AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-25 06:20:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2024-33600: nscd: Do not send missing not-found response in addgetnetgrentX (bug 31678)

Browse Source 
If we failed to add a not-found response to the cache, the dataset
point can be null, resulting in a null pointer dereference.

Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
This commit is contained in:
Florian Weimer 2024-04-25 15:01:07 +02:00
parent 87801a8fd0
commit 7835b00dbc
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
nscd/netgroupcache.c
View File

@ -147,7 +147,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
/* No such service. */ /* No such service. */
cacheable = do_notfound (db, fd, req, key, &dataset, &total, &timeout, cacheable = do_notfound (db, fd, req, key, &dataset, &total, &timeout,
&key_copy); &key_copy);
goto writeout; goto maybe_cache_add;
} }
memset (&data, '\0', sizeof (data)); memset (&data, '\0', sizeof (data));
@ -348,7 +348,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
{ {
cacheable = do_notfound (db, fd, req, key, &dataset, &total, &timeout, cacheable = do_notfound (db, fd, req, key, &dataset, &total, &timeout,
&key_copy); &key_copy);
goto writeout; goto maybe_cache_add;
} }
total = buffilled; total = buffilled;
@ -410,14 +410,12 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
} }
if (he == NULL && fd != -1) if (he == NULL && fd != -1)
{ /* We write the dataset before inserting it to the database since
/* We write the dataset before inserting it to the database while inserting this thread might block and so would
since while inserting this thread might block and so would unnecessarily let the receiver wait. */
unnecessarily let the receiver wait. */
writeout:
writeall (fd, &dataset->resp, dataset->head.recsize); writeall (fd, &dataset->resp, dataset->head.recsize);
}
maybe_cache_add:
if (cacheable) if (cacheable)
{ {
/* If necessary, we also propagate the data to disk. */ /* If necessary, we also propagate the data to disk. */