#1454 if allocation fails, sss_mmap_cache_init may dereference NULL pointer
Closed: Invalid None Opened 8 years ago by jhrozek.

639 mc_ctx->file = talloc_asprintf(mc_ctx, "%s/%s",
640 SSS_NSS_MCACHE_DIR, name);
641 if (!mc_ctx->file) {

6
    Taking true branch
642 ret = ENOMEM;
643 goto done;

7
    Control jumps to line 708
644 }

Then in the error handler:

707 done:
708 if (ret) {

8
    Taking true branch
709 if (mc_ctx && mc_ctx->mmap_base) {

9
    Taking false branch
710 munmap(mc_ctx->mmap_base, mc_ctx->mmap_size);
711 }
712 if (mc_ctx && mc_ctx->fd != -1) {

10
    Taking true branch
713 close(mc_ctx->fd);
714 ret = unlink(mc_ctx->file);

11
    Null pointer passed as an argument to a 'nonnull' parameter
715 if (ret == -1) {
716 DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to rm mmap file %s: %d(%s)\n",
717 mc_ctx->file, ret, strerror(ret)));
718 }
719 }

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.9.0 RC2
rhbz: => 0

Note: This can not happen. The mc_ctx->fd is unconditionally set to -1 before the goto jump so the (mc_ctx && mc_ctx->fd != -1) condition will never be evaluated as true if the allocation fails.

resolution: => invalid
status: new => closed

Metadata Update from @jhrozek:
- Issue assigned to mzidek
- Issue set to the milestone: SSSD 1.9.0 RC1

3 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2496

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata