RFC2307bis initgroups: fix nested groups processing

Due to incorrectly written loop, SSSD would go into infitite loop if it
processed the same group on two different levels of membership.

1 files changed, 33 insertions, 20 deletions

diff --git a/src/providers/ldap/sdap_async_accounts.c b/src/providers/ldap/sdap_async_accounts.c
index 6f1e5281..e6027f85 100644
--- a/src/providers/ldap/sdap_async_accounts.c
+++ b/src/providers/ldap/sdap_async_accounts.c
@@ -5558,17 +5558,23 @@ static void rfc2307bis_nested_groups_process(struct tevent_req *subreq)
          * Move on to the next group
          */
         state->group_iter++;
-        if (state->group_iter < state->num_groups) {
-            do {
-                ret = rfc2307bis_nested_groups_step(req);
-                if (ret != EOK && ret != EAGAIN) {
-                    tevent_req_error(req, ret);
-                    return;
-                }
-            } while (ret == EOK);
+        while (state->group_iter < state->num_groups) {
+            ret = rfc2307bis_nested_groups_step(req);
+            if (ret == EAGAIN) {
+                /* Looking up parent groups.. */
+                return;
+            } else if (ret != EOK) {
+                tevent_req_error(req, ret);
+                return;
+            }
+
             /* EOK means this group has already been processed
-             * in another level */
-        } else {
+             * in another nesting level */
+            state->group_iter++;
+        }
+
+        if (state->group_iter == state->num_groups) {
+            /* All groups processed. Done. */
             tevent_req_done(req);
         }
         return;
@@ -5613,18 +5619,25 @@ static void rfc2307bis_nested_groups_done(struct tevent_req *subreq)
     }
 
     state->group_iter++;
-    if (state->group_iter < state->num_groups) {
-        do {
-            ret = rfc2307bis_nested_groups_step(req);
-            if (ret != EOK && ret != EAGAIN) {
-                tevent_req_error(req, ret);
-                return;
-            }
-        } while (ret == EOK);
+    while (state->group_iter < state->num_groups) {
+        ret = rfc2307bis_nested_groups_step(req);
+        if (ret == EAGAIN) {
+            /* Looking up parent groups.. */
+            return;
+        } else if (ret != EOK) {
+            tevent_req_error(req, ret);
+            return;
+        }
+
         /* EOK means this group has already been processed
-         * in another level */
-    } else {
+         * in another nesting level */
+        state->group_iter++;
+    }
+
+    if (state->group_iter == state->num_groups) {
+        /* All groups processed. Done. */
         tevent_req_done(req);
+        return;
     }
 }