openldap-bugs

openldap-bugs@openldap.org

1 participants
20967 discussions

Re: (ITS#7996) Tighten race in ldap_int_initialize
by Armin.Tueting＠tueting-online.com 23 Jun '19

23 Jun '19

Am Freitag, den 21.06.2019, 13:31 +0200 schrieb Ond=C5=99ej Kuzn=C3=ADk: [...] > Hi Armin, Hi Ondrej, > thank you very much for your report, this should now be fixed in master > with commit b2f4cacd4783cfe49370accc712863f9537f9924. I'm not following 'master' - I'm afraid! But, the commit has been merged into 'OPENLDAP_REL_ENG_2_4' and slapd is now serving our requests! So far, so good! Thanks for your effort! >=20 > Regards, Regards, Armin.

1 0

(ITS#9041) cyrus.c includes limits.h twice
by quanah＠openldap.org 21 Jun '19

21 Jun '19

Full_Name: Quanah Gibson-Mount Version: RE24 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.128.44) There appear to have been dueling commits on April 10, 2005 and April 9, 2005, so that we get: 3e800f20bd (Kurt Zeilenga 2005-04-10 19:32:14 +0000 28)#ifdef HAVE_LIMITS_H 3e800f20bd (Kurt Zeilenga 2005-04-10 19:32:14 +0000 29)#include <limits.h> 3e800f20bd (Kurt Zeilenga 2005-04-10 19:32:14 +0000 30)#endif 3e800f20bd (Kurt Zeilenga 2005-04-10 19:32:14 +0000 31) bc0cc3272c (Kurt Zeilenga 2003-02-21 17:48:03 +0000 32)#include "ldap-int.h" bc0cc3272c (Kurt Zeilenga 2003-02-21 17:48:03 +0000 33) bc0cc3272c (Kurt Zeilenga 2003-02-21 17:48:03 +0000 34)#ifdef HAVE_CYRUS_SASL bc0cc3272c (Kurt Zeilenga 2003-02-21 17:48:03 +0000 35) eca819d866 (Howard Chu 2005-04-09 06:41:39 +0000 36)#ifdef HAVE_LIMITS_H eca819d866 (Howard Chu 2005-04-09 06:41:39 +0000 37)#include <limits.h> eca819d866 (Howard Chu 2005-04-09 06:41:39 +0000 38)#endif This should be cleaned up.

1 0

Re: (ITS#9037) observing crash in mdb_cursor_put()
by myk＠mykzilla.org 21 Jun '19

21 Jun '19

After stepping through the test program in a debugger, I see that mdb_page_search returns MDB_NOTFOUND if mc->mc_db->md_root is P_INVALID because the tree is empty. And mdb_cursor_put sets rc to MDB_NO_ROOT if mc->mc_db->md_root is P_INVALID. So that can't be related to the crash, at least not in the instances I'm investigating, because insert_key and insert_data (and hence rc) is always MDB_NOTFOUND in their minidumps when the crash occurs, which can't happen when rc is set to MDB_NO_ROOT. -myk

1 0

Re: (ITS#7996) Tighten race in ldap_int_initialize
by ondra＠mistotebe.net 21 Jun '19

21 Jun '19

On Tue, Jun 18, 2019 at 07:33:48AM +0000, Armin.Tueting(a)tueting-online.com wrote: > Am Montag, den 17.06.2019, 15:40 -0700 schrieb Quanah Gibson-Mount: >> --On Monday, June 17, 2019 7:16 PM +0200 Armin T=C3=BCting=20 >> <Armin.Tueting(a)tueting-online.com> wrote: >>>> I.e., it started and then got as far as reading your ldap.conf file. >>>> What is the contents of ldap.conf? >>> Attached 'ldap.conf'. Nothing unusual... >>> >>>> Have you run the test suite (make test)? Does it pass? fail? >>> Attached 'make_test.txt'. As far as I can see - it has been passed. >> >> Ok, so make test passes without issue, so it would appear there's something >> specific with your configuration that is triggering the problem. Would you >> be able to provide your slapd configuration (minus any passwords and the >> like)? > I'll privately send it to you in a seperate email. > >> >> Additionally, if you could get a full gdb backtrace of the hung slapd=20 >> process that would be useful as well. I.e.: >> >> start up slapd >> gdb /path/to/slapd <pid #> > (gdb) thr apply all bt full > #3 0x00007ffa4a92a135 in ldap_pvt_thread_mutex_lock > #4 0x00007ffa4a944e6e in ldap_set_option > #5 0x00007ffa4a943ed3 in openldap_ldap_init_w_conf > #6 0x00007ffa4a944318 in openldap_ldap_init_w_sysconf > #8 0x00007ffa4a944e38 in ldap_set_option > #9 0x0000000000413cd6 in main () Hi Armin, thank you very much for your report, this should now be fixed in master with commit b2f4cacd4783cfe49370accc712863f9537f9924. Regards, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Corrected vulnerabilities (CVE's) versus ITS# number
by claude.cheret＠external.thalesgroup.com 21 Jun '19

21 Jun '19

Full_Name: Claude CHERET Version: 2.4.46 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (92.163.84.130) Hi, Can you tel me where I can find information about corrected CVE versus OpenLdap version ? Bests Regards. -- Claude Chéret claude.cheret(a)external.thalesgroup.com

1 0

Re: (ITS#9037) observing crash in mdb_cursor_put()
by myk＠mykzilla.org 20 Jun '19

20 Jun '19

myk(a)mykzilla.org wrote on 2019-06-20 23:39: > myk(a)mykzilla.org wrote on 2019-06-20 23:35: >> I'm unsure if it's related, but with this change to mdb.c, the following >> test program (which resembles Firefox's usage) asserts in >> mdb_cursor_init because rc is MDB_NOTFOUND. > Erm, here's the program without the errant characters: My apologies, I'm unsure why the characters appeared the second time as well. (I tested first by manually removing them, sending the message to myself, and then confirming they didn't appear.) I've saved the program to this GitHub gist: https://gist.github.com/mykmelez/ac75a7ab0a0d09a7d709be63806d01d7 -myk

1 0

Re: (ITS#9037) observing crash in mdb_cursor_put()
by myk＠mykzilla.org 20 Jun '19

20 Jun '19

myk(a)mykzilla.org wrote on 2019-06-20 23:35: > I'm unsure if it's related, but with this change to mdb.c, the following > test program (which resembles Firefox's usage) asserts in > mdb_cursor_init because rc is MDB_NOTFOUND. Erm, here's the program without the errant characters: #include <stdio.h> #include <stdlib.h> #include "lmdb.h" #define E(expr) CHECK((rc = (expr)) == MDB_SUCCESS, #expr) #define CHECK(test, msg) ((test) ? (void)0 : ((void)fprintf(stderr, \ "%s:%d: %s: %s\n", __FILE__, __LINE__, msg, mdb_strerror(rc)), abort())) int main(int argc,char * argv[]) { int rc; MDB_env *env; MDB_dbi dbi; MDB_val key, data; MDB_txn *txn; char sval[] = "foo"; char dval[] = "bar"; E(mdb_env_create(&env)); E(mdb_env_set_maxdbs(env, 2)); E(mdb_env_open(env, "./mytestdb", 0, 0664)); E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_dbi_open(txn, "subdb", MDB_CREATE, &dbi)); E(mdb_txn_commit(txn)); key.mv_size = 3; key.mv_data = sval; data.mv_size = 3; data.mv_data = dval; E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_put(txn, dbi, &key, &data, 0)); E(mdb_txn_commit(txn)); mdb_dbi_close(env, dbi); mdb_env_close(env); return 0; }

1 0

Re: (ITS#9037) observing crash in mdb_cursor_put()
by myk＠mykzilla.org 20 Jun '19

20 Jun '19

hyc(a)symas.com wrote on 2019-06-19 09:55: > Maybe. For testing purposes you could try something like this > diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c > index 692feaa38b..e41f3bc36a 100644 > --- a/libraries/liblmdb/mdb.c > +++ b/libraries/liblmdb/mdb.c > @@ -7620,7 +7620,8 @@ mdb_cursor_init(MDB_cursor *mc, MDB_txn *txn, MDB_dbi dbi, MDB_xcursor *mx) > mc->mc_xcursor = NULL; > } > if (*mc->mc_dbflag & DB_STALE) { > - mdb_page_search(mc, NULL, MDB_PS_ROOTONLY); > + int rc = mdb_page_search(mc, NULL, MDB_PS_ROOTONLY); > + mdb_cassert(mc, !rc); > } > } I'm unsure if it's related, but with this change to mdb.c, the following test program (which resembles Firefox's usage) asserts in mdb_cursor_init because rc is MDB_NOTFOUND. #include <stdio.h> #include <stdlib.h> #include "lmdb.h" #define E(expr) CHECK((rc = (expr)) == MDB_SUCCESS, #expr) #define CHECK(test, msg) ((test) ? (void)0 : ((void)fprintf(stderr, \ "%s:%d: %s: %s\n", __FILE__, __LINE__, msg, mdb_strerror(rc)), abort())) int main(int argc,char * argv[]) { int rc; MDB_env *env; MDB_dbi dbi; MDB_val key, data; MDB_txn *txn; char sval[] = "foo"; char dval[] = "bar"; E(mdb_env_create(&env)); E(mdb_env_set_maxdbs(env, 2)); E(mdb_env_open(env, "./mytestdb", 0, 0664)); E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_dbi_open(txn, "subdb", MDB_CREATE, &dbi)); E(mdb_txn_commit(txn)); key.mv_size = 3; key.mv_data = sval; data.mv_size = 3; data.mv_data = dval; E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_put(txn, dbi, &key, &data, 0)); E(mdb_txn_commit(txn)); mdb_dbi_close(env, dbi); mdb_env_close(env); return 0; } Without the change to mdb.c, however, the program appears to work correctly. -myk

1 0

Re: (ITS#9039) key corruption using mdb_put and differing data
by hyc＠symas.com 20 Jun '19

20 Jun '19

lmdb(a)pluckeye.net wrote: > Full_Name: Jonny Wilkes > Version: 2.4.2 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (67.160.82.31) > > > The following code shows key corruption. Yes, because you've misused the API. > > I am probably using the API wrong, but I don't see how. I apologize in advance > for not having a clue. Read the Note http://www.lmdb.tech/doc/group__mdb.html#ga8bf10cd91d3f3a83a34d04ce6b07992d Further comments below. > And now, on to the test. It can be compiled and run like so: > > gcc t1.c -llmdb && ./a.out > > --------- t1.c starts here --------- > /* > > The output of this program using liblmdb0 v0.9.21-1 on Ubuntu is: > > --- dump --- > key12345 > key67890 > --- dump --- > key12345 > y12345 > > Why? What happened to key67890? > > */ > > #include <lmdb.h> > #if USE_SOURCE > #include "midl.c" > #include "mdb.c" > #endif > #include <stdio.h> > #include <string.h> > #include <unistd.h> > > #define P(K) printf("%s\n", (char *)K.mv_data) > > #define X(x) do { int _x = x; if (_x) fprintf(stderr, "%d %s\n", _x, > mdb_strerror(_x)); } while (0) > > const char *path = "/tmp/lmdb-why.tmp"; > MDB_env *env; > > /* > * setup creates /tmp/lmdb-why.tmp with 2 keys with the data "hey": > * > * 1. key12345 : hey > * 2. key67890 : hey > */ > int > setup(void) > { > unlink(path); > if (!env) { > X(mdb_env_create(&env)); > X(mdb_env_open(env, path, MDB_NOSUBDIR, 0664)); > } > > MDB_txn *txn; X(mdb_txn_begin(env, NULL, 0, &txn)); > MDB_dbi dbi; X(mdb_dbi_open(txn, NULL, 0, &dbi)); > > const char *keys[] = { > "key12345", > "key67890" > }; > for (unsigned i = 0; i < 2; ++i) { > MDB_val key, data; > key.mv_data = (void *)keys[i]; > key.mv_size = strlen(keys[i])+1; > data.mv_data = "hey"; > data.mv_size = 4; > X(mdb_put(txn, dbi, &key, &data, 0)); > } > X(mdb_txn_commit(txn)); > return 0; > } > > int > dump(void) > { > printf("--- dump ---\n"); > > MDB_txn *txn; X(mdb_txn_begin(env, NULL, 0, &txn)); > MDB_dbi dbi; X(mdb_dbi_open(txn, NULL, 0, &dbi)); > MDB_cursor *cursor; X(mdb_cursor_open(txn, dbi, &cursor)); > > MDB_val key; > int rc; > while ((rc = mdb_cursor_get(cursor, &key, NULL, MDB_NEXT)) == 0) { > P(key); > } > > mdb_cursor_close(cursor); > if (MDB_NOTFOUND != rc) > return rc; > mdb_txn_abort(txn); > return 0; > } > > /* > * change_data change the data for each key to "there" using mdb_put. > * After it completes, the keys are corrupt. > */ > int > change_data(void) > { > MDB_txn *txn; X(mdb_txn_begin(env, NULL, 0, &txn)); > MDB_dbi dbi; X(mdb_dbi_open(txn, NULL, 0, &dbi)); > MDB_cursor *cursor; X(mdb_cursor_open(txn, dbi, &cursor)); > > MDB_val key; > int rc; > while ((rc = mdb_cursor_get(cursor, &key, NULL, MDB_NEXT)) == 0) { > MDB_val data; > data.mv_data = (void *)"there"; > data.mv_size = 6; /* ! */ > X(mdb_put(txn, dbi, &key, &data, 0)); As documented, the key returned by mdb_cursor_get is only valid until the next update operation. Since you've called mdb_put here, the key is altered while the put is executing, and so you get your corruption. You have to copy the key if you want this particular code to work. But even so, you're not using the API optimally. Since you have a cursor already, you should be using mdb_cursor_put instead. > } > mdb_cursor_close(cursor); > if (MDB_NOTFOUND != rc) > return rc; > > X(mdb_txn_commit(txn)); > return 0; > } > > int main(void) > { > X(setup()); > X(dump()); > X(change_data()); > X(dump()); > return 0; > } Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#9039) key corruption using mdb_put and differing data
by lmdb＠pluckeye.net 19 Jun '19

19 Jun '19

Full_Name: Jonny Wilkes Version: 2.4.2 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (67.160.82.31) The following code shows key corruption. I am probably using the API wrong, but I don't see how. I apologize in advance for not having a clue. And now, on to the test. It can be compiled and run like so: gcc t1.c -llmdb && ./a.out --------- t1.c starts here --------- /* The output of this program using liblmdb0 v0.9.21-1 on Ubuntu is: --- dump --- key12345 key67890 --- dump --- key12345 y12345 Why? What happened to key67890? */ #include <lmdb.h> #if USE_SOURCE #include "midl.c" #include "mdb.c" #endif #include <stdio.h> #include <string.h> #include <unistd.h> #define P(K) printf("%s\n", (char *)K.mv_data) #define X(x) do { int _x = x; if (_x) fprintf(stderr, "%d %s\n", _x, mdb_strerror(_x)); } while (0) const char *path = "/tmp/lmdb-why.tmp"; MDB_env *env; /* * setup creates /tmp/lmdb-why.tmp with 2 keys with the data "hey": * * 1. key12345 : hey * 2. key67890 : hey */ int setup(void) { unlink(path); if (!env) { X(mdb_env_create(&env)); X(mdb_env_open(env, path, MDB_NOSUBDIR, 0664)); } MDB_txn *txn; X(mdb_txn_begin(env, NULL, 0, &txn)); MDB_dbi dbi; X(mdb_dbi_open(txn, NULL, 0, &dbi)); const char *keys[] = { "key12345", "key67890" }; for (unsigned i = 0; i < 2; ++i) { MDB_val key, data; key.mv_data = (void *)keys[i]; key.mv_size = strlen(keys[i])+1; data.mv_data = "hey"; data.mv_size = 4; X(mdb_put(txn, dbi, &key, &data, 0)); } X(mdb_txn_commit(txn)); return 0; } int dump(void) { printf("--- dump ---\n"); MDB_txn *txn; X(mdb_txn_begin(env, NULL, 0, &txn)); MDB_dbi dbi; X(mdb_dbi_open(txn, NULL, 0, &dbi)); MDB_cursor *cursor; X(mdb_cursor_open(txn, dbi, &cursor)); MDB_val key; int rc; while ((rc = mdb_cursor_get(cursor, &key, NULL, MDB_NEXT)) == 0) { P(key); } mdb_cursor_close(cursor); if (MDB_NOTFOUND != rc) return rc; mdb_txn_abort(txn); return 0; } /* * change_data change the data for each key to "there" using mdb_put. * After it completes, the keys are corrupt. */ int change_data(void) { MDB_txn *txn; X(mdb_txn_begin(env, NULL, 0, &txn)); MDB_dbi dbi; X(mdb_dbi_open(txn, NULL, 0, &dbi)); MDB_cursor *cursor; X(mdb_cursor_open(txn, dbi, &cursor)); MDB_val key; int rc; while ((rc = mdb_cursor_get(cursor, &key, NULL, MDB_NEXT)) == 0) { MDB_val data; data.mv_data = (void *)"there"; data.mv_size = 6; /* ! */ X(mdb_put(txn, dbi, &key, &data, 0)); } mdb_cursor_close(cursor); if (MDB_NOTFOUND != rc) return rc; X(mdb_txn_commit(txn)); return 0; } int main(void) { X(setup()); X(dump()); X(change_data()); X(dump()); return 0; }

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs