Bug 733103
Summary: | large targetattr list with syntax errors cause server to crash or hang | ||||||
---|---|---|---|---|---|---|---|
Product: | [Retired] 389 | Reporter: | Rich Megginson <rmeggins> | ||||
Component: | Security - Access Control (ACL) | Assignee: | Rich Megginson <rmeggins> | ||||
Status: | CLOSED CURRENTRELEASE | QA Contact: | Viktor Ashirov <vashirov> | ||||
Severity: | unspecified | Docs Contact: | |||||
Priority: | unspecified | ||||||
Version: | 1.2.9 | CC: | amsharma | ||||
Target Milestone: | --- | ||||||
Target Release: | --- | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Whiteboard: | |||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | |||||||
: | 733443 (view as bug list) | Environment: | |||||
Last Closed: | 2015-12-07 16:55:03 UTC | Type: | --- | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Bug Depends On: | |||||||
Bug Blocks: | 690318, 708096, 733443 | ||||||
Attachments: |
|
Description
Rich Megginson
2011-08-24 18:51:40 UTC
Created attachment 519695 [details]
0001-Bug-733103-large-targetattr-list-with-syntax-errors-.patch
To ssh://git.fedorahosted.org/git/389/ds.git 7e43a28..91c6799 master -> master commit 91c6799b07ca48bce85482136ceb244b484fc91b Author: Rich Megginson <rmeggins> Date: Wed Aug 24 13:13:35 2011 -0600 Reviewed by: nhosoi (Thanks!) Branch: master Fix Description: If we need to realloc the list to hold more target attributes, the list is not NULL terminated. If there are syntax errors in the aci, the function returns with an unterminated list, and this will either cause the loop in the free code to go off the end of the list or crash with a segfault. The fix is to make sure the list is always NULL terminated. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no [root@snmaptest fourwaymmr]# ldapmodify -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 << EOF
> dn: dc=example,dc=com
> changetype: modify
> replace: aci
> aci: (targetattr = "physicalDeliveryOfficeName || homePhone || preferredDeliveryMethod || jpegPhoto || nsAIMid || mozillaHomeCountryName || audio ||internationaliSDNNumber || postalAddress || roomNumber || mozillaWorkStreet2 || givenName || mozillaSecondEmail || userPKCS12 || userPassword || teletexTerminalIdentifier || mobile || manager || objectClass || userSMIMECertificate || mozillaHomeStreet || destinationIndicator || telexNumber || employeeNumber || secretary || uid || userCertificate || st || mozillaCustom4 || mozillaCustom3 || mozillaCustom2 || mozillaCustom1 || description || mozillaHomePostalCode || mail || labeledUri || businessCategory || x500UniqueIdentifier || ou || seeAlso || photo || mozillaNickname || mozillaHomeLocalityName || shadowLastChange || title || street || departmentNumber || mozillaHomeStreet2 || mozillaUseHtmlMail || mozillaHomeState || o || cn || l || initials || telephoneNumber || mozillaHomeUrl || x121Address") (version 3.0; acl "Authenticated user self access"; allow (read,compare,search,write)(userdn="ldap:///cn=Userami,dc=example,dc=com");)
> EOF
modifying entry "dc=example,dc=com"
No Crash found, hence VERIFIED.
|