#1236 Potential NULL-dereference in sudosrv_cmd_get_sudorules
Closed: Fixed None Opened 12 years ago by sgallagh.

If dctx cannot be allocated, we should call {{{sudosrv_cmd_send_error()}}} directly instead of calling {{{sudosrv_cmd_done()}}} which dereferences dctx.

181    /* create domain ctx */
182    dctx = talloc_zero(cmd_ctx, struct sudo_dom_ctx);
At conditional (1): "!dctx" taking the true branch.
CID 12571: Dereference after null check (FORWARD_NULL)Comparing "dctx" to null implies that "dctx" might be null.
183    if (!dctx) {
184        ret = ENOMEM;
185        goto done;
186    }
187    dctx->cmd_ctx = cmd_ctx;
188    dctx->orig_username = NULL;
189    dctx->cased_username = NULL;

...

254done:
Passing null variable "dctx" to function "sudosrv_cmd_done", which dereferences it. [show details]
255    return sudosrv_cmd_done(dctx, ret);
256}

Fields changed

component: SSSD => SUDO Responder
priority: major => minor

An identical bug exists in {{{sudosrv_cmd_get_defaults()}}}

coverity: 12571 => 12571, 12570

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.9.0
rhbz: => 0

Fields changed

owner: somebody => pbrezina
status: new => assigned

Fields changed

patch: 0 => 1

Fixed by:

resolution: => fixed
status: assigned => closed

Fields changed

milestone: SSSD 1.9.0 => SSSD 1.8.1 (LTM)

Metadata Update from @sgallagh:
- Issue assigned to pbrezina
- Issue set to the milestone: SSSD 1.8.1 (LTM)

7 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2278

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata