Bug 1622165 - ipa-otpd: fix potential double-free and infinite loop in queue code
Summary: ipa-otpd: fix potential double-free and infinite loop in queue code
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: freeipa
Version: 28
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: IPA Maintainers
QA Contact: Fedora Extras Quality Assurance
URL: https://github.com/freeipa/freeipa/pu...
Whiteboard:
Depends On:
Blocks: 1622166 1622168
TreeView+ depends on / blocked
 
Reported: 2018-08-24 14:56 UTC by Robbie Harwood
Modified: 2019-03-18 14:51 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
: 1622166 (view as bug list)
Environment:
Last Closed: 2019-03-18 14:51:40 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Robbie Harwood 2018-08-24 14:56:15 UTC
Upstream PR: https://github.com/freeipa/freeipa/pull/2283

The ipa-otpd code occasionally removes elements from one queue,
inspects and modifies them, and then inserts them into
another (possibly identical, possibly different) queue. When the next
pointer isn't cleared, this can result in element membership in both
queues, leading to double frees, or even self-referential elements,
causing infinite loops at traversal time.

Rather than eliminating the pattern, make it safe by clearing the next
field any time an element enters or exits a queue.


Note You need to log in before you can comment on or make changes to this bug.