New subject: [sssd PR#126][comment] ldap_child: Fix use after free

17 Jan 2017


      URL: https://github.com/SSSD/sssd/pull/126
Author: lslebodn
 Title: #126: ldap_child: Fix use after free
Action: opened
PR body:
"""
In case on any krb5 related error, we tried to send string
interpretation of krb5 error tb parrent in prepare_response.
However, we cannot use global krb5 context (krb5_error_ctx)
because the context is every time released in done section of
ldap_child_get_tgt_sync.
This patch rather return duplicated string to prevent use after free.
Backtrace:
```
 #0  __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
 100     ../sysdeps/x86_64/multiarch/strchr.S: No such file or directory.
Thread 1 (Thread 0x7fc96cad5880 (LWP 11201)):
 #0  __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
 No locals.
 #1  0x00007fc96be43725 in err_fmt_fmt (msg=0x7fc96d1cf8d0 "Cannot find KDC for requested realm",
                                        code=-1765328230,
                                        err_fmt=<optimized out>) at kerrs.c:152
        buf = {buftype = K5BUF_DYNAMIC, data = 0x7fc96d1cdb10,
               space = 128, len = 0}
        p = <optimized out>
        s = 0xdededededededede <Address 0xdededededededede out of bounds>
 #2  krb5_get_error_message (ctx=<optimized out>,
                             code=code@entry=-1765328230) at kerrs.c:184
        std = 0x7fc96d1cf8d0 "Cannot find KDC for requested realm"
 #3  0x00007fc96cb224e5 in sss_krb5_get_error_message (ctx=<optimized out>,
                                                       ec=ec@entry=-1765328230) at src/util/sss_krb5.c:424
 No locals.
 #4  0x00007fc96cb1fbb0 in prepare_response (rsp=<synthetic pointer>,
                                             kerr=-1765328230, expire_time=0,
                                             ccname=0x0,
                                             mem_ctx=0x7fc96d1cb390) at src/providers/ldap/ldap_child.c:553
        ret = <optimized out>
        r = 0x7fc96d1cd8b0
        krb5_msg = 0x0
```
Related parts of logs:
```
[System Logs]:
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$@EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$@EXAMPLE.COM' not found in Kerberos database
Jan 17 06:20:08 fserver-1658118.example.com kernel: traps: ldap_child[15788] general protection ip:7f7faf2e505a sp:7ffd3f768478 error:0 in libc-2.17.so[7f7faf260000+1b6000]
Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core
[User Logs]:
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$@EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$@EXAMPLE.COM' not found in Kerberos database
Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core
```
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/126/head:pr126
git checkout pr126

[sssd PR#126][opened] ldap_child: Fix use after free