The _og_subgroups_get_children_groups function in og_subgroups.common.inc recursively calls itself. It is possible to accidentally assign group->subgroup->group to cause an infinite loop. Patch coming to add a bailout for recursion depth.

Comments

mpotter’s picture

Status: Active » Needs review
StatusFileSize
new1.59 KB

Here is the patch.

mpotter’s picture

Oops, here is the patch without the debug statement.

mpotter’s picture

Finally, here is another one without the whitespace issue that should apply more cleanly with other patches.

mpotter’s picture

Found that a recursion loop could also be caused in the og_subgroups_get_parents routine, even with the existing check of _og_subgroups_parent_search. This is because the $parents array actually gets modified later in the routine. Leave it to the customer to find just the right combination of parent data to cause these recursion problems.

In any case, here is another patch to prevent infinite recursion. Combines the previous patch with the new routine and adds a constant for the recursion depth.

mpotter’s picture

Sigh. Bad copy/paste in watchdog message fixed.

mpotter’s picture

kenianbei’s picture

Thanks for the patches. Will review soon.

kenianbei’s picture

Status: Needs review » Closed (fixed)

Hi mpotter,

I've added a new patch here which changes quite a bit of the current code. It also removes the need for this patch. If you have time please review the patch and let me know any feedback. Thanks!

Norman

hefox’s picture

Status: Closed (fixed) » Postponed

When fixing issues, the status to set is "fixed". The issue queue bot will come around in 2 weeks and set the closed (fixed) status.

However, it looks like there has been no commited code for this? If it was an duplicate, the status would be closed (duplicate), but as there's a patch that fixes it in a different way, "postponed" would likely be the better status -- indicate that this is still an issue, but postponed on the other issue getting in.

mpotter’s picture

Issue summary: View changes
Status: Postponed » Fixed

The latest code has og_subgroups_children_load_multiple() so this patch no longer applies. It also has code for detecting recursion now.

mpotter’s picture

Status: Fixed » Closed (fixed)