An application which uses Openldap libraries to contact Active Directory to get User information crashes. This appears to be generated internally within the LDAP libraries, since the behavior appears to be consistent with memory corruption. On occasion, the external authentication agent has been able to properly query and validate the credentials required for login, but most of the time, it caused the agent to crash with the above assertion. The valgrind output contains: ==9990== Invalid read of size 8 ==9990== at 0x87F1DB0: ldap_is_read_ready (os-ip.c:685) ==9990== by 0x87E0A22: ldap_result (result.c:373) ==9990== by 0x87E1F4B: ldap_search_s (search.c:364) ==9990== by 0x86AED07: _get_user_info (pam_ldap.c:2544) ==9990== by 0x86B05C2: _do_authentication (pam_ldap.c:2836) ==9990== by 0x86B0A4B: pam_sm_authenticate (pam_ldap.c:3271) ==9990== by 0x516B7A9: _pam_dispatch (pam_dispatch.c:83) ==9990== by 0x516D181: pam_authenticate (pam_auth.c:33) ==9990== by 0x40DC64: pami::start(char const*, char const*, char const*) (pami.cpp:163) ==9990== by 0x408153: lmtask::extacnt(msgx&, ustring&, ustring&) (lmtask.cpp:137) ==9990== by 0x4082F1: lmtask::reqAuthChk(msgxauth&) (lmtask.cpp:212) ==9990== by 0x408572: lmtask::body() (lmtask.cpp:101) ==9990== Address 0x20000000060f9d28 is not stack'd, malloc'd or (recently) free'd Turning off the referrals prevents the crash.
This request was evaluated by Red Hat Product Management for inclusion, but this component is not scheduled to be updated in the current Red Hat Enterprise Linux release. If you would like this request to be reviewed for the next minor release, ask your support representative to set the next rhel-x.y flag to "?".
The bug is deep in the OpenLDAP internals and is reproducible with latest sources. I could do a quick-and-dirty workaround, but proper fix must be coordinated with upstream. I opened a bug report there: http://www.openldap.org/its/index.cgi/Incoming?id=5853
Created attachment 327420 [details] patch candidate II Oops, stupid mistake, forgot to check for NULL... Never directly modify patches without testing :(. Attaching new one, which should fix the early crash. It replaces previous openldap-2.2.13-refer-crash.patch. I apologize for inconvenience.
I sent the patch upstream, see the link at comment #3.
Created attachment 332367 [details] upstreampatch for openldap-2.4.13 Upstream rejected my patch and fixed the bug differently, see below.