diff options
| author | Pavel Reichl <preichl@redhat.com> | 2014-04-25 14:42:39 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2014-04-30 19:06:43 +0200 |
| commit | ed61bfc5184d9c7a46d17681a22a1abb64423708 (patch) | |
| tree | f9255cecdc3e146ce8747fb8ca9bb08b497b2532 | |
| parent | cef2384a3a6fc1a1637c6a55e2bced93d28e8fca (diff) | |
| download | sssd-ed61bfc5184d9c7a46d17681a22a1abb64423708.tar.gz sssd-ed61bfc5184d9c7a46d17681a22a1abb64423708.tar.xz sssd-ed61bfc5184d9c7a46d17681a22a1abb64423708.zip | |
AD Provider: bugfix use-after-free
Resolves:
https://fedorahosted.org/sssd/ticket/2322
Reviewed-by: Sumit Bose <sbose@redhat.com>
| -rw-r--r-- | src/providers/data_provider_be.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c index ec2c0fa5d..1982b9315 100644 --- a/src/providers/data_provider_be.c +++ b/src/providers/data_provider_be.c @@ -193,7 +193,8 @@ void be_req_terminate(struct be_req *be_req, void be_terminate_domain_requests(struct be_ctx *be_ctx, const char *domain) { - struct be_req *be_req = NULL; + struct be_req *be_req; + struct be_req *next_be_req; DEBUG(SSSDBG_TRACE_FUNC, "Terminating requests for domain [%s]\n", domain); @@ -203,11 +204,15 @@ void be_terminate_domain_requests(struct be_ctx *be_ctx, return; } - DLIST_FOR_EACH(be_req, be_ctx->active_requests) { + be_req = be_ctx->active_requests; + while (be_req) { + /* save pointer to next request in case be_req will be freed */ + next_be_req = be_req->next; if (strcmp(domain, be_req->domain->name) == 0) { be_req_terminate(be_req, DP_ERR_FATAL, ERR_DOMAIN_NOT_FOUND, sss_strerror(ERR_DOMAIN_NOT_FOUND)); } + be_req = next_be_req; } } |