[Freeipa-devel] [PATCH 0071] Fix potential crash caused by failing zone_register allocation.

[Adam Tkac]

On Tue, Oct 02, 2012 at 03:21:08PM +0200, Petr Spacek wrote:
> Hello,
> 
> Fix potential crash caused by failing zone_register allocation.
> 
> Problematic call flow:
> new_ldap_instance -> zr_create (returns failure) ->
> destroy_ldap_instance -> zr_get_rbt (*crash*)

Ack

> From 9d96a9c4a4ac5b592ed5874132e0618b1b259de0 Mon Sep 17 00:00:00 2001
> From: Petr Spacek <pspacek at redhat.com>
> Date: Tue, 2 Oct 2012 15:16:27 +0200
> Subject: [PATCH] Fix potential crash caused by failing zone_register
>  allocation.
> 
> Signed-off-by: Petr Spacek <pspacek at redhat.com>
> ---
>  src/ldap_helper.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/src/ldap_helper.c b/src/ldap_helper.c
> index 38d86afa521dcf0e6b58ebb38635ff0fffbedd2a..629c76732c86af2a614e589a5afff18136068a66 100644
> --- a/src/ldap_helper.c
> +++ b/src/ldap_helper.c
> @@ -516,7 +516,7 @@ destroy_ldap_instance(ldap_instance_t **ldap_instp)
>  {
>  	ldap_instance_t *ldap_inst;
>  	dns_rbtnodechain_t chain;
> -	dns_rbt_t *rbt;
> +	dns_rbt_t *rbt = NULL;
>  	isc_result_t result = ISC_R_SUCCESS;
>  	const char *db_name;
>  
> @@ -530,7 +530,10 @@ destroy_ldap_instance(ldap_instance_t **ldap_instp)
>  	 *
>  	 * NOTE: This should be probably done in zone_register.c
>  	 */
> -	rbt = zr_get_rbt(ldap_inst->zone_register);
> +	if (ldap_inst->zone_register != NULL)
> +		rbt = zr_get_rbt(ldap_inst->zone_register);
> +	if (rbt == NULL)
> +		result = ISC_R_NOTFOUND;
>  
>  	/* Potentially ISC_R_NOSPACE can occur. Destroy codepath has no way to
>  	 * return errors, so kill BIND.
> -- 
> 1.7.11.4
> 


-- 
Adam Tkac, Red Hat, Inc.