Bug 474788

Summary: LDAP causes crashes when attempting to authenticate with Active Directory
Product: Red Hat Enterprise Linux 4 Reporter: Tomas Smetana <tsmetana>
Component: openldapAssignee: Jan Vcelak <jvcelak>
Status: CLOSED CURRENTRELEASE QA Contact: Ondrej Moriš <omoris>
Severity: high Docs Contact:
Priority: urgent    
Version: 4.6CC: jplans, jwest, omoris, rvokal, sghosh, tao, tsmetana
Target Milestone: rcKeywords: OtherQA, ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 510522 (view as bug list) Environment:
Last Closed: 2012-06-14 20:43:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 510522    
Bug Blocks: 509507    
Attachments:
Description Flags
patch candidate II
none
upstreampatch for openldap-2.4.13 none

Description Tomas Smetana 2008-12-05 12:05:51 UTC 
An application which uses Openldap libraries to contact Active Directory to get User information crashes.

This appears to be generated internally within the LDAP libraries, since the behavior appears to be consistent with memory corruption.  On occasion, the  external authentication agent has been able to properly query and validate the credentials required for login, but most of the time, it caused the
agent to crash with the above assertion.

The valgrind output contains:

==9990== Invalid read of size 8
==9990==    at 0x87F1DB0: ldap_is_read_ready (os-ip.c:685)
==9990==    by 0x87E0A22: ldap_result (result.c:373)
==9990==    by 0x87E1F4B: ldap_search_s (search.c:364)
==9990==    by 0x86AED07: _get_user_info (pam_ldap.c:2544)
==9990==    by 0x86B05C2: _do_authentication (pam_ldap.c:2836)
==9990==    by 0x86B0A4B: pam_sm_authenticate (pam_ldap.c:3271)
==9990==    by 0x516B7A9: _pam_dispatch (pam_dispatch.c:83)
==9990==    by 0x516D181: pam_authenticate (pam_auth.c:33)
==9990==    by 0x40DC64: pami::start(char const*, char const*, char const*) (pami.cpp:163)
==9990==    by 0x408153: lmtask::extacnt(msgx&, ustring&, ustring&) (lmtask.cpp:137)
==9990==    by 0x4082F1: lmtask::reqAuthChk(msgxauth&) (lmtask.cpp:212)
==9990==    by 0x408572: lmtask::body() (lmtask.cpp:101)
==9990==  Address 0x20000000060f9d28 is not stack'd, malloc'd or (recently) free'd

Turning off the referrals prevents the crash.
Comment 1 RHEL Program Management 2008-12-05 12:17:26 UTC 
This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release. If you would like
this request to be reviewed for the next minor release, ask your
support representative to set the next rhel-x.y flag to "?".
Comment 3 Jan Safranek 2008-12-09 15:39:06 UTC 
The bug is deep in the OpenLDAP internals and is reproducible with latest sources.  I could do a quick-and-dirty workaround, but proper fix must be coordinated with upstream. I opened a bug report there: http://www.openldap.org/its/index.cgi/Incoming?id=5853
Comment 7 Jan Safranek 2008-12-19 08:40:26 UTC 
Created attachment 327420 [details]
patch candidate II

Oops, stupid mistake, forgot to check for NULL... Never directly modify patches without testing :(.

Attaching new one, which should fix the early crash. It replaces previous openldap-2.2.13-refer-crash.patch. I apologize for inconvenience.
Comment 9 Jan Safranek 2009-01-15 14:50:54 UTC 
I sent the patch upstream, see the link at comment #3.
Comment 10 Jan Safranek 2009-02-18 12:16:35 UTC 
Created attachment 332367 [details]
upstreampatch for openldap-2.4.13

Upstream rejected my patch and fixed the bug differently, see below.