- openldap-bugs - openldap.org

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining
by khosrow.ebrahimpour＠ssc-spc.gc.ca 15 Dec '14

15 Dec '14

On 12/15/2014 12:09 PM, Howard Chu wrote: > khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: >> Full_Name: K. Ebrahimpour >> Version: RE24 (commit dbc6741750de79b852ec9f728abb8b1425b6f03f) >> OS: Ubuntu 14.04.1 >> URL: https://gist.github.com/khosrow/cc6640cad9275a2cd041 >> Submission from: (NULL) (205.211.133.128) > >> Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also >> able to >> replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. > > The current release is 2.4.40. For such old releases you should > contact Ubuntu for support. > I may not have been clear enough on which versions I have tested. Please see the *VERSION* field in the ITS submission form for the correct version. To clarify, I have tested and reproduced the bug on the following versions: * 2.4.28 on Ubuntu 12.04 (official Ubuntu package) * 2.4.31 on Ubuntu 14.04 (official Ubuntu package) * RE24 commit #dbc6741750de79b852ec9f728abb8b1425b6f03f on Ubuntu 14.04 (from OpenLDAP git repo) I understand the two first instances are old releases, I simply tested the bug on progressively newer versions of the software. Are you saying that the third tested version is also old? Thanks, -- Khosrow

1 0

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining
by hyc＠symas.com 15 Dec '14

15 Dec '14

khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: > Full_Name: K. Ebrahimpour > Version: RE24 (commit dbc6741750de79b852ec9f728abb8b1425b6f03f) > OS: Ubuntu 14.04.1 > URL: https://gist.github.com/khosrow/cc6640cad9275a2cd041 > Submission from: (NULL) (205.211.133.128) > Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able to > replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. The current release is 2.4.40. For such old releases you should contact Ubuntu for support. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining
by quanah＠zimbra.com 15 Dec '14

15 Dec '14

--On Monday, December 15, 2014 4:58 PM +0000 khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: > Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able > to replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. Both of those are years old, and known to have multitudes of issues. Please test using current RE24 code. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#8005) crash when multiple olcDbURI are defined for chaining
by khosrow.ebrahimpour＠ssc-spc.gc.ca 15 Dec '14

15 Dec '14

Full_Name: K. Ebrahimpour Version: RE24 (commit dbc6741750de79b852ec9f728abb8b1425b6f03f) OS: Ubuntu 14.04.1 URL: https://gist.github.com/khosrow/cc6640cad9275a2cd041 Submission from: (NULL) (205.211.133.128) While trying to setup referral chaining in a multi-master setup, I can setup chaining to one of the masters without any problems. And I can perform a MOD operation that is then referral chased and performed on the master. However, when I define both masters the replica crashes when I do a MOD operation. Snippet of cn=config from the working example: dn: olcDatabase={1}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {1}ldap olcDbStartTLS: start starttls=yes olcDbIDAssertAuthzFrom: {0}* olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbURI: ldap://ldap-m1.example.com olcDbIDAssertBind: mode=self flags=prescriptive,proxauauthz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=com" credentials="secret" keepalive=0:0:0 starttls=yes tls_reqcert=allow If I change olcDbURI to either of the entries below, the replica server crashes * olcDbURI: "ldap://ldap-m1.example.com,ldap://ldap-m2.example.com" * olcDbURI: "ldap://ldap-m1.example.com ldap://ldap-m2.example.com" According to slapd-ldap(5), the URI list can be comma or space separated. I've turned on "args" and "trace" debugging to troubleshoot, but never get any errors in the logs. I only see an attempt to chase the referral followed by an immediate crash (see log snippet at the end of email). Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able to replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise.

1 0

Re: (ITS#8003) segault with jpegPhoto > ~27KB and audit overlay
by hyc＠symas.com 15 Dec '14

15 Dec '14

Raffael Sahli wrote: > On 12.12.2014 09:08, Howard Chu wrote: >> public(a)raffaelsahli.com wrote: >>> Full_Name: Raffael Sahli >>> Version: 2.4.40 >>> OS: Ubuntu LTS 12.04 >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (46.245.145.146) >>> >>> >>> slapd will crash if a database has the audit overlay enabled and the >>> attribute >>> jpegPhoto will be modified or added with data bigger than ~27KB. >>> >>> `/usr/local/libexec/slapd': free(): invalid next size (normal) >>> >>> Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and >>> bdb/mdb. >>> >>> Remove the audit overlay or migrate back to 2.4.39 solves the problem. Thanks, fixed now in master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8003) segault with jpegPhoto > ~27KB and audit overlay
by public＠raffaelsahli.com 15 Dec '14

15 Dec '14

On 12.12.2014 09:08, Howard Chu wrote: > public(a)raffaelsahli.com wrote: >> Full_Name: Raffael Sahli >> Version: 2.4.40 >> OS: Ubuntu LTS 12.04 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (46.245.145.146) >> >> >> slapd will crash if a database has the audit overlay enabled and the >> attribute >> jpegPhoto will be modified or added with data bigger than ~27KB. >> >> `/usr/local/libexec/slapd': free(): invalid next size (normal) >> >> Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and >> bdb/mdb. >> >> Remove the audit overlay or migrate back to 2.4.39 solves the problem. >> >> > Please provide a sample slapd config that demonstrates the problem. > include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database mdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" rootpw secret directory /usr/local/var/openldap-data index objectClass eq overlay auditlog auditlog /var/log/audit_slapd.log -- Raffael Sahli

1 0

Re: (ITS#8004) Simple Paged Control: Set 'size' in return control value to number of search results
by hyc＠symas.com 12 Dec '14

12 Dec '14

michael(a)stroeder.com wrote: > Full_Name: > Version: > OS: > URL: > Submission from: (NULL) (79.227.182.177) > > > Feature request: > > http://tools.ietf.org/html/rfc2696#section-3 > > In the control returned to the client, the > size MAY be set to the server's estimate of the total number of > entries in the entire result set. > > So a client could evaluate this size value whether it's greater than 0 and take > this as indication how many search results would be returned (and e.g. display > it to the user). slapd doesn't know in advance how many results can be returned. It knows how many potential candidates were generated by index lookups, but this number may be much larger than the actual result set. In particular, the result set may be much smaller due to ACLs, as well as actual filter comparisons. It would be a security violation to disclose the existence of entries that the user is not permitted to see. Rejecting this request. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8004) Simple Paged Control: Set 'size' in return control value to number of search results
by michael＠stroeder.com 12 Dec '14

12 Dec '14

Full_Name: Version: OS: URL: Submission from: (NULL) (79.227.182.177) Feature request: http://tools.ietf.org/html/rfc2696#section-3 In the control returned to the client, the size MAY be set to the server's estimate of the total number of entries in the entire result set. So a client could evaluate this size value whether it's greater than 0 and take this as indication how many search results would be returned (and e.g. display it to the user). I'm asking myself whether slapo-noopsrch would be the right place for handling this. The no-op search control returns two distinct values for search results and search continuations though.

1 0

Re: (ITS#8003) segault with jpegPhoto > ~27KB and audit overlay
by hyc＠symas.com 12 Dec '14

12 Dec '14

public(a)raffaelsahli.com wrote: > Full_Name: Raffael Sahli > Version: 2.4.40 > OS: Ubuntu LTS 12.04 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (46.245.145.146) > > > slapd will crash if a database has the audit overlay enabled and the attribute > jpegPhoto will be modified or added with data bigger than ~27KB. > > `/usr/local/libexec/slapd': free(): invalid next size (normal) > > Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and bdb/mdb. > > Remove the audit overlay or migrate back to 2.4.39 solves the problem. > > Please provide a sample slapd config that demonstrates the problem. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8003) segault with jpegPhoto > ~27KB and audit overlay
by public＠raffaelsahli.com 12 Dec '14

12 Dec '14

Full_Name: Raffael Sahli Version: 2.4.40 OS: Ubuntu LTS 12.04 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (46.245.145.146) slapd will crash if a database has the audit overlay enabled and the attribute jpegPhoto will be modified or added with data bigger than ~27KB. `/usr/local/libexec/slapd': free(): invalid next size (normal) Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and bdb/mdb. Remove the audit overlay or migrate back to 2.4.39 solves the problem.

1 0

(ITS#8002) SSL fails with olcTLSVerifyClient=allow when ITS 7979 patch is applied
by rik.theys＠esat.kuleuven.be 11 Dec '14

11 Dec '14

Full_Name: Rik Theys Version: 2.4.40 OS: Fedora 21 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (134.58.253.57) Hi, After upgrading from Fedora 20 to 21 my client machine could no longer connect to our LDAP server. Fedora links openldap with nss for TLS. It throws the following error: TLS: certdb config: configDir='/etc/openldap/cacerts' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly TLS: cannot open certdb '/etc/openldap/cacerts', error -8018:Unknown PKCS #11 error. TLS: loaded CA certificate file /etc/openldap/cacerts/a9b3780c.0 from CA certificate directory /etc/openldap/cacerts. TLS: loaded CA certificate file /etc/openldap/cacerts/f4033bb2.0 from CA certificate directory /etc/openldap/cacerts. TLS: skipping 'cacert.pem' - filename does not have expected format (certificate hash with numeric suffix) TLS: skipping 'esat.pem' - filename does not have expected format (certificate hash with numeric suffix) TLS: certificate [CN=wheezy-test.esat.kuleuven.be,OU=ESAT,O=KU Leuven,ST=Leuven,C=BE] is valid TLS: error: connect - force handshake failure: errno 0 - moznss error -12256 TLS: can't connect: TLS error -12256:SSL received a malformed Certificate Request handshake message.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) I downgraded to fedora package 2.4.40-1.fc21 which did not have this bug. The only difference between 2.4.40-1.fc21 and 2.4.40-2.fc21 is a backported patch for ITS #7979 which adds TLS 1+ support. I tried to reproduce this on a test machine and was initially unable to reproduce it there. Comparing the config of the test machine with our failing LDAP servers only showed a difference for the olcTLSVerifyClient setting. When the LDAP server does not have 'olcTLSVerifyClient: allow' in its configuration, it works. Once I set this parameter in the server configuration, the error above appears and LDAP connections are broken. The patch looks OK so maybe there's something wrong when openldap uses a higher TLS version and the bug it to be found there? I've also filed this bug in the fedora bug tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1172638 Regards, Rik

1 0

Re: (ITS#7977) Supported PBKDF2-SHA256 and PBKDF2-SHA512
by luca.bruno＠rocket-internet.de 11 Dec '14

11 Dec '14

> with a corresponding IPR statement as outlined in > our Contributors guidelines. I was (wrongly) assuming that the explicit "Signed-off-by" line in each patch was enough to express this from my side. Just to be more explicit, here is the IPR statement for my part of the patch: """ The attached patch is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Luca Bruno, on behalf of "Rocket Internet AG". By virtue of my employment agreement with "Rocket Internet AG", I have assigned my rights and interest in this work to "Rocket Internet AG". "Rocket Internet AG" has not assigned rights and/or interest in this work to any party. I, Luca Bruno am authorized by "Rocket Internet AG", my employer, to release this work under the following terms. "Rocket Internet AG" hereby places the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. """ Cheers, Luca PS. I would suggest to explicitly CC third-parties when you are missing IPR info, as I was not aware that this ticket was waiting for input on my side. -- Luca Bruno (kaeso) Security Engineer Rocket Internet AG -> GPG Key ID: 0x4F3BBEBF

1 0

Re: (ITS#8001) Segmentation Fault in ldap_sync_*
by hyc＠symas.com 10 Dec '14

10 Dec '14

alexey(a)kireyev.name wrote: > Full_Name: Alexey Kireyev > Version: 2.4.40 > OS: Ubuntu 14.04 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (98.118.88.65) > > > If not all fields in ldap_sync_t manually set after ldap_sync_initialize, then > any following calls might (and most probably will) ends in segmentation fault. > > Reason: ldap_sync_initialize doesn't zeroed newly allocated structure (it does > it for pre-existing, though, which is wrong by itself in my view) Thanks, you're right. fixed in master. > > > > > -------------------------------------------------------------------------------------------------------- > > >>From 01149a2eba9f463261d88e5a1ce43e19c4a323cf Mon Sep 17 00:00:00 2001 > From: Alexey Kireyev <alexey(a)kireyev.name> > Date: Wed, 10 Dec 2014 14:37:16 -0500 > Subject: [PATCH] Newly allocated ldap_sync_t has to be zero out > > --- > libraries/libldap/ldap_sync.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/libraries/libldap/ldap_sync.c b/libraries/libldap/ldap_sync.c > index e573c3b..e79153f 100644 > --- a/libraries/libldap/ldap_sync.c > +++ b/libraries/libldap/ldap_sync.c > @@ -64,11 +64,10 @@ ldap_sync_initialize( ldap_sync_t *ls_in )D%D > if ( ls == NULL ) { > return NULL; > } > - > - } else { > - memset( ls, 0, sizeof( ldap_sync_t ) ); > } > > + memset( ls, 0, sizeof( ldap_sync_t ) ); > + > ls->ls_scope = LDAP_SCOPE_SUBTREE; > ls->ls_timeout = -1; > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7998) no-return-in-nonvoid-function noopsrch.c:145
by michael＠stroeder.com 10 Dec '14

10 Dec '14

hyc(a)symas.com wrote: > michael(a)stroeder.com wrote: >> As I read noopsrch_response there's a else {} clause missing. >> But I'm not sure. > > Yes, but not important. Unfortunately the build is blocked on openSUSE build system because of this. There may be a way to work around it but I don't know how. Ciao, Michael.

1 0

Re: (ITS#8000) Warnings building contrib overlay passwd/sha2
by hyc＠symas.com 10 Dec '14

10 Dec '14

michael(a)stroeder.com wrote: > Full_Name: > Version: RE24 > OS: > URL: > Submission from: (NULL) (79.227.174.182) > > > HI! > > I'm trying to package passwd/sha2 for openSUSE. > The default compiler options in their build system results in these warnings: Fixed in master. The note about compilers breaking this code is spurious. Any compiler that failed to properly compile the previous code would itself be broken. > > [ 193s] + CFLAGS='-fomit-frame-pointer -fmessage-length=0 -grecord-gcc-switches > -fstack-protector -O2 -Wall -D_FORTIFY_SOURCE=2 -funwind-tables > -fasynchronous-unwind-tables -g -Wno-format-extra-args -fno-strict-aliasing' > [ 193s] + make -j4 sysconfdir=/etc/openldap libdir=/usr/lib > libexecdir=/usr/lib > [ 193s] ../../../../libtool --mode=compile gcc -g -O2 -Wall > -I..%2.%./../../include -I../../../../include -I../../../../servers/slapd -c > slapd-sha2.c > [ 193s] ../../../../libtool --mode=compile gcc -g -O2 -Wall > -I../../../../include -I../../../../include -I../../../../servers/slapd -c > sha2.c > [ 193s] mkdir .libs > [ 193s] mkdir .libs > [ 193s] mkdir: cannot create directory '.libs': File exists > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c sha2.c -fPIC -DPIC -o .libs/sha2.o > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c slapd-sha2.c -fPIC -DPIC -o .libs/slapd-sha2.o > [ 193s] sha2.c: In function 'SHA256_Final': > [ 193s] sha2.c:608:3: warning: dereferencing type-punned pointer will break > strict-aliasing rules [-Wstrict-aliasing] > [ 193s] *(sha2_word64*)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = > context->bitcount; > [ 193s] ^ > [ 193s] sha2.c: In function 'SHA512_Last': > [ 193s] sha2.c:925:2: warning: dereferencing type-punned pointer will break > strict-aliasing rules [-Wstrict-aliasing] > [ 193s] *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = > context->bitcount[1]; > [ 193s] ^ > [ 193s] sha2.c:926:2: warning: dereferencing type-punned pointer will break > strict-aliasing rules [-Wstrict-aliasing] > [ 193s] *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = > context->bitcount[0]; > [ 193s] ^ > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c slapd-sha2.c -o slapd-sha2.o >/dev/null > 2>&1 > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c sha2.c -o sha2.o >/dev/null 2>&1 > [ 194s] ../../../../libtool --mode=link gcc -g -O2 -Wall -version-info 0:0:0 \ > [ 194s] -rpath /usr/lib/openldap -module -o pw-sha2.la slapd-sha2.lo sha2.lo > ../../../../libraries/libldap_r/libldap_r.la > ../../../../libraries/liblber/liblber.la > [ 194s] cc -shared .libs/slapd-sha2.o .libs/sha2.o -Wl,--rpath > -Wl,/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/libldap_r/.libs > -Wl,--rpath -Wl,/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/liblber/.libs > -L/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/liblber/.libs > ../../../../libraries/libldap_r/.libs/libldap_r.so > ../../../../libraries/liblber/.libs/liblber.so -Wl,-soname -Wl,pw-sha2.so.0 -o > .libs/pw-sha2.so.0.0.0 > [ 194s] (cd .libs && rm -f pw-sha2.so.0 && ln -s > pw-sha2.so.0.0.0 pw-sha2.so.0) > [ 194s] (cd .libs && rm -f pw-sha2.so && ln -s pw-sha2.so.0.0.0 > pw-sha2.so) > [ 194s] ar cru .libs/pw-sha2.a slapd-sha2.o sha2.o > [ 194s] ranlib .libs/pw-sha2.a > [ 194s] creating pw-sha2.la > > > Overall RPM build fails with: > > [ 262s] I: Program is likely to break with new gcc. Try -fno-strict-aliasing. > [ 262s] W: openldap2 strict-aliasing-punning sha2.c:608, 925, 926 > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7998) no-return-in-nonvoid-function noopsrch.c:145
by hyc＠symas.com 10 Dec '14

10 Dec '14

michael(a)stroeder.com wrote: > As I read noopsrch_response there's a else {} clause missing. > But I'm not sure. Yes, but not important. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7998) no-return-in-nonvoid-function noopsrch.c:145
by hyc＠symas.com 10 Dec '14

10 Dec '14

michael(a)stroeder.com wrote: > Full_Name: > Version: RE24 > OS: > URL: > Submission from: (NULL) (79.227.174.182) > > > Building slapo- (contrib/) with strict warnings results in: > > no-return-in-nonvoid-function noopsrch.c:145 > > Fixed in master -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7997) no-return-in-nonvoid-function dupent.c:367
by hyc＠symas.com 10 Dec '14

10 Dec '14

michael(a)stroeder.com wrote: > Full_Name: > Version: > OS: > URL: > Submission from: (NULL) (79.227.174.182) > > > Building slapo-dupent (contrib/) with strict warnings results in: > > no-return-in-nonvoid-function dupent.c:367 > > > Fixed in master -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8001) Segmentation Fault in ldap_sync_*
by alexey＠kireyev.name 10 Dec '14

10 Dec '14

Full_Name: Alexey Kireyev Version: 2.4.40 OS: Ubuntu 14.04 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (98.118.88.65) If not all fields in ldap_sync_t manually set after ldap_sync_initialize, then any following calls might (and most probably will) ends in segmentation fault. Reason: ldap_sync_initialize doesn't zeroed newly allocated structure (it does it for pre-existing, though, which is wrong by itself in my view) -------------------------------------------------------------------------------------------------------- >From 01149a2eba9f463261d88e5a1ce43e19c4a323cf Mon Sep 17 00:00:00 2001 From: Alexey Kireyev <alexey(a)kireyev.name> Date: Wed, 10 Dec 2014 14:37:16 -0500 Subject: [PATCH] Newly allocated ldap_sync_t has to be zero out --- libraries/libldap/ldap_sync.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libraries/libldap/ldap_sync.c b/libraries/libldap/ldap_sync.c index e573c3b..e79153f 100644 --- a/libraries/libldap/ldap_sync.c +++ b/libraries/libldap/ldap_sync.c @@ -64,11 +64,10 @@ ldap_sync_initialize( ldap_sync_t *ls_in )D%D if ( ls == NULL ) { return NULL; } - - } else { - memset( ls, 0, sizeof( ldap_sync_t ) ); } + memset( ls, 0, sizeof( ldap_sync_t ) ); + ls->ls_scope = LDAP_SCOPE_SUBTREE; ls->ls_timeout = -1; -- 1.9.1 The attached patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Alexey Kireyev alexey(a)kireyev.name. I have not assigned rights and/or interest in this work to any party. I, Alexey Kireyev, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#8000) Warnings building contrib overlay passwd/sha2
by michael＠stroeder.com 10 Dec '14

10 Dec '14

Full_Name: Version: RE24 OS: URL: Submission from: (NULL) (79.227.174.182) HI! I'm trying to package passwd/sha2 for openSUSE. The default compiler options in their build system results in these warnings: [ 193s] + CFLAGS='-fomit-frame-pointer -fmessage-length=0 -grecord-gcc-switches -fstack-protector -O2 -Wall -D_FORTIFY_SOURCE=2 -funwind-tables -fasynchronous-unwind-tables -g -Wno-format-extra-args -fno-strict-aliasing' [ 193s] + make -j4 sysconfdir=/etc/openldap libdir=/usr/lib libexecdir=/usr/lib [ 193s] ../../../../libtool --mode=compile gcc -g -O2 -Wall -I..%2.%./../../include -I../../../../include -I../../../../servers/slapd -c slapd-sha2.c [ 193s] ../../../../libtool --mode=compile gcc -g -O2 -Wall -I../../../../include -I../../../../include -I../../../../servers/slapd -c sha2.c [ 193s] mkdir .libs [ 193s] mkdir .libs [ 193s] mkdir: cannot create directory '.libs': File exists [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include -I../../../../servers/slapd -c sha2.c -fPIC -DPIC -o .libs/sha2.o [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include -I../../../../servers/slapd -c slapd-sha2.c -fPIC -DPIC -o .libs/slapd-sha2.o [ 193s] sha2.c: In function 'SHA256_Final': [ 193s] sha2.c:608:3: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] [ 193s] *(sha2_word64*)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = context->bitcount; [ 193s] ^ [ 193s] sha2.c: In function 'SHA512_Last': [ 193s] sha2.c:925:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] [ 193s] *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1]; [ 193s] ^ [ 193s] sha2.c:926:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] [ 193s] *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0]; [ 193s] ^ [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include -I../../../../servers/slapd -c slapd-sha2.c -o slapd-sha2.o >/dev/null 2>&1 [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include -I../../../../servers/slapd -c sha2.c -o sha2.o >/dev/null 2>&1 [ 194s] ../../../../libtool --mode=link gcc -g -O2 -Wall -version-info 0:0:0 \ [ 194s] -rpath /usr/lib/openldap -module -o pw-sha2.la slapd-sha2.lo sha2.lo ../../../../libraries/libldap_r/libldap_r.la ../../../../libraries/liblber/liblber.la [ 194s] cc -shared .libs/slapd-sha2.o .libs/sha2.o -Wl,--rpath -Wl,/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/libldap_r/.libs -Wl,--rpath -Wl,/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/liblber/.libs -L/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/liblber/.libs ../../../../libraries/libldap_r/.libs/libldap_r.so ../../../../libraries/liblber/.libs/liblber.so -Wl,-soname -Wl,pw-sha2.so.0 -o .libs/pw-sha2.so.0.0.0 [ 194s] (cd .libs && rm -f pw-sha2.so.0 && ln -s pw-sha2.so.0.0.0 pw-sha2.so.0) [ 194s] (cd .libs && rm -f pw-sha2.so && ln -s pw-sha2.so.0.0.0 pw-sha2.so) [ 194s] ar cru .libs/pw-sha2.a slapd-sha2.o sha2.o [ 194s] ranlib .libs/pw-sha2.a [ 194s] creating pw-sha2.la Overall RPM build fails with: [ 262s] I: Program is likely to break with new gcc. Try -fno-strict-aliasing. [ 262s] W: openldap2 strict-aliasing-punning sha2.c:608, 925, 926

1 0

(ITS#7999) proxycache failed for bdb while testing
by yjd＠zjca.com.cn 10 Dec '14

10 Dec '14

Full_Name: edong Version: 2.4.40 OS: CentOS 6.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (60.190.254.10) BerkeleyDB version: 5.3.28 ./configure --enable-crypt --enable-lmpasswd --enable-spasswd --enable-modules --enable-backends=mod --enable-perl=no --enable-ndb=no --enable-overlays=mod --enable-dynamic The "make test" fails as follow3A3A ... Testing Bind caching Query 19: cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com Query 20: (Bind should be cached) Refresh failed >>>>> test020-proxycache failed for bdb (exit 1) make[2]: *** [bdb-mod] Error 1 make[2]: Leaving directory `/root/Downloads/openldap-2.4.40/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/root/Downloads/openldap-2.4.40/tests' make: *** [test] Error 2

1 0

Re: (ITS#7998) no-return-in-nonvoid-function noopsrch.c:145
by michael＠stroeder.com 10 Dec '14

10 Dec '14

As I read noopsrch_response there's a else {} clause missing. But I'm not sure.

1 0

(ITS#7998) no-return-in-nonvoid-function noopsrch.c:145
by michael＠stroeder.com 10 Dec '14

10 Dec '14

Full_Name: Version: RE24 OS: URL: Submission from: (NULL) (79.227.174.182) Building slapo- (contrib/) with strict warnings results in: no-return-in-nonvoid-function noopsrch.c:145

1 0

(ITS#7997) no-return-in-nonvoid-function dupent.c:367
by michael＠stroeder.com 10 Dec '14

10 Dec '14

Full_Name: Version: OS: URL: Submission from: (NULL) (79.227.174.182) Building slapo-dupent (contrib/) with strict warnings results in: no-return-in-nonvoid-function dupent.c:367

1 0

Re: (ITS#7968) SIGSEGV shortly after reconnection performed by syncrepl due to synchronization conflicts
by hyc＠symas.com 10 Dec '14

10 Dec '14

Leonid Yuriev wrote: > I saw that the master is lost some changes of the my original patch > (that was early attached to ITS). > > Please see attached diff. > I think it is a race condition around si_cookieState inside for-loop. Prove it. The fields being accessed inside the loop are for the pending values, and the pending mutex has already been acquired outside the loop. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs