nscd_getpw_r in libc6 crashes due to invalid free()

[gcc]

There is a bug in libc6 in Dapper Drake (2.3.6) which causes applications that use nscd to crash eventually. A simple test is that this command crashes eventually:

  perl -e 'while (1){getpwnam("root")}'

often with a glibc error about an invalid free(), or aborts for another reason. The bug was reported in redhat:

  https://bugzilla.redhat.com/show_bug.cgi?id=169813

and fixed upstream:

  http://sources.redhat.com/bugzilla/show_bug.cgi?id=1363

Please apply the patch to Dapper Drake.

[Kees-verruijt-redwood (kees-verruijt-redwood)]

nscd_getpw_r() will free() on a static buffer passed in to it when called by
getpwnam() and friends.

This can be seen by simple code inspection in nscd/nscd_getpw_r.c.
(discussion is based on CVS version 1.30 which is the current MAIN). The
following excerpt are a few lines of nscd/nscd_getpw_r.c:

86:nscd_getpw_r (...)
96: retry:;
142: resultbuf->pw_uid = pw_resp->pw_uid;
203: if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0 && retval != -1)
230: free (resultbuf);
232: goto retry;

The above shows that if there has been a GC cycle that resultbuf is freed and
then reused in the next retry. That's incorrect. It is also incorrect in that
resultbuf is passed in, and it can be a buffer that's not from the heap.

This turns up in a simple getpwnam() call made during a GC cycle. This tries to
free the resbuf in getpwnam and thus dumps core.

Suggested fix: remove free(resultbuf) (line 230).

[Kees-verruijt-redwood (kees-verruijt-redwood)]

Created attachment 665
glibc_1363_testcase1.c

C source that might coredump; it just calls getpwnam() on different
non-existing users. It coredumps the first call after the nscd daemon does GC.

This is easiest to see by running the attached program and "nscd -d -d -d -d"
in two adjacent sessions. As soon as I see "remove GETPWBYNAME entry ".....""
by nscd the test program aborts.

(Originally found on SuSE 9.3 x86_64 w/ glibc-2.3.4-23.4)

[Drepper-fsp (drepper-fsp)]

Fixed on CVS trunk.

[C. Cooke (ccooke)]

 Thanks for reporting this bug and any supporting documentation. Since this bug has enough information provided for a developer to begin work, I'm going to mark it as confirmed and let them handle it from here. Thanks for taking the time to make Ubuntu better!

[Rune Philosof (olberd)]

Has this been released for dapper drake (it does have lts for servers still) and following releases?

[gcc (chris+ubuntu-qwirx)]

I don't see the issue any more on Dapper.