From 49bc313040d96acab37f67c57d22bffac8fbe9c4 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 6 Aug 2013 21:15:42 +0200 Subject: LDAP: Fix crash when processing nested groups https://fedorahosted.org/sssd/ticket/1932 There is a rather strange workaround in the nested groups processing code that calls tevent_req_post outside _send(). However, it broke in certain situations where the tevent_req_call resulted in req being freed, which freed state by extension and then the subsequent _post call was a use-after-free. This patch saves the two variables used outside state so that it's safe to use them even after the callback. --- src/providers/ldap/sdap_async_groups.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c index 55111783c..9a1d66daa 100644 --- a/src/providers/ldap/sdap_async_groups.c +++ b/src/providers/ldap/sdap_async_groups.c @@ -3220,14 +3220,20 @@ static errno_t sdap_nested_group_lookup_user(struct tevent_req *req, return ret; } else if (ret == EOK) { DEBUG(SSSDBG_TRACE_FUNC, ("All done.\n")); + + /* Calling tevent req done might invoke callback which would + * zero out state */ + bool is_finished = state->send_finished; + struct tevent_context *ev = state->ev; + tevent_req_done(req); /** * FIXME: Rewrite nested group processing so we call * tevent_req_post() only in _send(). */ - if (state->send_finished == false) { - tevent_req_post(req, state->ev); + if (is_finished == false) { + tevent_req_post(req, ev); } } return EOK; @@ -3284,14 +3290,20 @@ static errno_t sdap_nested_group_lookup_group(struct tevent_req *req) return ret; } else if (ret == EOK) { DEBUG(SSSDBG_TRACE_FUNC, ("All done.\n")); + + /* Calling tevent req done might invoke callback which would + * zero out state */ + bool is_finished = state->send_finished; + struct tevent_context *ev = state->ev; + tevent_req_done(req); /** * FIXME: Rewrite nested group processing so we call * tevent_req_post() only in _send(). */ - if (state->send_finished == false) { - tevent_req_post(req, state->ev); + if (is_finished == false) { + tevent_req_post(req, ev); } } return EOK; -- cgit