Skip to content

Commit

Permalink
RESPONDER: user proper context for getDomains()
Browse files Browse the repository at this point in the history
Request was created on a long term responder context, but a callback
for this request tries to access memory that is allocated on a short
term client context. So if client disconnects before request is
completed, then callback dereferences already freed memory.

Resolves: #7319
  • Loading branch information
alexey-tikhonov committed Apr 26, 2024
1 parent 54179a0 commit 106c641
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion src/responder/pac/pacsrv_cmd.c
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ static errno_t pac_add_pac_user(struct cli_ctx *cctx)
ret = responder_get_domain_by_id(cctx->rctx, pr_ctx->user_dom_sid_str,
&pr_ctx->dom);
if (ret == EAGAIN || ret == ENOENT) {
req = sss_dp_get_domains_send(cctx->rctx, cctx->rctx, true,
req = sss_dp_get_domains_send(cctx, cctx->rctx, true,
pr_ctx->domain_name);
if (req == NULL) {
ret = ENOMEM;
Expand Down
2 changes: 1 addition & 1 deletion src/responder/pam/pamsrv_cmd.c
Original file line number Diff line number Diff line change
Expand Up @@ -1929,7 +1929,7 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)

ret = pam_forwarder_parse_data(cctx, pd);
if (ret == EAGAIN) {
req = sss_dp_get_domains_send(cctx->rctx, cctx->rctx, true, pd->domain);
req = sss_dp_get_domains_send(cctx, cctx->rctx, true, pd->domain);
if (req == NULL) {
ret = ENOMEM;
} else {
Expand Down

0 comments on commit 106c641

Please sign in to comment.