summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPavel Březina <pbrezina@redhat.com>2013-08-22 14:38:54 +0200
committerJakub Hrozek <jhrozek@redhat.com>2013-08-28 16:21:59 +0200
commit0574adc1fa6a544b8a86b551dfb2a1442d46432c (patch)
tree85dcb04a5412bb338cc369823a07ade5d6bf7d04
parent0681ea99f2e2e782e0768fdc95f67f959f384799 (diff)
downloadsssd-0574adc1fa6a544b8a86b551dfb2a1442d46432c.tar.gz
sssd-0574adc1fa6a544b8a86b551dfb2a1442d46432c.tar.xz
sssd-0574adc1fa6a544b8a86b551dfb2a1442d46432c.zip
sss_packet_grow: correctly pad packet length to 512B
https://fedorahosted.org/sssd/ticket/2059 If len % SSSSRV_PACKET_MEM_SIZE == 0 or some low number, we can end up with totlen < len and return EINVAL. It also does not pad the length, but usually allocates much more memory than is desired. len = 1024 n = 1024 % 512 + 1 = 0 + 1 = 1 totlen = 1 * 512 = 512 => totlen < len len = 511 n = 511 % 512 + 1 = 511 + 1 totlen = 512 * 512 = 262144 totlen is way bigger than it was supposed to be
-rw-r--r--src/responder/common/responder_packet.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c
index 5132d955b..6476bd6e5 100644
--- a/src/responder/common/responder_packet.c
+++ b/src/responder/common/responder_packet.c
@@ -105,7 +105,7 @@ int sss_packet_grow(struct sss_packet *packet, size_t size)
/* make sure we do not overflow */
if (totlen < len) {
- int n = len % SSSSRV_PACKET_MEM_SIZE + 1;
+ int n = len / SSSSRV_PACKET_MEM_SIZE + 1;
totlen += n * SSSSRV_PACKET_MEM_SIZE;
if (totlen < len) {
return EINVAL;