summaryrefslogtreecommitdiff
path: root/src/responder/nss
diff options
context:
space:
mode:
authorSimo Sorce <simo@redhat.com>2012-12-19 11:56:27 -0500
committerJakub Hrozek <jhrozek@redhat.com>2012-12-20 19:55:02 +0100
commit8437e782fdf97945e9e0c2a793ffaf49abc2c0ca (patch)
tree9f233f5dafb160e556a636f52835923b0c190300 /src/responder/nss
parent10c50d237d6e3137499fcfaa5a804e6712e002ee (diff)
downloadsssd-8437e782fdf97945e9e0c2a793ffaf49abc2c0ca.tar.gz
sssd-8437e782fdf97945e9e0c2a793ffaf49abc2c0ca.tar.bz2
sssd-8437e782fdf97945e9e0c2a793ffaf49abc2c0ca.zip
nss_mc: Add extra checks when dereferencing records
Although it should enver happen that we pass in an invalid hash it is always better to just not do anything than access memory ouf of the hash table. It can lead to segfaults, or worse referencing memory that should not be touched.
Diffstat (limited to 'src/responder/nss')
-rw-r--r--src/responder/nss/nsssrv_mmap_cache.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/src/responder/nss/nsssrv_mmap_cache.c b/src/responder/nss/nsssrv_mmap_cache.c
index e312be19..2958bbac 100644
--- a/src/responder/nss/nsssrv_mmap_cache.c
+++ b/src/responder/nss/nsssrv_mmap_cache.c
@@ -106,6 +106,12 @@ static void sss_mc_add_rec_to_chain(struct sss_mc_ctx *mcc,
struct sss_mc_rec *cur;
uint32_t slot;
+ if (hash > mcc->ht_size) {
+ /* Invalid hash. This should never happen, but better
+ * return than trying to access out of bounds memory */
+ return;
+ }
+
slot = mcc->hash_table[hash];
if (slot == MC_INVALID_VAL) {
/* no previous record/collision, just add to hash table */
@@ -136,6 +142,12 @@ static void sss_mc_rm_rec_from_chain(struct sss_mc_ctx *mcc,
struct sss_mc_rec *cur = NULL;
uint32_t slot;
+ if (hash > mcc->ht_size) {
+ /* Invalid hash. This should never happen, but better
+ * return than trying to access out of bounds memory */
+ return;
+ }
+
slot = mcc->hash_table[hash];
cur = MC_SLOT_TO_PTR(mcc->data_table, slot, struct sss_mc_rec);
if (cur == rec) {