Fix memory hierarchy when processing nested group memberships

https://fedorahosted.org/sssd/ticket/1186

4 files changed, 14 insertions, 11 deletions

diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index feb13db98..061a99c8e 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -1323,10 +1323,10 @@ static void sdap_get_groups_process(struct tevent_req *subreq)
         }
 
         /* Copy the new groups into the list
-         * They're already allocated on 'state'
          */
         for (i = 0; i < count; i++) {
-            state->groups[state->count + i] = groups[i];
+            state->groups[state->count + i] =
+                talloc_steal(state->groups, groups[i]);
         }
 
         state->count += count;
diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c
index 964f5b0a0..5e0e184ad 100644
--- a/src/providers/ldap/sdap_async_initgroups.c
+++ b/src/providers/ldap/sdap_async_initgroups.c
@@ -426,10 +426,10 @@ static void sdap_initgr_rfc2307_process(struct tevent_req *subreq)
         }
 
         /* Copy the new groups into the list.
-         * They're already allocated on 'state'.
          */
         for (i = 0; i < count; i++) {
-            state->ldap_groups[state->ldap_groups_count + i] = ldap_groups[i];
+            state->ldap_groups[state->ldap_groups_count + i] =
+                talloc_steal(state->ldap_groups, ldap_groups[i]);
         }
 
         state->ldap_groups_count += count;
@@ -1553,11 +1553,10 @@ static void sdap_initgr_rfc2307bis_process(struct tevent_req *subreq)
         }
 
         /* Copy the new groups into the list.
-         * They're already allocated on 'state'.
          */
         for (i = 0; i < count; i++) {
             state->direct_groups[state->num_direct_parents + i] =
-                    ldap_groups[i];
+                    talloc_steal(state->direct_groups, ldap_groups[i]);
         }
 
         state->num_direct_parents += count;
@@ -2204,10 +2203,13 @@ static void rfc2307bis_nested_groups_process(struct tevent_req *subreq)
         }
 
         /* Copy the new groups into the list.
-         * They're already allocated on 'state'.
+         * They're allocated on 'state' so we need to move them
+         * onto ldap_parents so that the data won't disappear when
+         * we finish this nesting level.
          */
         for (i = 0; i < count; i++) {
-            state->ldap_parents[state->parents_count + i] = ldap_groups[i];
+            state->ldap_parents[state->parents_count + i] =
+                talloc_steal(state->ldap_parents, ldap_groups[i]);
         }
 
         state->parents_count += count;
diff --git a/src/providers/ldap/sdap_async_services.c b/src/providers/ldap/sdap_async_services.c
index b472e4072..5bc044630 100644
--- a/src/providers/ldap/sdap_async_services.c
+++ b/src/providers/ldap/sdap_async_services.c
@@ -199,10 +199,10 @@ sdap_get_services_process(struct tevent_req *subreq)
         }
 
         /* Copy the new services into the list
-         * They're already allocated on 'state'
          */
         for (i = 0; i < count; i++) {
-            state->services[state->count + i] = services[i];
+            state->services[state->count + i] =
+                talloc_steal(state->services, services[i]);
         }
 
         state->count += count;
diff --git a/src/providers/ldap/sdap_async_users.c b/src/providers/ldap/sdap_async_users.c
index fa9c0a799..a8595ac89 100644
--- a/src/providers/ldap/sdap_async_users.c
+++ b/src/providers/ldap/sdap_async_users.c
@@ -528,7 +528,8 @@ static void sdap_get_users_process(struct tevent_req *subreq)
          * They're already allocated on 'state'
          */
         for (i = 0; i < count; i++) {
-            state->users[state->count + i] = users[i];
+            state->users[state->count + i] =
+                talloc_steal(state->users, users[i]);
         }
 
         state->count += count;