Project

General

Profile

Bug #24830

crash in lasso_profile_get_issuer on invalid content

Added by Frédéric Péters over 1 year ago. Updated 5 months ago.

Status:
Solution déployée
Priority:
Normal
Category:
-
Target version:
Start date:
27 Jun 2018
Due date:
% Done:

100%

Patch proposed:
Yes
Planning:
No

Description

Using the Python binding:

>>> import lasso
>>> msg = 'SAMLRequest=Hello!!!fZHbasMwDIZfJfi+sXtYk5okkC4NFLZRtrGL3QzXUWnAsTNL2eHt56YUOga7Ekj69P+SMlSd6WU50NE+wvsASNFXZyzKsZCzwVvpFLYoreoAJWn5VN7fyVksZO8dOe0Mu0L+JxQieGqdZdG2ytmbSNJkvZiv01WdJDdJLRbLzXyTlnVZ1etVmrLoBTyG/pwFPECIA2wtkrIUUmKaTsRyMkuep0spFlLMXllUhR1aq2ikjkQ9Ss5VWBAstTo+eGhi47QysWjiPfC26fnJ+YwjOhbVzmsY75GzgzIIJ9VdMN5+wCVTZCdAjm58cdHQrtu7v/OV1m6whLwDY5wNgVSjSPGMX0/Jzp94CDfbVjtnWv0dlQH4vPWgKEiTH4Dx4kz9flnxAw==&SigAlg=http://www.w3.org/2000/09/xmldsig'
>>> lasso.profileGetIssuer(msg)
munmap_chunk(): invalid pointer

Aborted (core dumped)

(hopefully nobody uses this new API)

0001-tools-fix-segfault-in-lasso_get_saml_message-fixes-2.patch View (2.5 KB) Benjamin Dauvergne, 27 Jun 2018 07:29 PM

Associated revisions

Revision e29de316 (diff)
Added by Benjamin Dauvergne over 1 year ago

tools: fix segfault in lasso_get_saml_message (fixes #24830)

We reuse the "message" local variable but we should not.
Also fix a segfault in lasso_xmltextreader_from_message() when getting
the length of "message" before checking if it is NULL or not.

History

#1 Updated by Benjamin Dauvergne over 1 year ago

  • Assignee set to Benjamin Dauvergne

#2 Updated by Benjamin Dauvergne over 1 year ago

#3 Updated by Frédéric Péters over 1 year ago

Should it also log something?

#4 Updated by Benjamin Dauvergne over 1 year ago

I don't think so, it will return NULL/None, it seems enough for the caller to see that something is wrong (and anyway internal function already log something at the DEBUG level).

#5 Updated by Frédéric Péters over 1 year ago

  • Status changed from Solution proposée to Solution validée

Works for me, ack.

#6 Updated by Benjamin Dauvergne over 1 year ago

  • Status changed from Solution validée to Résolu (à déployer)
  • % Done changed from 0 to 100

#7 Updated by Benjamin Dauvergne over 1 year ago

  • Target version set to 2.6.1

#8 Updated by Benjamin Dauvergne 5 months ago

  • Status changed from Résolu (à déployer) to Solution déployée

Also available in: Atom PDF