public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group
@ 2012-02-27  6:10 siddhesh at redhat dot com
  2012-02-27  6:17 ` [Bug nis/13761] " siddhesh at redhat dot com
                   ` (8 more replies)
  0 siblings, 9 replies; 10+ messages in thread
From: siddhesh at redhat dot com @ 2012-02-27  6:10 UTC (permalink / raw)
  To: glibc-bugs

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

             Bug #: 13761
           Summary: [PATCH] Fix allocation in nss_compat for large number
                    of memberships to a group
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nis
        AssignedTo: unassigned@sourceware.org
        ReportedBy: siddhesh@redhat.com
                CC: kukuk@suse.de
    Classification: Unclassified


nss_compat allocates buffer space on stack using alloca (and
extend_alloca) for initgroup and keeps extending it to fit in larger
lines. This breaks for cases where the number of members in a gorup
are very large, causing the alloca reference to go beyond thread stack
boundary. I have posted a patch on libc-alpha that implements a fallback to
malloc/free if the buffer size needed is beyond __libc_alloca_cutoff:

http://sourceware.org/ml/libc-alpha/2012-02/msg00503.html

How reproducible:
Always

Steps to Reproduce:
1. In /etc/nsswitch.conf:

group: compat
group_compat: files

2. Create a large number of users for a single group

for i in $(seq 1 70000); do
 useradd -M -N -s /sbin/nologin -G foo somelongusernameaaaaaaaaaaaa$i
 echo Created somelongusername$i
done

3. Start nscd
4. groups somelongusernameaaaaaaaaaaaa100

Actual results:
nscd crashes

Expected results:
nscd does not crash

Additional info:

This is also possible with ldap (the original case is with ldap):

group: files compat
group_compat: ldap

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2012-11-29 17:48 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-02-27  6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com
2012-02-27  6:17 ` [Bug nis/13761] " siddhesh at redhat dot com
2012-02-28  3:39 ` carlos at systemhalted dot org
2012-02-28  3:43 ` carlos at systemhalted dot org
2012-02-28  3:44 ` carlos at systemhalted dot org
2012-02-28  6:22 ` kukuk at suse dot de
2012-03-30  7:32 ` siddhesh at redhat dot com
2012-04-12 15:43 ` law at redhat dot com
2012-04-12 15:45 ` law at redhat dot com
2012-11-29 17:48 ` law at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).