From 3f59118ffcce07cbd74360f9ce8047e0b35960be Mon Sep 17 00:00:00 2001
From: Fraser Tweedale <ftweedal@redhat.com>
Date: Fri, 23 Oct 2020 01:06:15 +1100
Subject: [PATCH] ipa_sam: do not modify static buffer holding fqdn

ipa_sam was modifying the buffer returned by ipa_gethostfqdn().
Subsequent calls to ipa_gethostfqdn() returned the corrupt data,
causing other operations to fail.

Update ipa_sam to copy the string and modify the copy.  Also
document this characteristic of ipa_gethostfqdn() and explain that
callers must not modify the returned data.

Part of: https://pagure.io/freeipa/issue/8501

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
---
 daemons/ipa-sam/ipa_sam.c | 10 +++++++---
 util/ipa_hostname.h       |  7 +++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
index 6993152e7..5dbdc17fb 100644
--- a/daemons/ipa-sam/ipa_sam.c
+++ b/daemons/ipa-sam/ipa_sam.c
@@ -4441,7 +4441,8 @@ static char *sec_key(TALLOC_CTX *mem_ctx, const char *d)
 
 static NTSTATUS save_sid_to_secret(struct ipasam_private *ipasam_state)
 {
-	const char *hostname;
+	char hostname[IPA_HOST_FQDN_LEN];
+	const char *fqdn;
 	char *p;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
@@ -4466,12 +4467,15 @@ static NTSTATUS save_sid_to_secret(struct ipasam_private *ipasam_state)
 		goto done;
 	}
 
-	hostname = ipa_gethostfqdn();
-	if (hostname == NULL) {
+	fqdn = ipa_gethostfqdn();
+	if (fqdn == NULL) {
 		DEBUG(1, ("ipa_gethostfqdn failed.\n"));
 		status = NT_STATUS_UNSUCCESSFUL;
 		goto done;
 	}
+	/* Copy is necessary, otherwise we this will corrupt the static
+	 * buffer returned by ipa_gethostfqdn(). */
+	strncpy(hostname, fqdn, sizeof(hostname));
 	p = strchr(hostname, '.');
 	if (p != NULL) {
 		*p = '\0';
diff --git a/util/ipa_hostname.h b/util/ipa_hostname.h
index f98da69a4..0cda02219 100644
--- a/util/ipa_hostname.h
+++ b/util/ipa_hostname.h
@@ -11,5 +11,12 @@
  */
 #define IPA_HOST_FQDN_LEN 255
 
+/* Get the host FQDN.
+ *
+ * Returns a null-terminated static char[].  The string length is
+ * at most IPA_HOST_FQDN_LEN - 1.  The caller MUST NOT modify this
+ * buffer.  If modification could occur, the caller MUST copy
+ * the string.
+ */
 const char*
 ipa_gethostfqdn(void);