openldap-bugs

openldap-bugs@openldap.org

1 participants
21418 discussions

Start a nNew thread

[Issue 8901] slapd segfaults in mdb_env_reader_dest
by openldap-its＠openldap.org 30 May '26

30 May '26

1 0

[Issue 8901] slapd segfaults in mdb_env_reader_dest
by openldap-its＠openldap.org 29 May '26

29 May '26

https://bugs.openldap.org/show_bug.cgi?id=8901 --- Comment #7 from Howard Chu <hyc(a)openldap.org> --- (In reply to Marcelo.DeCastroLoebens from comment #6) > Thanks for the analysis and workaround provided. > > Do you have an opinion about the risk associated with the workaround? Since > I'm not familiar with the code, that would be very helpful. > > I don't have the expertise to comprehensive test slapd in isolation, so I > would like to know if you imagine possible side effects during "regular" > usage (not shutdown). There's no impact during regular use since ldap_pvt_thread_pool_close() is only called during shutdown. Actually, just to be more explicit - the sleep(1) should be inserted in slapd/daemon.c:slapd_daemon_task() right after its call to ldap_pvt_thread_pool_close(). There's no need to muck with libldap itself. -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 8901] slapd segfaults in mdb_env_reader_dest
by openldap-its＠openldap.org 29 May '26

29 May '26

https://bugs.openldap.org/show_bug.cgi?id=8901 --- Comment #6 from Marcelo.DeCastroLoebens(a)windriver.com --- Thanks for the analysis and workaround provided. Do you have an opinion about the risk associated with the workaround? Since I'm not familiar with the code, that would be very helpful. I don't have the expertise to comprehensive test slapd in isolation, so I would like to know if you imagine possible side effects during "regular" usage (not shutdown). -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 8901] slapd segfaults in mdb_env_reader_dest
by openldap-its＠openldap.org 29 May '26

29 May '26

https://bugs.openldap.org/show_bug.cgi?id=8901 Howard Chu <hyc(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|VERIFIED |CONFIRMED Resolution|FEEDBACK |--- --- Comment #5 from Howard Chu <hyc(a)openldap.org> --- The problem is because ldap_pvt_thread_pool_close() doesn't actually know when the last thread has exited. The last thread does a cond_signal() to tell that it is exiting, but there's additional time between that and when the thread actually returns (or calls pthread_exit). And LMDB's own reader_dest function doesn't execute until the actual pthread_exit occurs. So when ldap_pvt_thread_pool_close() returns, worker threads may still be running. Then when backend_shutdown is called, which invokes back-mdb's shutdown and eventual mdb_env_close(), it may get there before the worker threads have completed, and so destroy the environment while worker threads are still trying to clear their reader slots. A proper fix would require some rewriting of the thread_pool code to track thread creation and termination explicitly. A workaround for now would be to insert a sleep(1) at the end of ldap_pvt_thread_pool_close(). -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 8901] slapd segfaults in mdb_env_reader_dest
by openldap-its＠openldap.org 29 May '26

29 May '26

1 0

[Issue 9716] New: Fix default guide versions for head and 2.6
by openldap-its＠openldap.org 26 May '26

26 May '26

https://bugs.openldap.org/show_bug.cgi?id=9716 Issue ID: 9716 Summary: Fix default guide versions for head and 2.6 Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: documentation Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- The preamble file needs to be fixed in openldap head and the 2.6 release branch to be correct. -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 10507] New: Remove back-perl from OpenLDAP 2.7
by openldap-its＠openldap.org 26 May '26

26 May '26

https://bugs.openldap.org/show_bug.cgi?id=10507 Issue ID: 10507 Summary: Remove back-perl from OpenLDAP 2.7 Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: backends Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- OpenLDAP 2.6 deprecated back-perl, so remove it from the 2.7 release branch -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 9009] 2.7: Switch to LMDB v1.0
by openldap-its＠openldap.org 26 May '26

26 May '26

https://bugs.openldap.org/show_bug.cgi?id=9009 --- Comment #2 from Quanah Gibson-Mount <quanah(a)openldap.org> --- head: • aa02d9f5 by Howard Chu at 2026-05-22T03:51:12+01:00 ITS#9009 slapd-mdb: refix Makefile RE27: • 7ae0869b by Howard Chu at 2026-05-22T19:12:49+00:00 ITS#9009 slapd-mdb: refix Makefile -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10512] New: systemd exec - update to absolute path
by openldap-its＠openldap.org 26 May '26

26 May '26

https://bugs.openldap.org/show_bug.cgi?id=10512 Issue ID: 10512 Summary: systemd exec - update to absolute path Product: OpenLDAP Version: 2.6.10 Hardware: All OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: daniel(a)iamniz.co.uk Target Milestone: --- Could the ExecStart option in the systemd unit file be updated to use a absolute path? ERROR:systemctl: slapd.service: Exec is not an absolute path: ExecStart=sh -c 'mkdir -p /run/slapd; \ chown "$SLAPD_USER":"$SLAPD_GROUP" /run/slapd; \ [ -d "$SLAPD_CONF" ] && confflag=-F || confflag=-f; \ exec /usr/sbin/slapd -d0 \ ${SLAPD_SERVICES:+-h "$SLAPD_SERVICES"} \ ${SLAPD_USER:+-u "$SLAPD_USER"} \ ${SLAPD_GROUP:+-g "$SLAPD_GROUP"} \ ${SLAPD_CONF:+$confflag "$SLAPD_CONF"} \ $SLAPD_OPTIONS' ERROR:systemctl: slapd.service: Exec command does not exist: (ExecStart) sh ERROR:systemctl: slapd.service: but this does exist: /usr/bin/sh ERROR:systemctl: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ERROR:systemctl: The SystemD ExecXY commands must always be absolute paths by definition. ERROR:systemctl: Oops, 1 executable paths were not found in the current environment. Refusing. ERROR:systemctl: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Regards, Dan Nisbet -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 10488] New: Multiple out-of-bounds reads in servers/slapd/result.c v2ref() function
by openldap-its＠openldap.org 22 May '26

22 May '26

https://bugs.openldap.org/show_bug.cgi?id=10488 Issue ID: 10488 Summary: Multiple out-of-bounds reads in servers/slapd/result.c v2ref() function Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: wangxiaomeng(a)kylinos.cn Target Milestone: --- Created attachment 1142 --> https://bugs.openldap.org/attachment.cgi?id=1142&action=edit Fix two out-of-bounds reads in servers/slapd/result.c v2ref() function The v2ref() function in servers/slapd/result.c is responsible for converting LDAPv3 referrals to an LDAPv2-compatible string format. Two separate out-of-bounds read vulnerabilities exist in this function, both caused by insufficient checks for zero-length data before accessing the last character of the data buffer. Vulnerability 1: Out-of-bounds read in text buffer handling Location: servers/slapd/result.c, line 94 (within the v2ref() function): Vulnerable Code: if ( text != NULL ) { len = strlen( text ); if (text[len-1] != '\n') { i = 1; } } When the 'text' parameter is non-NULL but points to an empty string (""), strlen(text) returns 0. Accessing text[len-1] (i.e., text[-1]) results in an out-of-bounds read of one byte before the start of the 'text' buffer. Vulnerability 2: Out-of-bounds read in BerValue referral handling Location: servers/slapd/result.c, line 115 (within the v2ref() function) Vulnerable Code: len += ref[i].bv_len; if (ref[i].bv_val[ref[i].bv_len-1] != '/') { ++len; } When ref[i].bv_val is non-NULL but ref[i].bv_len is 0 (a valid state per LDAP BerValue semantics, representing an empty string), accessing ref[i].bv_val[ref[i].bv_len-1] (i.e., ref[i].bv_val[-1]) results in an out-of-bounds read of one byte before the start of the ref[i].bv_val buffer. Fix Add checks for zero-length data before accessing the last character of the respective buffers. The fix addresses both vulnerabilities with minimal, targeted changes that preserve the original functionality. -- You are receiving this mail because: You are on the CC list for the issue.

1 9

← Newer
1
...
8
9
10
11
12
13
14
...
2142
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs