https://bugs.openldap.org/show_bug.cgi?id=9429
Issue ID: 9429
Summary: LMDB mdb_del and mdb_cursor_del cause MDB_MAP_FULL on
Apple M1
Product: LMDB
Version: 0.9.26
Hardware: Other
OS: Mac OS
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: simonleier(a)gmail.com
Target Milestone: ---
I discovered that deleting data from the database causes MDB_MAP_FULL on my
MacBook Pro with M1 chip. The same code works fine on an Intel Mac.
I think there is no special code required to reproduce this. Open a db, put
something, try to delete it and LMDB crashes.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8372
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://bugs.openldap.org/s
| |how_bug.cgi?id=9426
--- Comment #5 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
May be duplicate of Issue#9426
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9397
Issue ID: 9397
Summary: LMDB: A second process opening a file with
MDB_WRITEMAP can cause the first to SIGBUS
Product: LMDB
Version: 0.9.26
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: github(a)nicwatson.org
Target Milestone: ---
Created attachment 780
--> https://bugs.openldap.org/attachment.cgi?id=780&action=edit
Full reproduction of SIGBUS MDB_WRITEMAP issue (works on Linux only)
The fundamental problem is that a ftruncate() on Linux that makes a file
smaller will cause accesses past the new end of the file to SIGBUS (see the
mmap man page).
The sequence that causes a SIGBUS involves two processes.
1. The first process opens a new LMDB file with MDB_WRITEMAP.
2. The second process opens the same LMDB file with MDB_WRITEMAP and with an
explicit map_size smaller than the first process's map size.
* This causes an ftruncate that makes the underlying file *smaller*.
3. (Optional) The second process closes the environment and exits.
4. The first process opens a write transaction and writes a bunch of data.
5. The first process commits the transaction. This causes a memory read from
the mapped memory that's now past the end of the file. On Linux, this triggers
a SIGBUS.
Attached is code that fully reproduces the problem on Linux.
The most straightforward solution is to allow ftruncate to *reduce* the file
size if it is the only reader. Another possibility is check the file size and
ftruncate if necessary every time a write transaction is opened. A third
possibility is to catch the SIGBUS signal.
Repro note: I used clone() to create the subprocess to most straightforwardly
demonstrate that the problem is not due to inherited file descriptors. The
problem still manifests when the processes are completely independent.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9418
Issue ID: 9418
Summary: slapd-bconfig: potential nullptr deref
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: danix800(a)gmail.com
Target Milestone: ---
Reported by clang static analyzer in servers/slapd/bconfig.c:6429
'ce->ce_parent'
is potentially nullptr dereference based on the above test of 'ce->ce_parent'
against null before 'access_allowed' is called, so it's better to check again.
See MR!208 for a potential fix.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8528
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords|OL_2_5_REQ |
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9415
Issue ID: 9415
Summary: Possible use of memory after free
Product: LMDB
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: cwe(a)skov.dk
Target Milestone: ---
In my code I have a construct like this:
err = mdb_txn_commit(txn);
if (err) {
mdb_txn_abort(txn);
}
I run codesonar on my code and include the lmdb source in the run. Codesonar
reports a possible double free for the case where mdb_midl_append_list in mdb.c
line 3586 returns ENOMEM. The code following line 3586 will free the txn and
return ENOMEM. This will cause my code to call mdb_txn_abort, which will access
the freed memory and call free again.
Please ask if more details are needed.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9401
Issue ID: 9401
Summary: Fix ldap_install_tls function name
Product: OpenLDAP
Version: 2.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
The ldap_install_tls function is really an internal only method for slapd. It
should be renamed accordingly to ldap_int_install_tls to reflect this fact, and
the documentation updated accordingly.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8528
Howard Chu <hyc(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |INVALID
--- Comment #7 from Howard Chu <hyc(a)openldap.org> ---
(In reply to Quanah Gibson-Mount from comment #1)
> --On Friday, November 04, 2016 12:41 AM +0000 openldap-its(a)OpenLDAP.org
> wrote:
>
> Here's the full text, since the web form apparently ate it:
>
> When doing a full replace on all values for olcAccess, things work
> incorrectly if the values provided are not in numeric sorted order. This
> is problematic when using tools like ldapvi who do alphabetic sort. It is
> trivial to reproduce the problem using the following example LDIFs:
>
> cat > replace_ordered.ldif <<EOF
> dn: olcDatabase={1}mdb,cn=config
> changetype: modify
> replace: olcAccess
> olcAccess: {0}to dn.exact="cn=0" by * none
> olcAccess: {1}to dn.exact="cn=1" by * none
> olcAccess: {2}to dn.exact="cn=2" by * none
> olcAccess: {3}to dn.exact="cn=3" by * none
> olcAccess: {4}to dn.exact="cn=4" by * none
> olcAccess: {5}to dn.exact="cn=5" by * none
> olcAccess: {6}to dn.exact="cn=6" by * none
> olcAccess: {7}to dn.exact="cn=7" by * none
> -
> EOF
>
> cat > replace_ordered_mixup.ldif <<EOF
> dn: olcDatabase={1}mdb,cn=config
> changetype: modify
> replace: olcAccess
> olcAccess: {7}to dn.exact="cn=7" by * none
> olcAccess: {1}to dn.exact="cn=1" by * none
> olcAccess: {4}to dn.exact="cn=4" by * none
> olcAccess: {3}to dn.exact="cn=3" by * none
> olcAccess: {5}to dn.exact="cn=5" by * none
> olcAccess: {0}to dn.exact="cn=0" by * none
> olcAccess: {6}to dn.exact="cn=6" by * none
> olcAccess: {2}to dn.exact="cn=2" by * none
> -
> EOF
>
> With the initial config as:
>
> olcAccess: {0}to attrs=userPassword by self write by anonymous auth by *
> none
> olcAccess: {1}to attrs=shadowLastChange by self write by * read
> olcAccess: {2}to * by * read
>
> When the ordered version is done, the correct result occurs:
>
> olcAccess: {0}to dn.exact="cn=0" by * none
> olcAccess: {1}to dn.exact="cn=1" by * none
> olcAccess: {2}to dn.exact="cn=2" by * none
> olcAccess: {3}to dn.exact="cn=3" by * none
> olcAccess: {4}to dn.exact="cn=4" by * none
> olcAccess: {5}to dn.exact="cn=5" by * none
> olcAccess: {6}to dn.exact="cn=6" by * none
> olcAccess: {7}to dn.exact="cn=7" by * none
>
> However, when the unordered replaced is done, an incorrect result occurs:
>
> olcAccess: {0}to dn.exact="cn=0" by * none
> olcAccess: {1}to dn.exact="cn=7" by * none
> olcAccess: {2}to dn.exact="cn=2" by * none
> olcAccess: {3}to dn.exact="cn=1" by * none
> olcAccess: {4}to dn.exact="cn=4" by * none
> olcAccess: {5}to dn.exact="cn=3" by * none
> olcAccess: {6}to dn.exact="cn=5" by * none
> olcAccess: {7}to dn.exact="cn=6" by * none
>
> Since we are doing a replace of all values, it should not be trying to
> reweight the operation. Instead, the values should just be numeric sorted
> and then written out accordingly, so one ends up with the same result as in
> the ordered case.
This ITS is invalid. The frontend is not trying to reweight the operation,
but you're giving it invalid input.
It processes each value in the order it was given. You put {7} first but at
that point in time, there aren't 7 values in the attribute, so it goes "at the
end".
The 2nd input is {1}, which gets put into the 2nd slot, so you have {7}, {1}.
The 3rd input is {4} but there are only 2 values, so it goes at the end in the
3rd slot.
The 4th input is {3} so it gets inserted into the 3rd slot and pushes the
previous value in the 3rd slot into the 4th slot.
The 5th input is {5} so it goes at the end.
The 6th input is {0} so it gets inserted into the 1st slot and pushes
everything else out by 1.
The 7th input is {6} so it goes at the end.
The 8th input is {2} so it gets inserted in the 3rd slot and pushes everything
else out by 1.
Closing this ITS.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9405
Issue ID: 9405
Summary: Link to Administrator's Guide is 404
Product: website
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: website
Assignee: bugs(a)openldap.org
Reporter: p.boven(a)xs4all.nl
Target Milestone: ---
On the 'software' page (https://www.openldap.org/software/), the link to the
"Administrator's Guide" page currently gives a 404 error.
The admin page link points to https://www.openldap.org/doc/admin/, but this
should apparently be https://www.openldap.org/doc/admin24/
--
You are receiving this mail because:
You are on the CC list for the issue.