Bug 784989

Description of problem:

I found a path using python-ldap that can cause a segementation fault. This particular path is rather artificial in nature it should probably still be addressed.

I tested this against an SSL-secured 389-ds server. You'll need a copy of the CA in PEM form.

What you do is make a connection to the non-fqdn of the SSL host. This request will fail but we ignore that and try to bind again anyway and this causes a segfault.

This program:

import ldap
from ldap import sasl
from ldap.ldapobject import SimpleLDAPObject

SASL_AUTH = ldap.sasl.sasl({},'GSSAPI')

def make_conn(url):
    conn = SimpleLDAPObject(url)
    ldap.set_option(ldap.OPT_DEBUG_LEVEL, 255)
    ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, '/path/to/ca.crt')
    try:
        conn.sasl_interactive_bind_s('', SASL_AUTH)
    except ldap.SERVER_DOWN:
        conn.sasl_interactive_bind_s('', SASL_AUTH)

    conn.unbind_s()

make_conn('ldaps://somewhere:636')

Generates this output:

ldap_sasl_interactive_bind: user selected: GSSAPI
ldap_int_sasl_bind: GSSAPI
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP doberman:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.186.9:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
TLS: loaded CA certificate file /etc/ipa/ca.crt.
TLS: certificate [CN=doberman.example.com,O=EXAMPLE.COM] is valid
TLS certificate verification: subject: CN=doberman.example.com,O=EXAMPLE.COM, issuer: CN=GREYOAK.COM Certificate Authority, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 0, cache not reusable: 0
TLS: hostname (doberman) does not match common name in certificate (doberman.example.com).
ldap_msgfree
ldap_err2string
ldap_sasl_interactive_bind: user selected: GSSAPI
ldap_int_sasl_bind: GSSAPI
Segmentation fault (core dumped)

And this trace:

#0  0x00007f152b260f3b in ldap_int_sasl_bind (ld=0x17a48b0, dn=
    0x7f1531ad2644 "", mechs=0x16c8b34 "GSSAPI", sctrls=0x0, cctrls=0x0, 
    flags=2, interact=0x7f152b49e7a0, defaults=0x16d7488, result=0x0, rmech=
    0x7fff81faf0f8, msgid=0x7fff81faf10c) at cyrus.c:440
#1  0x00007f152b264657 in ldap_sasl_interactive_bind (ld=0x17a48b0, dn=
    0x7f1531ad2644 "", mechs=0x16c8b34 "GSSAPI", serverControls=0x0, 
    clientControls=0x0, flags=2, interact=0x7f152b49e7a0, defaults=0x16d7488, 
    result=0x0, rmech=0x7fff81faf0f8, msgid=0x7fff81faf10c) at sasl.c:474
#2  0x00007f152b264838 in ldap_sasl_interactive_bind_s (ld=0x17a48b0, dn=
    0x7f1531ad2644 "", mechs=0x16c8b34 "GSSAPI", serverControls=0x0, 
    clientControls=0x0, flags=2, interact=0x7f152b49e7a0, defaults=0x16d7488)
    at sasl.c:511
#3  0x00007f152b49e13d in ?? ()
#4  0x00007f152b49e7a0 in ?? ()
#5  0x00000000016d7488 in ?? ()
#6  0x00000000018b3fd0 in ?? ()
#7  0x0000003866b0f8b9 in _PyObject_GC_Malloc (basicsize=<optimized out>)
    at /usr/src/debug/Python-2.7.1/Modules/gcmodule.c:1445
#8  _PyObject_GC_Malloc (basicsize=<optimized out>)
    at /usr/src/debug/Python-2.7.1/Modules/gcmodule.c:1439
#9  0x0000003866d87900 in _Py_NotImplementedStruct ()
   from /usr/lib64/libpython2.7.so.1.0
#10 0x0000003866d87900 in _Py_NotImplementedStruct ()
   from /usr/lib64/libpython2.7.so.1.0
#11 0x0000000000000000 in ?? ()

Version-Release number of selected component (if applicable):

openldap-2.4.24-5.fc15.x86_64