Bug 15160 - winbind at info level debug can coredump when processing wb_lookupusergroups
Summary: winbind at info level debug can coredump when processing wb_lookupusergroups
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 4.17.0rc4
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Jule Anger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-08-31 11:21 UTC by Noel Power
Modified: 2022-09-06 14:26 UTC (History)
1 user (show)

See Also:

Attachments
patch for v4.17 (2.87 KB, patch)
2022-08-31 15:34 UTC, Noel Power 		vl: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Noel Power 2022-08-31 11:21:04 UTC 
preparing fix for gitlab...
Comment 1 Noel Power 2022-08-31 14:05:13 UTC 
==6436==    at 0xA85F95B: dom_sid_string_buf (dom_sid.c:444)
==6436==    by 0xA85FBF2: dom_sid_str_buf (dom_sid.c:515)
==6436==    by 0x17EDF8: wb_lookupusergroups_recv (wb_lookupusergroups.c:115)
==6436==    by 0x17F964: wb_gettoken_gotgroups (wb_gettoken.c:123)
==6436==    by 0x56AD332: _tevent_req_notify_callback (tevent_req.c:141)
==6436==    by 0x56AD493: tevent_req_finish (tevent_req.c:193)
==6436==    by 0x56AD5C0: tevent_req_trigger (tevent_req.c:250)
==6436==    by 0x56AC119: tevent_common_invoke_immediate_handler (tevent_immediate.c:190)
==6436==    by 0x56AC268: tevent_common_loop_immediate (tevent_immediate.c:236)
==6436==    by 0x56B678A: epoll_event_loop_once (tevent_epoll.c:919)
==6436==    by 0x56B31C3: std_event_loop_once (tevent_standard.c:110)
==6436==    by 0x56AA621: _tevent_loop_once (tevent.c:825)
==6436==
==6436== Invalid read of size 1
==6436==    at 0xA85F95B: dom_sid_string_buf (dom_sid.c:444)
==6436==    by 0xA85FBF2: dom_sid_str_buf (dom_sid.c:515)
==6436==    by 0x17EDF8: wb_lookupusergroups_recv (wb_lookupusergroups.c:115)
==6436==    by 0x17F964: wb_gettoken_gotgroups (wb_gettoken.c:123)
==6436==    by 0x56AD332: _tevent_req_notify_callback (tevent_req.c:141)
==6436==    by 0x56AD493: tevent_req_finish (tevent_req.c:193)
==6436==    by 0x56AD5C0: tevent_req_trigger (tevent_req.c:250)
==6436==    by 0x56AC119: tevent_common_invoke_immediate_handler (tevent_immediate.c:190)
==6436==    by 0x56AC268: tevent_common_loop_immediate (tevent_immediate.c:236)
==6436==    by 0x56B678A: epoll_event_loop_once (tevent_epoll.c:919)
==6436==    by 0x56B31C3: std_event_loop_once (tevent_standard.c:110)
==6436==    by 0x56AA621: _tevent_loop_once (tevent.c:825)
Comment 2 Samba QA Contact 2022-08-31 15:08:06 UTC 
This bug was referenced in samba master:

1788b59bc0aaa8f18186ad9b9945fbd634f02445
Comment 3 Noel Power 2022-08-31 15:34:57 UTC 
Created attachment 17503 [details]
patch for v4.17
Comment 4 Jule Anger 2022-09-03 07:15:07 UTC 
Pushed to autobuild-v4-17-test.
Comment 5 Samba QA Contact 2022-09-03 08:19:09 UTC 
This bug was referenced in samba v4-17-test:

e9c554c0a6a2c0ba6d03fda7b64f19a42fae96d1
Comment 6 Jule Anger 2022-09-06 06:28:24 UTC 
Closing out bug report.

Thanks!
Comment 7 Samba QA Contact 2022-09-06 14:26:14 UTC 
This bug was referenced in samba v4-17-stable (Release samba-4.17.0rc5):

e9c554c0a6a2c0ba6d03fda7b64f19a42fae96d1