Bug 1346419

(In reply to Jesse Connell from comment #0)
> 
> Additional info:
> 
> I've traced this problem to a new patch in this version of the nfs-utils
> package: nfs-utils-1.2.3-gssd-uppercase.patch.  The patch adds a loop to
> convert a string to uppercase on line 32, but this loop uses the same index
> variable (i) that's already in use for indexing realmnames[] in the outer
> while loop in that function.
> 
> This has the effect of trying to access the address of a non-existent
> element of realmnames (line 953 of the patched krb5_util.c file) and assign
> it to the realm variable.  If the data that happens to sit at that
> non-existent element of realmnames represents an inaccessible address, then
> the next time there's an attempted read on the data at that supposed address
> (line 872, in strcmp(), during a later iteration of the while loop) it
> triggers the segmentation fault.  So, I edited the patch in the source RPM
> to have a new index variable for that for loop (attached) and rebuilt the
> package, and that version of rpc.gssd seems OK.  From the comments in the
> SRPM the original patch looks to be related to bug #1273166 but I don't have
> permissions to view that bug here.

Thanks for the detailed investigation.

Seems bug 1313090 has traced the same issue. Mark this one as DUPLICATE

*** This bug has been marked as a duplicate of bug 1313090 ***

Paste the upstream patch to fix this issue.

commit 55c12c837feaa909de8cbd6d5fe23378b85efeff
Author: Benjamin Coddington <bcodding>
Date:   Wed Mar 16 11:31:40 2016 -0400

    gssd: Fix inner-loop variable reuse
    
    The var "i" is already in use iterating realmnames.
    
    Fixes: "6597e391 gssd:  Don't assume the machine account will be in
    uppercase"
    
    Signed-off-by: Benjamin Coddington <bcodding>
    Signed-off-by: Steve Dickson <steved>

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 8ef8184..8dc64fe 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -796,7 +796,7 @@ find_keytab_entry(krb5_context context, krb5_keytab kt, const char *tgtname,
        char **realmnames = NULL;
        char myhostname[NI_MAXHOST], targethostname[NI_MAXHOST];
        char myhostad[NI_MAXHOST+1];
-       int i, j, retval;
+       int i, j, k, retval;
        char *default_realm = NULL;
        char *realm;
        char *k5err = NULL;
@@ -941,8 +941,8 @@ find_keytab_entry(krb5_context context, krb5_keytab kt, const char *tgtname,
                                 * moving on to the svcname
                                 */
                                if (strcmp(svcnames[j],"$") == 0 && !tried_upper) {
-                                       for (i = 0; myhostad[i] != '$'; ++i) {
-                                               myhostad[i] = toupper(myhostad[i]);
+                                       for (k = 0; myhostad[k] != '$'; ++k) {
+                                               myhostad[k] = toupper(myhostad[k]);
                                        }
                                        j--;
                                        tried_upper = 1;