openldap-bugs

openldap-bugs@openldap.org

1 participants
21065 discussions

(ITS#9128) Fix for slapd-mdb start Bus Error in strchrlen
by requate＠univention.de 03 Dec '19

03 Dec '19

Full_Name: Arvid Requate Version: 2.4.45 OS: UCS / Debian Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (92.210.162.23) In our CI tests we observed a situation where the slapd-mdb failed to start, terminating due to a "bus error" and slapcat showed the same behaviour. I turned out that the data.mdb file had an "Attribute;option" string right at the end of it and strchrlen tried to access a memory location past the end of the page while scanning for another ';', see stack trace down below. This patch fixed the issue for us: ========================================================= Author: Arvid Requate <requate(a)univention.de> Date: Tue Dec 3 23:33:10 2019 +0100 Avoid bus error with slapd-mdb/slapcat diff --git a/servers/slapd/ad.c b/servers/slapd/ad.c index 801f18d34..31a94a725 100644 --- a/servers/slapd/ad.c +++ b/servers/slapd/ad.c @@ -145,7 +145,7 @@ static char *strchrlen( { const char *p; - for( p=beg; *p && p < end; p++ ) { + for( p=beg; p < end && *p; p++ ) { if( *p == ch ) { *len = p - beg; return (char *) p; ========================================================= This is the stack trace: ========================================================= $ gdb slapcat bt #0 0x00005555555d0dc4 in strchrlen (len=<synthetic pointer>, ch=59 ';', end=0x7fff6bd62000 <error: Cannot access memory at address 0x7fff6bd62000>, beg=0x7fff6bd61ff5 "entry-de-de"<error: Cannot access memory at address 0x7fff6bd62000>) at ../../../../servers/slapd/ad.c:148 #1 slap_bv2ad (bv=bv@entry=0x7fffffffdbe0, ad=ad@entry=0x7fffffffdbb8, text=text@entry=0x7fffffffdbb0) at ../../../../servers/slapd/ad.c:224 #2 0x00007fffee70e043 in mdb_ad_read (mdb=mdb@entry=0x555555a58240, txn=<optimized out>) at ../../../../../servers/slapd/back-mdb/attr.c:573 #3 0x00007fffee6fe4ad in mdb_db_open (be=0x7fffffffdd90, cr=0x7fffffffdf80) at ../../../../../servers/slapd/back-mdb/init.c:263 #4 0x00005555555fa601 in over_db_open (be=<optimized out>, cr=0x7fffffffdf80) at ../../../../servers/slapd/backover.c:149 #5 0x000055555559a317 in backend_startup_one (be=be@entry=0x555555a580a0, cr=cr@entry=0x7fffffffdf80) at ../../../../servers/slapd/backend.c:224 #6 0x000055555559a4cb in backend_startup (be=be@entry=0x555555a580a0) at ../../../../servers/slapd/backend.c:278 #7 0x00005555555bc0e1 in slap_startup (be=0x555555a580a0) at ../../../../servers/slapd/init.c:219 #8 0x00005555555ffc84 in slap_tool_init (progname=progname@entry=0x55555561d2c1 "slapcat", tool=tool@entry=2, argc=<optimized out>, argv=<optimized out>) at ../../../../servers/slapd/slapcommon.c:908 #9 0x00005555555fec90 in slapcat (argc=<optimized out>, argv=<optimized out>) at ../../../../servers/slapd/slapcat.c:53 #10 0x0000555555570867 in main (argc=1, argv=0x7fffffffe568) at ../../../../servers/slapd/main.c:410 =========================================================

1 0

Re[2]: (ITS#9127) memory leak in mdb_entry_decode()
by grapvar＠gmail.com 02 Dec '19

02 Dec '19

Howard Chu, 02 Dec 2019 18:20 MSK: > > Since this is allocated in thread-local memory, there is no actual leak. It is the op->o_tmpalloc() who is thread-local, however, each op->o_tmpalloc() is eventually complimented by op->o_tmpfree(). But not this one. Why the exception? -- Konstantin Andreev. Konstantin Andreev, 02 Dec 2019 16:57 MSK: > > mdb_entry_decode() leaks allocated [Entry] on error. Here is a fix for the master branch: > > --- a/servers/slapd/back-mdb/id2entry.c > +++ b/servers/slapd/back-mdb/id2entry.c > @@ -1130,8 +1130,12 @@ done: > *e = x; > rc = 0; > > -leave: > +clr_mvc: > if (mvc) > mdb_cursor_close(mvc); > return rc; > +leave: > + /* can't mdb_entry_return() because [Entry *x] init is incomplete */ > + op->o_tmpfree( x, op->o_tmpmemctx ); > + goto clr_mvc; > } > > and for 2.4 branch, if you care: > ...

1 0

Re: (ITS#8629) slapauth segfault with GSSAPI + olcAuthzRegexp using internal LDAP search + ppolicy overlay
by ondra＠mistotebe.net 02 Dec '19

02 Dec '19

A fix for this bug has now been committed to master (b71235ac45fcd702f9c7d188dbfd24e611ce1a93) and should be part of 2.4.49. Regards, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#9127) memory leak in mdb_entry_decode()
by hyc＠symas.com 02 Dec '19

02 Dec '19

grapvar(a)gmail.com wrote: > Full_Name: Konstantin Andreev > Version: 2.4.48 > OS: Solaris 11.3 x64 > URL: > Submission from: (NULL) (79.135.238.172) > > > servers/slapd/back-mdb/id2entry.c`mdb_entry_decode() leaks allocated [Entry] on > error. > Here is a fix for the master branch: Since this is allocated in thread-local memory, there is no actual leak. > --- a/servers/slapd/back-mdb/id2entry.c > +++ b/servers/slapd/back-mdb/id2entry.c > @@ -1130,8 +1130,12 @@ done: > *e = x; > rc = 0; > > -leave: > +clr_mvc: > if (mvc) > mdb_cursor_close(mvc); > return rc; > +leave: > + /* can't mdb_entry_return() because [Entry *x] init is incomplete */ > + op->o_tmpfree( x, op->o_tmpmemctx ); > + goto clr_mvc; > } > > and for 2.4 branch, if you care: > > --- a/servers/slapd/back-mdb/id2entry.c > +++ b/servers/slapd/back-mdb/id2entry.c > @@ -695,12 +695,13 @@ > if (i > mdb->mi_numads) { > rc = mdb_ad_read(mdb, txn); > if (rc) > - return rc; > + goto leave; > if (i > mdb->mi_numads) { > Debug( LDAP_DEBUG_ANY, > "mdb_entry_decode: attribute index %d not recognized\n", > i, 0, 0 ); > - return LDAP_OTHER; > + rc = LDAP_OTHER; > + goto leave; > } > } > a->a_desc = mdb->mi_ads[i]; > @@ -745,7 +746,7 @@ > Debug( LDAP_DEBUG_ANY, > "mdb_entry_decode: attributeType %s value #%d provided more than once\n", > a->a_desc->ad_cname.bv_val, j, 0 ); > - return rc; > + goto leave; > } > } > a->a_next = a+1; > @@ -758,4 +759,8 @@ > 0, 0, 0 ); > *e = x; > return 0; > +leave: > + /* can't mdb_entry_return() because [Entry *x] init is incomplete */ > + op->o_tmpfree( x, op->o_tmpmemctx ); > + return rc; > } > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#9127) memory leak in mdb_entry_decode()
by grapvar＠gmail.com 02 Dec '19

02 Dec '19

Full_Name: Konstantin Andreev Version: 2.4.48 OS: Solaris 11.3 x64 URL: Submission from: (NULL) (79.135.238.172) servers/slapd/back-mdb/id2entry.c`mdb_entry_decode() leaks allocated [Entry] on error. Here is a fix for the master branch: --- a/servers/slapd/back-mdb/id2entry.c +++ b/servers/slapd/back-mdb/id2entry.c @@ -1130,8 +1130,12 @@ done: *e = x; rc = 0; -leave: +clr_mvc: if (mvc) mdb_cursor_close(mvc); return rc; +leave: + /* can't mdb_entry_return() because [Entry *x] init is incomplete */ + op->o_tmpfree( x, op->o_tmpmemctx ); + goto clr_mvc; } and for 2.4 branch, if you care: --- a/servers/slapd/back-mdb/id2entry.c +++ b/servers/slapd/back-mdb/id2entry.c @@ -695,12 +695,13 @@ if (i > mdb->mi_numads) { rc = mdb_ad_read(mdb, txn); if (rc) - return rc; + goto leave; if (i > mdb->mi_numads) { Debug( LDAP_DEBUG_ANY, "mdb_entry_decode: attribute index %d not recognized\n", i, 0, 0 ); - return LDAP_OTHER; + rc = LDAP_OTHER; + goto leave; } } a->a_desc = mdb->mi_ads[i]; @@ -745,7 +746,7 @@ Debug( LDAP_DEBUG_ANY, "mdb_entry_decode: attributeType %s value #%d provided more than once\n", a->a_desc->ad_cname.bv_val, j, 0 ); - return rc; + goto leave; } } a->a_next = a+1; @@ -758,4 +759,8 @@ 0, 0, 0 ); *e = x; return 0; +leave: + /* can't mdb_entry_return() because [Entry *x] init is incomplete */ + op->o_tmpfree( x, op->o_tmpmemctx ); + return rc; }

1 0

(ITS#9126) add: pwdChangedTime leads to seg fault
by michael＠stroeder.com 02 Dec '19

02 Dec '19

Full_Name: Michael Str.der Version: 2.4.48 / RE24 branch OS: openSUSE Linux URL: Submission from: (NULL) (213.240.182.73) slapd seg faults in case the client sends a modify operation like this (let me know if you need a stack trace): ----------------------------- snip ----------------------------- $ ldapmodify -e relax << EOF dn: uid=test42,ou=Testing,dc=stroeder,dc=de changetype: modify add: pwdChangedTime pwdChangedTime: 19721101000000Z EOF SASL/EXTERNAL authentication started SASL username: gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "uid=test42,ou=Testing,dc=stroeder,dc=de" ldap_result: Can't contact LDAP server (-1) ----------------------------- snip ----------------------------- Note that this only happens in case the userPassword was *freshly* set via Password Modify ext. op. If the client sends a modify operation with 'replace: pwdChangedTime' this works correctly and after that 'add: pwdChangedTime' is correctly rejected: ----------------------------- snip ----------------------------- $ ldapmodify -e relax << EOF dn: uid=test42,ou=Testing,dc=stroeder,dc=de changetype: modify replace: pwdChangedTime pwdChangedTime: 19721101000000Z EOF SASL/EXTERNAL authentication started SASL username: gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "uid=test42,ou=Testing,dc=stroeder,dc=de" $ ldapmodify -e relax << EOF dn: uid=test42,ou=Testing,dc=stroeder,dc=de changetype: modify add: pwdChangedTime pwdChangedTime: 19721101000000Z EOF SASL/EXTERNAL authentication started SASL username: gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "uid=test42,ou=Testing,dc=stroeder,dc=de" ldap_modify: Type or value exists (20) additional info: modify/add: pwdChangedTime: value #0 already exists ----------------------------- snip -----------------------------

1 0

Re: (ITS#7273) Sig abort crash in slapd using GSSAPI auth in slap_listener at daemon.c:1891
by Howard Chu 02 Dec '19

02 Dec '19

Hi, we believe this issue was due to a bug we recently found in Heimdal. Details are in ITS#9112. http://www.openldap.org/its/index.cgi/Build?id=9112 Closing this ITS.

1 0

Re: (ITS#9125) [regression] back-ldap does not respect --without-tls
by hyc＠symas.com 01 Dec '19

01 Dec '19

grapvar(a)gmail.com wrote: > Full_Name: Konstantin Andreev > Version: git/master/1dbf0e9/20191129 > OS: Solaris 11.3 x64 > URL: > Submission from: (NULL) (79.135.238.172) > > > I have configured the tip of the master branch like so: > > | $ ../configure ... --without-tls ... > | ... > | configure: WARNING: TLS data protection not supported! > > and then compilation has failed: Fixed now in git master. > > | cc -g -m64 -I../../../include -I../../../../include -I.. > -I../../../../servers/slapd/back-ldap/.. -DSLAPD_IMPORT -c > ../../../../servers/slapd/back-ldap/config.c -KPIC -DPIC -o .libs/config.o > | "../../../../servers/slapd/back-ldap/config.c", line 87: warning: > initialization type mismatch > | ... > | "../../../../servers/slapd/back-ldap/config.c", line 992: undefined > struct/union member: sb_tls_ctx > | "../../../../servers/slapd/back-ldap/config.c", line 993: improper member use: > sb_tls_ctx > | ... > | cc: acomp failed for ../../../../servers/slapd/back-ldap/config.c > > ... because slapd.h guards sb_tls_* members of the [struct slap_bindconf]: > > | servers/slapd/slap.h: > | typedef struct slap_bindconf { > | ... > | #ifdef HAVE_TLS > | void *sb_tls_ctx; > | char *sb_tls_cert; > | ... > | #endif > | } slap_bindconf; > > but back-ldap/config.c apparently does not respect HAVE_TLS. > > This is a regression, because latest release 2.4.48 compiles without TLS > succeessfully. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#9125) [regression] back-ldap does not respect --without-tls
by grapvar＠gmail.com 01 Dec '19

01 Dec '19

Full_Name: Konstantin Andreev Version: git/master/1dbf0e9/20191129 OS: Solaris 11.3 x64 URL: Submission from: (NULL) (79.135.238.172) I have configured the tip of the master branch like so: | $ ../configure ... --without-tls ... | ... | configure: WARNING: TLS data protection not supported! and then compilation has failed: | cc -g -m64 -I../../../include -I../../../../include -I.. -I../../../../servers/slapd/back-ldap/.. -DSLAPD_IMPORT -c ../../../../servers/slapd/back-ldap/config.c -KPIC -DPIC -o .libs/config.o | "../../../../servers/slapd/back-ldap/config.c", line 87: warning: initialization type mismatch | ... | "../../../../servers/slapd/back-ldap/config.c", line 992: undefined struct/union member: sb_tls_ctx | "../../../../servers/slapd/back-ldap/config.c", line 993: improper member use: sb_tls_ctx | ... | cc: acomp failed for ../../../../servers/slapd/back-ldap/config.c ... because slapd.h guards sb_tls_* members of the [struct slap_bindconf]: | servers/slapd/slap.h: | typedef struct slap_bindconf { | ... | #ifdef HAVE_TLS | void *sb_tls_ctx; | char *sb_tls_cert; | ... | #endif | } slap_bindconf; but back-ldap/config.c apparently does not respect HAVE_TLS. This is a regression, because latest release 2.4.48 compiles without TLS succeessfully.

1 0

Re: (ITS#9124) Unauthenticated remote denial-of-service (Null pointer dereference in ber_skip_tag)
by michael＠stroeder.com 29 Nov '19

29 Nov '19

On 11/29/19 1:06 PM, ondra(a)mistotebe.net wrote: > thanks for the report, this should be fixed by commit > 1dbf0e9441def3d6dbc0fa8fba3c2e86fa50fa19 in master. Will this fix be added to 2.4.49 and when? Ciao, Michael.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs