summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJakub Hrozek <jhrozek@redhat.com>2013-10-29 07:10:30 +0100
committerJakub Hrozek <jhrozek@redhat.com>2013-10-29 17:54:42 +0100
commit7812ef4742902c39d56959179ed033f9f7ff8ab2 (patch)
tree9a76dd39aafebe3aa0e2da4dadd7f98f20a66716
parent20d4e81545102cc0aec8ce24e76ca178d53f9175 (diff)
downloadsssd-7812ef4742902c39d56959179ed033f9f7ff8ab2.tar.gz
sssd-7812ef4742902c39d56959179ed033f9f7ff8ab2.tar.xz
sssd-7812ef4742902c39d56959179ed033f9f7ff8ab2.zip
NSS: Fix service enumeration
The code wrote into the middle of the packet to a space that was already reserved and allocated but then still advanced the pointer to the buffer. https://fedorahosted.org/sssd/ticket/2124
-rw-r--r--src/responder/nss/nsssrv_services.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/responder/nss/nsssrv_services.c b/src/responder/nss/nsssrv_services.c
index 79caa7d08..471cf31da 100644
--- a/src/responder/nss/nsssrv_services.c
+++ b/src/responder/nss/nsssrv_services.c
@@ -752,7 +752,11 @@ fill_service(struct sss_packet *packet,
written_aliases++;
talloc_zfree(tmpstr);
}
- SAFEALIGN_SET_UINT32(&body[aptr], written_aliases, &rsize);
+
+ /* We must not advance rsize here, the data has already been
+ * allocated and skipped earlier when aptr was assigned to.
+ */
+ SAFEALIGN_SET_UINT32(&body[aptr], written_aliases, NULL);
num++;
}