Bug 1381505 - crash in ppolicy_modify
Summary: crash in ppolicy_modify
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openldap
Version: 6.8
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Matus Honek
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-04 10:31 UTC by German Parente
Modified: 2020-07-16 08:56 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-15 20:04:48 UTC
Target Upstream Version:


Attachments (Terms of Use)
full stacktrace (21.37 KB, text/plain)
2016-10-04 10:33 UTC, German Parente
no flags Details

Description German Parente 2016-10-04 10:31:49 UTC
Description of problem:

a customer is having this issue when updating to openldap latest version.

Version-Release number of selected component (if applicable): openldap-servers-2.4.40-12.el6.x86_64


How reproducible: not always

The stack trace is this one:

Backtrace of the crash:

(gdb) bt
#0  ppolicy_modify (op=0x7f8edd477440, rs=0x7f8edd4775b0) at ../../../../servers/slapd/overlays/ppolicy.c:1671
#1  0x00007f8ee73f936a in overlay_op_walk (op=0x7f8edd477440, rs=0x7f8edd4775b0, which=op_modify, oi=0x7f8ee922f110, on=0x7f8ee922f2f0) at ../../../servers/slapd/backover.c:661
#2  0x00007f8ee73f9eb4 in over_op_func (op=0x7f8edd477440, rs=<value optimized out>, which=<value optimized out>) at ../../../servers/slapd/backover.c:723
#3  0x00007f8ee0ee20eb in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb) list
1666	
1667			for ( sc = op->o_callback; sc; sc=sc->sc_next ) {
1668				if ( sc->sc_response == slap_null_cb &&
1669					sc->sc_private ) {
1670					req_pwdexop_s *qpw = sc->sc_private;
1671					newpw = qpw->rs_new;
1672					oldpw = qpw->rs_old;
1673					is_pwdexop = 1;
1674				   	break;
1675				}
(gdb) 

(gdb) print qpw
$2 = (req_pwdexop_s *) 0xf
(gdb) 

there's a check missing ( qpw == NULL ? ) when there's a password modify extended operation

I am attaching the full stacktrace in a moment.

Comment 1 German Parente 2016-10-04 10:33:14 UTC
Created attachment 1207128 [details]
full stacktrace

Comment 4 Matus Honek 2016-10-04 12:11:10 UTC
The fact that the bt starts at NULL kind of worries me. It may be that the stack is corrupted, which is pretty weird.

Is there some more info on what might have caused this crash, how to reproduce this?

Anyway, a part of an upstream commit [1] (and maybe also [2]) which fixes ITS#8435 [3] might be a fix for this. However, this is in the Master git branch only...

[1] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=23c5d6bbdd01d91556eab16b43fbc607d44feb7c
[2] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=1899118e91b4f5e4dbb4f6e9adb0f9de600df577
[3] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8435


Note You need to log in before you can comment on or make changes to this bug.