Bug 1381505

Summary: crash in ppolicy_modify
Product: Red Hat Enterprise Linux 6 Reporter: German Parente <gparente>
Component: openldapAssignee: Matus Honek <mhonek>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.8CC: cww, nkinder, pkis
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-15 20:04:48 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
full stacktrace none

Description German Parente 2016-10-04 10:31:49 UTC
Description of problem:

a customer is having this issue when updating to openldap latest version.

Version-Release number of selected component (if applicable): openldap-servers-2.4.40-12.el6.x86_64


How reproducible: not always

The stack trace is this one:

Backtrace of the crash:

(gdb) bt
#0  ppolicy_modify (op=0x7f8edd477440, rs=0x7f8edd4775b0) at ../../../../servers/slapd/overlays/ppolicy.c:1671
#1  0x00007f8ee73f936a in overlay_op_walk (op=0x7f8edd477440, rs=0x7f8edd4775b0, which=op_modify, oi=0x7f8ee922f110, on=0x7f8ee922f2f0) at ../../../servers/slapd/backover.c:661
#2  0x00007f8ee73f9eb4 in over_op_func (op=0x7f8edd477440, rs=<value optimized out>, which=<value optimized out>) at ../../../servers/slapd/backover.c:723
#3  0x00007f8ee0ee20eb in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb) list
1666	
1667			for ( sc = op->o_callback; sc; sc=sc->sc_next ) {
1668				if ( sc->sc_response == slap_null_cb &&
1669					sc->sc_private ) {
1670					req_pwdexop_s *qpw = sc->sc_private;
1671					newpw = qpw->rs_new;
1672					oldpw = qpw->rs_old;
1673					is_pwdexop = 1;
1674				   	break;
1675				}
(gdb) 

(gdb) print qpw
$2 = (req_pwdexop_s *) 0xf
(gdb) 

there's a check missing ( qpw == NULL ? ) when there's a password modify extended operation

I am attaching the full stacktrace in a moment.

Comment 1 German Parente 2016-10-04 10:33:14 UTC
Created attachment 1207128 [details]
full stacktrace

Comment 4 Matus Honek 2016-10-04 12:11:10 UTC
The fact that the bt starts at NULL kind of worries me. It may be that the stack is corrupted, which is pretty weird.

Is there some more info on what might have caused this crash, how to reproduce this?

Anyway, a part of an upstream commit [1] (and maybe also [2]) which fixes ITS#8435 [3] might be a fix for this. However, this is in the Master git branch only...

[1] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=23c5d6bbdd01d91556eab16b43fbc607d44feb7c
[2] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=1899118e91b4f5e4dbb4f6e9adb0f9de600df577
[3] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8435