diff options
| author | Pavel Březina <pbrezina@redhat.com> | 2013-08-22 14:38:54 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-08-30 14:23:46 +0200 |
| commit | 69fff40717fb81c75e6d559107d8d29f5f847639 (patch) | |
| tree | 09a930e704de613ab073457a08e828899a838469 | |
| parent | 2a5d1df12b6011c71794b7dceb0d969340532a77 (diff) | |
| download | sssd-1.9.2-124.el6.tar.gz sssd-1.9.2-124.el6.tar.xz sssd-1.9.2-124.el6.zip | |
sss_packet_grow: correctly pad packet length to 512Bsssd-1.9.2-124.el6
https://fedorahosted.org/sssd/ticket/2059
If len % SSSSRV_PACKET_MEM_SIZE == 0 or some low number,
we can end up with totlen < len and return EINVAL.
It also does not pad the length, but usually allocates
much more memory than is desired.
len = 1024
n = 1024 % 512 + 1 = 0 + 1 = 1
totlen = 1 * 512 = 512
=> totlen < len
len = 511
n = 511 % 512 + 1 = 511 + 1
totlen = 512 * 512 = 262144
totlen is way bigger than it was supposed to be
| -rw-r--r-- | src/responder/common/responder_packet.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c index 5132d955b..6476bd6e5 100644 --- a/src/responder/common/responder_packet.c +++ b/src/responder/common/responder_packet.c @@ -105,7 +105,7 @@ int sss_packet_grow(struct sss_packet *packet, size_t size) /* make sure we do not overflow */ if (totlen < len) { - int n = len % SSSSRV_PACKET_MEM_SIZE + 1; + int n = len / SSSSRV_PACKET_MEM_SIZE + 1; totlen += n * SSSSRV_PACKET_MEM_SIZE; if (totlen < len) { return EINVAL; |