Bug 1061133 - segfault in gssi_inquire_context
Summary: segfault in gssi_inquire_context
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: gssproxy
Version: 20
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Guenther Deschner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-02-04 12:31 UTC by Guenther Deschner
Modified: 2014-04-02 09:14 UTC (History)
2 users (show)

Fixed In Version: gssproxy-0.3.1-1.fc20
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-04-02 09:14:33 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
patch for master (1.68 KB, patch)
2014-02-04 12:33 UTC, Guenther Deschner
gdeschner: review+
Details | Diff

Description Guenther Deschner 2014-02-04 12:31:39 UTC
Description of problem:
obvious NULL pointer derreference

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. 

Actual results:


Expected results:


Additional info:

GSS_USE_PROXY=1 gdb --args ldapsearch -Y GSSAPI -h ipaserver -b "dc=ipadom,dc=ber,dc=redhat,dc=com"
GNU gdb (GDB) Fedora 7.6.50.20130731-19.fc20
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
..
Reading symbols from /usr/bin/ldapsearch...Reading symbols from /usr/lib/debug/usr/bin/ldapsearch.debug...done.
done.
(gdb) r
Starting program: /usr/bin/ldapsearch -Y GSSAPI -h ipaserver -b dc=ipadom,dc=ber,dc=redhat,dc=com
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
SASL/GSSAPI authentication started

Program received signal SIGSEGV, Segmentation fault.
val_inq_ctx_args (lifetime_rec=0x0, ctx_flags=0x0, locally_initiated=locally_initiated@entry=0x0, opened=0x0, mech_type=0x7fffffff9480, targ_name=0x10, src_name=0x555555777fc0, context_handle=0x55555577a080, minor_status=0x7fffffff946c)
    at g_inq_context.c:56
56              *targ_name = GSS_C_NO_NAME;
Missing separate debuginfos, use: debuginfo-install keyutils-libs-1.5.8-1.fc20.x86_64 libdb-5.3.28-1.fc20.x86_64 nspr-4.10.2-1.fc20.x86_64 nss-3.15.4-1.fc20.x86_64 nss-mdns-0.10-13.fc20.x86_64 nss-softokn-freebl-3.15.4-1.fc20.x86_64 nss-util-3.15.4-1.fc20.x86_64 openssl-libs-1.0.1e-37.fc20.x86_64 pcre-8.33-2.fc20.1.x86_64 sssd-client-1.11.3-1.fc20.x86_64 xz-libs-5.1.2-6alpha.fc20.x86_64 zlib-1.2.8-3.fc20.x86_64
(gdb) bt full
#0  val_inq_ctx_args (lifetime_rec=0x0, ctx_flags=0x0, locally_initiated=locally_initiated@entry=0x0, opened=0x0, mech_type=0x7fffffff9480, targ_name=0x10, src_name=0x555555777fc0, context_handle=0x55555577a080, 
    minor_status=0x7fffffff946c) at g_inq_context.c:56
No locals.
#1  gss_inquire_context (minor_status=minor_status@entry=0x7fffffff946c, context_handle=context_handle@entry=0x55555577a080, src_name=0x555555777fc0, targ_name=0x10, lifetime_rec=0x0, mech_type=mech_type@entry=0x7fffffff9480, 
    ctx_flags=ctx_flags@entry=0x0, locally_initiated=locally_initiated@entry=0x0, opened=opened@entry=0x0) at g_inq_context.c:92
        ctx = <optimized out>
        mech = <optimized out>
        status = <optimized out>
        temp_minor = 32767
        actual_mech = 0x1e460
        localTargName = 0x0
        localSourceName = 0x0
#2  0x00007ffff224e5f9 in gssi_inquire_context (minor_status=0x7fffffff95e4, context_handle=0x5555557793b0, src_name=0x7fffffff9520, targ_name=0x0, lifetime_rec=<optimized out>, mech_type=0x7fffffff9510, ctx_flags=0x0, 
    locally_initiated=0x0, open=0x0) at src/mechglue/gpp_context.c:223
        ctx_handle = 0x5555557793b0
        s_name = 0x555555777fb0
        t_name = 0x0
        mech_oid = 0x555555775e88
        maj = <optimized out>
        min = 0
#3  0x00007ffff3e44d28 in gss_inquire_context (minor_status=minor_status@entry=0x7fffffff95e4, context_handle=<optimized out>, src_name=src_name@entry=0x555555775e90, targ_name=targ_name@entry=0x0, lifetime_rec=lifetime_rec@entry=0x0, 
    mech_type=mech_type@entry=0x0, ctx_flags=ctx_flags@entry=0x0, locally_initiated=locally_initiated@entry=0x0, opened=opened@entry=0x0) at g_inq_context.c:114
        ctx = <optimized out>
        mech = 0x555555778b20
        status = 0
        temp_minor = 21845
        actual_mech = 0xffff9540
        localTargName = 0x0
        localSourceName = 0x0
#4  0x00007ffff4077d78 in gssapi_client_mech_step (conn_context=0x555555775e70, params=0x5555557747e0, serverin=<optimized out>, serverinlen=<optimized out>, prompt_need=<optimized out>, clientout=0x7fffffff9728, 
    clientoutlen=0x7fffffff9700, oparams=0x5555557751a0) at gssapi.c:1680
        text = 0x555555775e70
        input_token = <optimized out>
        output_token = 0x7fffffff9600
        real_input_token = {length = 156, value = 0x55555577ba10}
        real_output_token = {length = 0, value = 0x0}
        maj_stat = <optimized out>
        min_stat = 0
        max_input = 14
        name_token = {length = 1, value = 0x0}
        ret = <optimized out>
        req_flags = 58
        out_req_flags = 314
        client_creds = <optimized out>
#5  0x00007ffff7768800 in sasl_client_step (conn=0x555555774930, serverin=0x55555577a080 "\200\240wUUU", serverinlen=1433894848, prompt_need=0x10, prompt_need@entry=0x7fffffff9710, clientout=0x7fffffff9728, clientoutlen=0x7fffffff9700)
    at client.c:973
        result = 0
#6  0x00007ffff7ba1cdc in ldap_int_sasl_bind (ld=ld@entry=0x555555769200, dn=dn@entry=0x0, mechs=mechs@entry=0x555555769030 "GSSAPI", sctrls=sctrls@entry=0x0, cctrls=cctrls@entry=0x0, flags=flags@entry=0, 
    interact=interact@entry=0x555555561180 <lutil_sasl_interact>, defaults=defaults@entry=0x555555773170, result=result@entry=0x55555577b830, rmech=0x7fffffff9938, msgid=0x7fffffff9934) at cyrus.c:589
        scred = 0x555555777c90
        mech = 0x7ffff407b64f "GSSAPI"
        ssf = 0x0
        ctx = 0x555555774930
        prompts = 0x0
        ccred = {bv_len = 0, bv_val = 0x0}
        saslrc = <optimized out>
        rc = 14
        credlen = 0
        my_hostname = "\254", '\000' <repeats 15 times>, "P\274wUUU\000\000]\274wUUU\000\000\374\274wUUU", '\000' <repeats 25 times>, <incomplete sequence \344>
        free_saslhost = 0
#7  0x00007ffff7ba5422 in ldap_sasl_interactive_bind (ld=ld@entry=0x555555769200, dn=dn@entry=0x0, mechs=mechs@entry=0x555555769030 "GSSAPI", serverControls=serverControls@entry=0x0, clientControls=clientControls@entry=0x0, 
    flags=flags@entry=0, interact=interact@entry=0x555555561180 <lutil_sasl_interact>, defaults=defaults@entry=0x555555773170, result=0x55555577b830, rmech=rmech@entry=0x7fffffff9938, msgid=msgid@entry=0x7fffffff9934) at sasl.c:471
---Type <return> to continue, or q <return> to quit---
        smechs = 0x0
        rc = <optimized out>
#8  0x00007ffff7ba564d in ldap_sasl_interactive_bind_s (ld=ld@entry=0x555555769200, dn=0x0, mechs=0x555555769030 "GSSAPI", serverControls=serverControls@entry=0x0, clientControls=clientControls@entry=0x0, flags=0, 
    interact=0x555555561180 <lutil_sasl_interact>, defaults=defaults@entry=0x555555773170) at sasl.c:505
        rmech = 0x7ffff407b64f "GSSAPI"
        result = 0x55555577b830
        rc = <optimized out>
        msgid = 1
#9  0x000055555555d1c2 in tool_bind (ld=ld@entry=0x555555769200) at common.c:1474
        defaults = 0x555555773170
        rc = <optimized out>
        sctrlsp = 0x0
        sctrls = {0x5555557690a0, 0x5555557680f0 <ldap_set_option>, 0x0}
        sctrl = {{ldctl_oid = 0x1 <Address 0x1 out of bounds>, ldctl_value = {bv_len = 0, bv_val = 0x0}, ldctl_iscritical = 120 'x'}, {ldctl_oid = 0x0, ldctl_value = {bv_len = 140737488346440, bv_val = 0x0}, 
            ldctl_iscritical = -123 '\205'}, {ldctl_oid = 0x555555559b80 <private_conn_setup> "\203=-\351 ", ldctl_value = {bv_len = 0, bv_val = 0x0}, ldctl_iscritical = 0 '\000'}}
        nsctrls = <optimized out>
        __PRETTY_FUNCTION__ = "tool_bind"
#10 0x0000555555558232 in main (argc=<optimized out>, argv=<optimized out>) at ldapsearch.c:893
        filtpattern = 0x555555562eb8 "(objectclass=*)"
        attrs = 0x0
        line = '\000' <repeats 8191 times>
        fp = 0x0
        rc = <optimized out>
        rc1 = <optimized out>
        i = <optimized out>
        first = <optimized out>
        ld = 0x555555769200
        seber = 0x0
        vrber = 0x0
        syncber = 0x0
        syncbvalp = 0x0
        err = <optimized out>
        __PRETTY_FUNCTION__ = "main"
(gdb)

Comment 1 Guenther Deschner 2014-02-04 12:33:40 UTC
Created attachment 859111 [details]
patch for master

Comment 2 Guenther Deschner 2014-02-05 14:06:50 UTC
Comment on attachment 859111 [details]
patch for master

Simo acked patch via IRC.

Comment 3 Fedora Update System 2014-03-13 16:17:24 UTC
gssproxy-0.3.1-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/gssproxy-0.3.1-1.fc20

Comment 4 Fedora Update System 2014-03-15 15:15:48 UTC
Package gssproxy-0.3.1-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing gssproxy-0.3.1-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-3905/gssproxy-0.3.1-1.fc20
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2014-04-02 09:14:33 UTC
gssproxy-0.3.1-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.