From 17db46b22e1c2d1575af3c715d92c1f936dd005b Mon Sep 17 00:00:00 2001 From: Michal Zidek Date: Wed, 14 Aug 2013 18:22:06 +0200 Subject: mmap_cache: Off by one error. Removes off by one error when using macro MC_SIZE_TO_SLOTS and adds new macro MC_SLOT_WITHIN_BOUNDS. --- src/responder/nss/nsssrv_mmap_cache.c | 12 ++++++------ src/sss_client/nss_mc_group.c | 8 ++++---- src/sss_client/nss_mc_passwd.c | 8 ++++---- src/util/mmap_cache.h | 3 +++ 4 files changed, 17 insertions(+), 14 deletions(-) diff --git a/src/responder/nss/nsssrv_mmap_cache.c b/src/responder/nss/nsssrv_mmap_cache.c index 02527dac4..a1202c751 100644 --- a/src/responder/nss/nsssrv_mmap_cache.c +++ b/src/responder/nss/nsssrv_mmap_cache.c @@ -369,12 +369,12 @@ static struct sss_mc_rec *sss_mc_find_record(struct sss_mc_ctx *mcc, hash = sss_mc_hash(mcc, key->str, key->len); slot = mcc->hash_table[hash]; - if (slot > MC_SIZE_TO_SLOTS(mcc->dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, mcc->dt_size)) { return NULL; } while (slot != MC_INVALID_VAL) { - if (slot > MC_SIZE_TO_SLOTS(mcc->dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, mcc->dt_size)) { DEBUG(SSSDBG_FATAL_FAILURE, ("Corrupted fastcache. Slot number too big.\n")); sss_mmap_cache_reset(mcc); @@ -588,13 +588,13 @@ errno_t sss_mmap_cache_pw_invalidate_uid(struct sss_mc_ctx *mcc, uid_t uid) hash = sss_mc_hash(mcc, uidstr, strlen(uidstr) + 1); slot = mcc->hash_table[hash]; - if (slot > MC_SIZE_TO_SLOTS(mcc->dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, mcc->dt_size)) { ret = ENOENT; goto done; } while (slot != MC_INVALID_VAL) { - if (slot > MC_SIZE_TO_SLOTS(mcc->dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, mcc->dt_size)) { DEBUG(SSSDBG_FATAL_FAILURE, ("Corrupted fastcache.\n")); sss_mmap_cache_reset(mcc); ret = ENOENT; @@ -721,13 +721,13 @@ errno_t sss_mmap_cache_gr_invalidate_gid(struct sss_mc_ctx *mcc, gid_t gid) hash = sss_mc_hash(mcc, gidstr, strlen(gidstr) + 1); slot = mcc->hash_table[hash]; - if (slot > MC_SIZE_TO_SLOTS(mcc->dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, mcc->dt_size)) { ret = ENOENT; goto done; } while (slot != MC_INVALID_VAL) { - if (slot > MC_SIZE_TO_SLOTS(mcc->dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, mcc->dt_size)) { DEBUG(SSSDBG_FATAL_FAILURE, ("Corrupted fastcache.\n")); sss_mmap_cache_reset(mcc); ret = ENOENT; diff --git a/src/sss_client/nss_mc_group.c b/src/sss_client/nss_mc_group.c index 871857b07..40fbd072f 100644 --- a/src/sss_client/nss_mc_group.c +++ b/src/sss_client/nss_mc_group.c @@ -122,7 +122,7 @@ errno_t sss_nss_mc_getgrnam(const char *name, size_t name_len, /* If slot is not within the bounds of mmaped region and * it's value is not MC_INVALID_VAL, then the cache is * probbably corrupted. */ - while (slot < MC_SIZE_TO_SLOTS(gr_mc_ctx.dt_size)) { + while (MC_SLOT_WITHIN_BOUNDS(slot, gr_mc_ctx.dt_size)) { ret = sss_nss_mc_get_record(&gr_mc_ctx, slot, &rec); if (ret) { goto done; @@ -156,7 +156,7 @@ errno_t sss_nss_mc_getgrnam(const char *name, size_t name_len, slot = rec->next; } - if (slot >= MC_SIZE_TO_SLOTS(gr_mc_ctx.dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, gr_mc_ctx.dt_size)) { ret = ENOENT; goto done; } @@ -197,7 +197,7 @@ errno_t sss_nss_mc_getgrgid(gid_t gid, /* If slot is not within the bounds of mmaped region and * it's value is not MC_INVALID_VAL, then the cache is * probbably corrupted. */ - while (slot < MC_SIZE_TO_SLOTS(gr_mc_ctx.dt_size)) { + while (MC_SLOT_WITHIN_BOUNDS(slot, gr_mc_ctx.dt_size)) { ret = sss_nss_mc_get_record(&gr_mc_ctx, slot, &rec); if (ret) { goto done; @@ -218,7 +218,7 @@ errno_t sss_nss_mc_getgrgid(gid_t gid, slot = rec->next; } - if (slot >= MC_SIZE_TO_SLOTS(gr_mc_ctx.dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, gr_mc_ctx.dt_size)) { ret = ENOENT; goto done; } diff --git a/src/sss_client/nss_mc_passwd.c b/src/sss_client/nss_mc_passwd.c index e412fb404..353cd1146 100644 --- a/src/sss_client/nss_mc_passwd.c +++ b/src/sss_client/nss_mc_passwd.c @@ -123,7 +123,7 @@ errno_t sss_nss_mc_getpwnam(const char *name, size_t name_len, /* If slot is not within the bounds of mmaped region and * it's value is not MC_INVALID_VAL, then the cache is * probbably corrupted. */ - while (slot < MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) { + while (MC_SLOT_WITHIN_BOUNDS(slot, pw_mc_ctx.dt_size)) { ret = sss_nss_mc_get_record(&pw_mc_ctx, slot, &rec); if (ret) { goto done; @@ -158,7 +158,7 @@ errno_t sss_nss_mc_getpwnam(const char *name, size_t name_len, slot = rec->next; } - if (slot >= MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, pw_mc_ctx.dt_size)) { ret = ENOENT; goto done; } @@ -199,7 +199,7 @@ errno_t sss_nss_mc_getpwuid(uid_t uid, /* If slot is not within the bounds of mmaped region and * it's value is not MC_INVALID_VAL, then the cache is * probbably corrupted. */ - while (slot < MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) { + while (MC_SLOT_WITHIN_BOUNDS(slot, pw_mc_ctx.dt_size)) { ret = sss_nss_mc_get_record(&pw_mc_ctx, slot, &rec); if (ret) { goto done; @@ -220,7 +220,7 @@ errno_t sss_nss_mc_getpwuid(uid_t uid, slot = rec->next; } - if (slot >= MC_SIZE_TO_SLOTS(pw_mc_ctx.dt_size)) { + if (!MC_SLOT_WITHIN_BOUNDS(slot, pw_mc_ctx.dt_size)) { ret = ENOENT; goto done; } diff --git a/src/util/mmap_cache.h b/src/util/mmap_cache.h index 5350a0eb3..c04ce10df 100644 --- a/src/util/mmap_cache.h +++ b/src/util/mmap_cache.h @@ -68,6 +68,9 @@ typedef uint32_t rel_ptr_t; #define MC_SLOT_TO_PTR(base, slot, type) \ (type *)((base) + ((slot) * MC_SLOT_SIZE)) +#define MC_SLOT_WITHIN_BOUNDS(slot, dt_size) \ + ((slot) < ((dt_size) / MC_SLOT_SIZE)) + #define MC_VALID_BARRIER(val) (((val) & 0xff000000) == 0xf0000000) #define SSS_MC_MAJOR_VNO 0 -- cgit