Hello,
please see attached trivial patch.
Thanks.
From 64a6f29514e6898d02b6df49f9e28b900369ea33 Mon Sep 17 00:00:00 2001
From: Pavel Reichl <[email protected]>
Date: Wed, 23 Jul 2014 22:02:44 +0200
Subject: [PATCH] SDAP: fix use after free in async_initgroups
Request is freed if creation of subrequest fails and ENOMEM is returned.
This would lead to use after free as returned value is checked on
caller's side and (already freed) request would be marked as erroneous.
---
src/providers/ldap/sdap_async_initgroups.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index d3c727591e6ed47a11799fdde06102286a5fc5d6..2eecdf9a3e9a42fdfd101132b0b856540893cee7 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -1638,7 +1638,6 @@ static errno_t sdap_initgr_rfc2307bis_next_base(struct tevent_req *req)
state->timeout,
true);
if (!subreq) {
- talloc_zfree(req);
return ENOMEM;
}
tevent_req_set_callback(subreq, sdap_initgr_rfc2307bis_process, req);
--
1.9.3
_______________________________________________
sssd-devel mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
