This might be a little artificial bug, but I've hit with one of QE's
reproducers.
They have a test pam client that rapidly does auth in a loop, but
evidently never calls the part of NSS responder that would in turn call
sss_dp_send_acct_req(). After sssd_be was killed and sssd_nss reconnected,
it accessed a NULL pointer in handle_requests_after_reconnect()
>From 996f9d04e300e303c16a9ace2c83108c189b4acf Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhro...@redhat.com>
Date: Mon, 10 Oct 2011 17:57:43 +0200
Subject: [PATCH] Check if dp_requests hash table exists before using it
---
src/responder/common/responder_dp.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/src/responder/common/responder_dp.c
b/src/responder/common/responder_dp.c
index a89425c..11986f0 100644
--- a/src/responder/common/responder_dp.c
+++ b/src/responder/common/responder_dp.c
@@ -114,6 +114,11 @@ void handle_requests_after_reconnect(void)
unsigned long count, i;
struct sss_dp_req *sdp_req;
+ if (!dp_requests) {
+ DEBUG(7, ("No requests to handle after reconnect\n"));
+ return;
+ }
+
ret = hash_values(dp_requests, &count, &values);
if (ret != HASH_SUCCESS) {
DEBUG(1, ("hash_values failed, "
--
1.7.6.4
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
