#1454 if allocation fails, sss_mmap_cache_init may dereference NULL pointer
Closed: Invalid None Opened 7 years ago by jhrozek.

639 mc_ctx->file = talloc_asprintf(mc_ctx, "%s/%s",
640 SSS_NSS_MCACHE_DIR, name);
641 if (!mc_ctx->file) {

6
    Taking true branch
642 ret = ENOMEM;
643 goto done;

7
    Control jumps to line 708
644 }

Then in the error handler:

707 done:
708 if (ret) {

8
    Taking true branch
709 if (mc_ctx && mc_ctx->mmap_base) {

9
    Taking false branch
710 munmap(mc_ctx->mmap_base, mc_ctx->mmap_size);
711 }
712 if (mc_ctx && mc_ctx->fd != -1) {

10
    Taking true branch
713 close(mc_ctx->fd);
714 ret = unlink(mc_ctx->file);

11
    Null pointer passed as an argument to a 'nonnull' parameter
715 if (ret == -1) {
716 DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to rm mmap file %s: %d(%s)\n",
717 mc_ctx->file, ret, strerror(ret)));
718 }
719 }

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.9.0 RC2
rhbz: => 0

Note: This can not happen. The mc_ctx->fd is unconditionally set to -1 before the goto jump so the (mc_ctx && mc_ctx->fd != -1) condition will never be evaluated as true if the allocation fails.

resolution: => invalid
status: new => closed

Metadata Update from @jhrozek:
- Issue assigned to mzidek
- Issue set to the milestone: SSSD 1.9.0 RC1

2 years ago

Login to comment on this ticket.

Metadata