Bug 214207

Summary: Corrupted user-name
Product: [Fedora] Fedora Reporter: Enrico Scholz <rh-bugzilla>
Component: mod_auth_kerbAssignee: Joe Orton <jorton>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 6CC: nutello
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 5.3-2.fc6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-03-23 13:32:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Enrico Scholz 2006-11-06 16:07:14 UTC 
Description of problem:

mod_auth_kerb seems to corrupt the username:

| XXXXXX - ensc@XXXXX [06/Nov/2006:16:55:32 +0100] "GET ...
| XXXXXX - \x02 [06/Nov/2006:16:55:34 +0100]

Logfile shows

| ... using cached name , referer: ...
| ... using cached name o_mini.png, ...

like entries.


This seems to be caused by the -cache patch which does:

|  MK_USER = apr_pstrdup(r->pool, output_token.value);
|  ...
|      rv = apr_pool_userdata_set(r->user, NAMEKEY, NULL, r->connection->pool);
| ----
|      if (apr_pool_userdata_get(&data, NAMEKEY, r->connection->pool) == APR_SUCCESS


When having a multi-request connection, the 'r->pool' might be freed
while the 'r->connection->pool' is still alive and returns corrupted
memory.

I suggest to write

|-  MK_USER = apr_pstrdup(r->pool, output_token.value);
|+  MK_USER = apr_pstrdup(r->connection->pool, output_token.value);

which seems to fix the problem for me.


Version-Release number of selected component (if applicable):

mod_auth_kerb-5.1-3
Comment 1 Joe Orton 2006-11-06 16:11:58 UTC 
Good catch, thanks!
Comment 2 Rudi Chiarito 2006-11-29 21:02:16 UTC 
This bug was fixed in today's update for FC5, but it remains open for FC6. I can
confirm that rebuilding 5.3-2 under FC6 solves the problem (it was triggering
very bizarre error messages from Subversion for us). Please release an official
FC6 package as well.
Comment 3 Joe Orton 2006-11-30 09:54:27 UTC 
Ah, sorry, I forgot to hit the "push" button on the FC6 update yesterday, it's
on its way now.
Comment 4 Fedora Update System 2006-11-30 15:31:07 UTC 
mod_auth_kerb-5.3-2.fc6 has been pushed for fc6, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.