summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSimo Sorce <simo@redhat.com>2012-12-19 11:56:27 -0500
committerJakub Hrozek <jhrozek@redhat.com>2012-12-20 19:55:02 +0100
commit8437e782fdf97945e9e0c2a793ffaf49abc2c0ca (patch)
tree9f233f5dafb160e556a636f52835923b0c190300
parent10c50d237d6e3137499fcfaa5a804e6712e002ee (diff)
downloadsssd-8437e782fdf97945e9e0c2a793ffaf49abc2c0ca.tar.gz
sssd-8437e782fdf97945e9e0c2a793ffaf49abc2c0ca.tar.bz2
sssd-8437e782fdf97945e9e0c2a793ffaf49abc2c0ca.zip
nss_mc: Add extra checks when dereferencing records
Although it should enver happen that we pass in an invalid hash it is always better to just not do anything than access memory ouf of the hash table. It can lead to segfaults, or worse referencing memory that should not be touched.
-rw-r--r--src/responder/nss/nsssrv_mmap_cache.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/src/responder/nss/nsssrv_mmap_cache.c b/src/responder/nss/nsssrv_mmap_cache.c
index e312be19..2958bbac 100644
--- a/src/responder/nss/nsssrv_mmap_cache.c
+++ b/src/responder/nss/nsssrv_mmap_cache.c
@@ -106,6 +106,12 @@ static void sss_mc_add_rec_to_chain(struct sss_mc_ctx *mcc,
struct sss_mc_rec *cur;
uint32_t slot;
+ if (hash > mcc->ht_size) {
+ /* Invalid hash. This should never happen, but better
+ * return than trying to access out of bounds memory */
+ return;
+ }
+
slot = mcc->hash_table[hash];
if (slot == MC_INVALID_VAL) {
/* no previous record/collision, just add to hash table */
@@ -136,6 +142,12 @@ static void sss_mc_rm_rec_from_chain(struct sss_mc_ctx *mcc,
struct sss_mc_rec *cur = NULL;
uint32_t slot;
+ if (hash > mcc->ht_size) {
+ /* Invalid hash. This should never happen, but better
+ * return than trying to access out of bounds memory */
+ return;
+ }
+
slot = mcc->hash_table[hash];
cur = MC_SLOT_TO_PTR(mcc->data_table, slot, struct sss_mc_rec);
if (cur == rec) {