AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-08 14:20:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response (bug 31678)

Browse Source 
The addgetnetgrentX call in addinnetgrX may have failed to produce
a result, so the result variable in addinnetgrX can be NULL.
Use db->negtimeout as the fallback value if there is no result data;
the timeout is also overwritten below.

Also avoid sending a second not-found response.  (The client
disconnects after receiving the first response, so the data stream did
not go out of sync even without this fix.)  It is still beneficial to
add the negative response to the mapping, so that the client can get
it from there in the future, instead of going through the socket.

Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
This commit is contained in:
Florian Weimer 2024-04-25 15:01:07 +02:00
parent 7835b00dbc
commit b048a482f0
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
nscd/netgroupcache.c
View File

@ -511,14 +511,15 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len, datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len,
sizeof (innetgroup_response_header), sizeof (innetgroup_response_header),
he == NULL ? 0 : dh->nreloads + 1, result->head.ttl); he == NULL ? 0 : dh->nreloads + 1,
result == NULL ? db->negtimeout : result->head.ttl);
/* Set the notfound status and timeout based on the result from /* Set the notfound status and timeout based on the result from
getnetgrent. */ getnetgrent. */
dataset->head.notfound = result->head.notfound; dataset->head.notfound = result == NULL || result->head.notfound;
dataset->head.timeout = timeout; dataset->head.timeout = timeout;
dataset->resp.version = NSCD_VERSION; dataset->resp.version = NSCD_VERSION;
dataset->resp.found = result->resp.found; dataset->resp.found = result != NULL && result->resp.found;
/* Until we find a matching entry the result is 0. */ /* Until we find a matching entry the result is 0. */
dataset->resp.result = 0; dataset->resp.result = 0;
@ -566,7 +567,9 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
goto out; goto out;
} }
if (he == NULL) /* addgetnetgrentX may have already sent a notfound response. Do
not send another one. */
if (he == NULL && dataset->resp.found)
{ {
/* We write the dataset before inserting it to the database /* We write the dataset before inserting it to the database
since while inserting this thread might block and so would since while inserting this thread might block and so would