summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLukas Slebodnik <lslebodn@redhat.com>2014-08-20 17:04:34 +0200
committerJakub Hrozek <jhrozek@redhat.com>2014-08-22 10:51:35 +0200
commit0060992d68ba843d4d90b491a1500b6290789a5c (patch)
tree01fece275f701de6f2eb87df27d5d1009c94029c
parent24000ed5b08499b49595436b8a3b348fcd4012de (diff)
downloadsssd-0060992d68ba843d4d90b491a1500b6290789a5c.tar.gz
sssd-0060992d68ba843d4d90b491a1500b6290789a5c.tar.xz
sssd-0060992d68ba843d4d90b491a1500b6290789a5c.zip
dyndns: Fix talloc hierarchy of "struct sss_iface_addr"
Structure "struct sdap_dyndns_update_state" has two linked lists of structures "struct sss_iface_addr": addresses, dns_addrlist In *_recv functions, linked list was talloc stealed to structure sss_iface_addr, but just 1st member was moved to "state" talloc context. Other member of link list were freed with removing subrequest, which caused use after free problem. Resolves: https://fedorahosted.org/sssd/ticket/2405 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
-rw-r--r--src/providers/dp_dyndns.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/src/providers/dp_dyndns.c b/src/providers/dp_dyndns.c
index a12560ecd..31b452afe 100644
--- a/src/providers/dp_dyndns.c
+++ b/src/providers/dp_dyndns.c
@@ -66,6 +66,9 @@ sss_iface_addr_add(TALLOC_CTX *mem_ctx, struct sss_iface_addr **list,
talloc_zfree(address);
return NULL;
}
+
+ /* steal old dlist to the new head */
+ talloc_steal(address, *list);
DLIST_ADD(*list, address);
return address;
@@ -212,6 +215,9 @@ sss_iface_addr_list_get(TALLOC_CTX *mem_ctx, const char *ifname,
ret = ENOMEM;
goto done;
}
+
+ /* steal old dlist to the new head */
+ talloc_steal(address, addrlist);
DLIST_ADD(addrlist, address);
}
}
@@ -650,6 +656,9 @@ nsupdate_get_addrs_done(struct tevent_req *subreq)
if (state->addrlist) {
talloc_steal(state->addrlist, addr);
}
+
+ /* steal old dlist to the new head */
+ talloc_steal(addr, state->addrlist);
DLIST_ADD(state->addrlist, addr);
}
state->count += count;