diff options
author | Jakub Hrozek <jhrozek@redhat.com> | 2013-10-29 07:10:30 +0100 |
---|---|---|
committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-10-29 17:54:42 +0100 |
commit | 7812ef4742902c39d56959179ed033f9f7ff8ab2 (patch) | |
tree | 9a76dd39aafebe3aa0e2da4dadd7f98f20a66716 | |
parent | 20d4e81545102cc0aec8ce24e76ca178d53f9175 (diff) | |
download | sssd-7812ef4742902c39d56959179ed033f9f7ff8ab2.tar.gz sssd-7812ef4742902c39d56959179ed033f9f7ff8ab2.tar.xz sssd-7812ef4742902c39d56959179ed033f9f7ff8ab2.zip |
NSS: Fix service enumeration
The code wrote into the middle of the packet to a space that was already
reserved and allocated but then still advanced the pointer to the buffer.
https://fedorahosted.org/sssd/ticket/2124
-rw-r--r-- | src/responder/nss/nsssrv_services.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/responder/nss/nsssrv_services.c b/src/responder/nss/nsssrv_services.c index 79caa7d08..471cf31da 100644 --- a/src/responder/nss/nsssrv_services.c +++ b/src/responder/nss/nsssrv_services.c @@ -752,7 +752,11 @@ fill_service(struct sss_packet *packet, written_aliases++; talloc_zfree(tmpstr); } - SAFEALIGN_SET_UINT32(&body[aptr], written_aliases, &rsize); + + /* We must not advance rsize here, the data has already been + * allocated and skipped earlier when aptr was assigned to. + */ + SAFEALIGN_SET_UINT32(&body[aptr], written_aliases, NULL); num++; } |