https://bugs.openldap.org/show_bug.cgi?id=10457

Issue ID: 10457 Summary: slapd (2.6.8 / EL9 EPEL build) segfault in config_back_search() when bound as “data admin” and searching non-existent DN under cn=config Product: OpenLDAP Version: 2.6.8 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs@openldap.org Reporter: openldap@sdv.fr Target Milestone: ---

Created attachment 1118 --> https://bugs.openldap.org/attachment.cgi?id=1118&action=edit ACLs and slapd backtrace

slapd crashes (SIGSEGV) in the cn=config backend (config_back_search()) when a client performs a search with base DN cn=foobar,cn=config (non-existent entry), only when the client is bound as a "data" admin DN (e.g. cn=admin,dc=...) and the config database ACL denies access to everyone except local SASL/EXTERNAL (peercred root).

slapd should not crash on an invalid or unauthorized request; it should return a normal LDAP error (e.g. LDAP_NO_SUCH_OBJECT or LDAP_INSUFFICIENT_ACCESS) without terminating.

============================== Environment ==============================

OpenLDAP version / build : openldap-epel-2.6.8-2.el9.x86_64 (slapd /usr/sbin/slapd) Architecture : x86_64 Invocation : /usr/sbin/slapd -u ldap -h 'ldap:/// ldaps:/// ldapi:///'

============================== Steps to reproduce ==============================

1. Ensure the config database ACL matches the following (see file attached), i.e. only local SASL/EXTERNAL peercred root has manage, everyone else is none. 2. Perform a simple bind using the data admin DN (not a cn=config admin), then search with base DN cn=foobar,cn=config then slapd crashes (SIGSEGV).

Used command to reproduce : ldapsearch -LLL -x -y "/var/ldap_admin_pwd" -D "cn=admin,dc=example,dc=com" -b "cn=foobar,cn=config"

============================== Backtrace ==============================

slapd terminates with SIGSEGV in config_back_search() while handling the search. The crash happens at: "rs->sr_matched = last->ce_entry->e_name.bv_val;" in servers/slapd/bconfig.c:6877, apparently dereferencing an invalid last / last->ce_entry.

You'll find complete backtrace attached (see file attached).

============================== Additional notes ==============================

The crash is reproducible only when binding as the “data” admin DN and searching under cn=config with a non-existent DN. Anonymous search does not crash. This seems related to handling of sr_matched / matchedDN construction under access denial conditions in the config backend.

Please advise if this is a known issue in 2.6.8 or if a patch is available, I can provide additional backtraces/logs as needed.