openldap-bugs

openldap-bugs@openldap.org

1 participants
21509 discussions

[Issue 10337] New: Global TLS options not inherited in context
by openldap-its＠openldap.org 24 Feb '26

24 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=10337 Issue ID: 10337 Summary: Global TLS options not inherited in context Product: OpenLDAP Version: 2.6.9 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: remi(a)fedoraproject.org Target Milestone: --- During ldap_create, global options are copied See https://github.com/openldap/openldap/blob/OPENLDAP_REL_ENG_2_6_9/libraries/… /* copy the global options */ AC_MEMCPY(&ld->ld_options, gopts, sizeof(ld->ld_options)); But not the TLS string options See https://github.com/openldap/openldap/blob/OPENLDAP_REL_ENG_2_6_9/libraries/… /* We explicitly inherit the SSL_CTX, don't need the names/paths. Leave * them empty to allow new SSL_CTX's to be created from scratch. */ memset( &ld->ld_options.ldo_tls_info, 0, sizeof( ld->ld_options.ldo_tls_info )); ld->ld_options.ldo_tls_ctx = NULL; Which create inconsistency when trying to generate a newctx For the context See * https://github.com/php/php-src/issues/17776 => why tls_newctx is needed * https://github.com/php/php-src/issues/18529 => regression On PHP side a possible workaround is to do the copyu manually * https://github.com/php/php-src/pull/18547 But should probably be handled at openldap library -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 10404] New: slapd uses all available memory and starts using swap
by openldap-its＠openldap.org 23 Feb '26

23 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=10404 Issue ID: 10404 Summary: slapd uses all available memory and starts using swap Product: OpenLDAP Version: 2.6.10 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: tomas.bjorklund(a)su.se Target Milestone: --- We have a problem with slapd using more and more memory until in starts using swap. We are using mdb and our maxsize is set to 8192000000. The server has 32GB of ram. data.mdb is around 2.6 GB Some settings from our slapd.conf: sizelimit 5000 timelimit 600 checkpoint 1024 15 loglevel sync stats This is how it looks with top: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 314486 root 20 0 31.6g 26.2g 2.6g S 16.3 83.7 8,09 slapd Depending on the load of the server it usually takes 2 weeks until all memory has been used. Things that we have tried: Changed swapiness to 1 Changed slapd service to use this: [Service] Environment="LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libtcmalloc_minimal.so.4" LimitCORE=infinity LimitNOFILE=4096 Restart=on-failure TimeoutStopSec=900 Everything worked fine with bdb and cache settings like: cachesize 100000 idlcachesize 100000 But since switching to mdb we run out of memory. -- You are receiving this mail because: You are on the CC list for the issue.

1 26

[Issue 10453] Security Vulnerability Report: Multiple CWE-22, CWE-416 and CWE-476 Issues Identified
by openldap-its＠openldap.org 17 Feb '26

17 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=10453 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|needs_review | -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10453] Security Vulnerability Report: Multiple CWE-22, CWE-416 and CWE-476 Issues Identified
by openldap-its＠openldap.org 13 Feb '26

13 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=10453 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED Group|OpenLDAP-devs | -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10191] New: backend searches should respond to pause requests
by openldap-its＠openldap.org 12 Feb '26

12 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=10191 Issue ID: 10191 Summary: backend searches should respond to pause requests Product: OpenLDAP Version: 2.6.7 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: backends Assignee: bugs(a)openldap.org Reporter: hyc(a)openldap.org Target Milestone: --- A long running search will cause mods to cn=config to wait a long time. Search ops should periodically check for threadpool pause requests. -- You are receiving this mail because: You are on the CC list for the issue.

1 10

[Issue 9513] New: Enhanced debug output
by openldap-its＠openldap.org 12 Feb '26

12 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=9513 Issue ID: 9513 Summary: Enhanced debug output Product: OpenLDAP Version: 2.5 Hardware: All OS: All Status: UNCONFIRMED Severity: enhancement Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: hyc(a)openldap.org Target Milestone: --- While debugging ITS#9479 I needed more information on which threads were doing what actions. Also, when looking for delays/hangs/race conditions, the 1-second granularity of the debug msg timestamp was inadequate. And also, some of the debug output for the Search operation was being done in separate Debug calls for a single line of output. This gets jumbled up pretty badly if other threads are printing output as well. New patch set will extend the debug timestamp to have fractional seconds too; it will use clock_gettime for nanosecond resolution if available, otherwise use gettimeofday for microsecond resolution. Also tweak the Search debug output to only use one Debug invocation per line of output. This is MR!279. -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 9022] Force slapadd to rewrite all entryCSN values
by openldap-its＠openldap.org 12 Feb '26

12 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=9022 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|2.7.1 |2.7.0 Status|UNCONFIRMED |RESOLVED Resolution|--- |TEST --- Comment #3 from Quanah Gibson-Mount <quanah(a)openldap.org> --- • 1780b212 by Ondřej Kuzník at 2026-02-09T18:41:47+00:00 ITS#9022 Introduce -o remove-sids= to slapadd -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10439] New: The value of the mc_xcursor pointer in the context of calling the mdb_xcursor_init1() function
by openldap-its＠openldap.org 10 Feb '26

10 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=10439 Issue ID: 10439 Summary: The value of the mc_xcursor pointer in the context of calling the mdb_xcursor_init1() function Product: OpenLDAP Version: 2.6.12 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: mishtitov(a)gmail.com Target Milestone: --- Problem occurs in functions `mdb_cursor_first()`, `mdb_cursor_last()` and `mdb_cursor_set()`. After having been compared to a NULL value, pointer 'mc->mc_xcursor' is passed in call to function 'mdb_xcursor_init1()` where it is dereferenced. This might happen when the node flag `F_DUPDATA` is set, but the database does not have the `MDB_DUPSORT` flag, leading to `mc->mc_xcursor` being uninitialized. I think that this is very unlikely to happen, but I haven't found a clear connection between the `F_DUPDATA` and `MDB_DUPSORT` flags. Please consider wheter if it's worth adding a NULL check there. -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 10452] New: Potential NULL dereference in slap_acl_mask()
by openldap-its＠openldap.org 10 Feb '26

10 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=10452 Issue ID: 10452 Summary: Potential NULL dereference in slap_acl_mask() Product: OpenLDAP Version: 2.6.8 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: nastentsiya.filimonova(a)gmail.com Target Milestone: --- I've noticed potentially inconsistent NULL checks for the op->o_conn field in function slap_acl_mask (source file openldap-2.6.8/servers/slapd/acl.c). At first, op->o_conn is explicitly checked for NULL: if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) ) { ndn = op->o_conn->c_ndn; } else { ndn = op->o_ndn; } This suggests that op->o_conn may indeed be NULL in some scenarios. However, right after that in the same function there are several unconditional dereferences of op->o_conn without a preceding NULL check, for example: if ( !op->o_conn->c_listener ) { continue; } if ( !op->o_conn->c_peer_domain.bv_val ) { continue; } if ( !op->o_conn->c_peer_name.bv_val ) { continue; } Could you please clarify whether op->o_conn is guaranteed to be non-NULL for all possible paths reaching these code sections? If op->o_conn can indeed be NULL here, these dereferences may lead to a NULL pointer dereference and would require additional checks. If op->o_conn is guaranteed to be non-NULL by design, please confirm this (it would also be useful to document this assumption explicitly). Thank you. -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 6104] race condition with cancel operation
by openldap-its＠openldap.org 06 Feb '26

06 Feb '26

https://bugs.openldap.org/show_bug.cgi?id=6104 Howard Chu <hyc(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kangyang126(a)gmail.com --- Comment #16 from Howard Chu <hyc(a)openldap.org> --- *** Issue 10444 has been marked as a duplicate of this issue. *** -- You are receiving this mail because: You are on the CC list for the issue.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs