https://bugs.openldap.org/show_bug.cgi?id=10461
Issue ID: 10461 Summary: contrib/rbac: session filter construction uses fixed filterbuf[1024] with unbounded uid and role appends Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: contrib Assignee: bugs@openldap.org Reporter: pengpeng@iscas.ac.cn Target Milestone: ---
Hello OpenLDAP maintainers,
I would like to report what appears to be a real current-head overflow in the contrib/slapd-modules/rbac module.
I want to be careful about scope: this is a contrib/ module bug, not a core slapd claim.
The vulnerable code builds a filter in a fixed stack buffer:
char filterbuf[RBAC_BUFLEN]; ... strcat(filterbuf, "(&(objectClass=ftOperation)(|"); strcat(filterbuf, "(ftUsers="); strcat(filterbuf, sessp->uid.bv_val); strcat(filterbuf, ")"); for (i = 0; !BER_BVISEMPTY(&sessp->roles[i]); i++) { strcat(filterbuf, "(ftRoles="); strncat(filterbuf, sessp->roles[i].bv_val, sessp->roles[i].bv_len); strcat(filterbuf, ")"); }
RBAC_BUFLEN is 1024.
I checked the nearby input handling. The username validation routine constrains character classes, but I do not see a comparable length bound on uid, and the role list is parsed from BER as a variable-length caller-supplied set.
So I do not see a current invariant that guarantees the concatenated (ftUsers=...) plus all (ftRoles=...) fragments stay within 1024 bytes before the strcat/strncat sequence runs.
Why I think this should not be dismissed as a false positive:
- fixed stack buffer - repeated unbounded concatenation - uid validation appears to constrain characters, not total accumulated filter length - roles are variable-length and iterated until an empty terminator
I am keeping the claim narrow: this is a contrib/rbac session-filter construction bug, not a blanket statement about core OpenLDAP parsing.
A straightforward fix would be to compute the required filter length up front or replace the concatenation chain with bounded formatting that rejects oversized accumulated filters.
Best regards