For example, an aci like this: aci: (targetattr = "physicalDeliveryOfficeName || homePhone || preferredDeliveryMethod || jpegPhoto || nsAIMid || mozillaHomeCountryName || audio || internationaliSDNNumber || postalAddress || roomNumber || mozillaWorkStreet2 || givenName || mozillaSecondEmail || userPKCS12 || userPassword || teletexTerminalIdentifier || mobile || manager || objectClass || userSMIMECertificate || mozillaHomeStreet || destinationIndicator || telexNumber || employeeNumber || secretary || uid || userCertificate || st || mozillaCustom4 || mozillaCustom3 || mozillaCustom2 || mozillaCustom1 || description || mozillaHomePostalCode || mail || labeledUri || businessCategory || x500UniqueIdentifier || ou || seeAlso || photo || mozillaNickname || mozillaHomeLocalityName || shadowLastChange || title || street || departmentNumber || mozillaHomeStreet2 || mozillaUseHtmlMail || mozillaHomeState || o || cn || l || initials || telephoneNumber || mozillaHomeUrl || x121Address") (version 3.0; acl "Authenticated user self access"; allow (read,compare,search,write)(userdn = "ldap:///self");) where one or more of the attributes in the targetattr list are not defined, and the list contains more than 5 elements. Adding this aci will cause the server to either crash or hang.
Created attachment 519695 [details] 0001-Bug-733103-large-targetattr-list-with-syntax-errors-.patch
To ssh://git.fedorahosted.org/git/389/ds.git 7e43a28..91c6799 master -> master commit 91c6799b07ca48bce85482136ceb244b484fc91b Author: Rich Megginson <rmeggins> Date: Wed Aug 24 13:13:35 2011 -0600 Reviewed by: nhosoi (Thanks!) Branch: master Fix Description: If we need to realloc the list to hold more target attributes, the list is not NULL terminated. If there are syntax errors in the aci, the function returns with an unterminated list, and this will either cause the loop in the free code to go off the end of the list or crash with a segfault. The fix is to make sure the list is always NULL terminated. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no
[root@snmaptest fourwaymmr]# ldapmodify -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 << EOF > dn: dc=example,dc=com > changetype: modify > replace: aci > aci: (targetattr = "physicalDeliveryOfficeName || homePhone || preferredDeliveryMethod || jpegPhoto || nsAIMid || mozillaHomeCountryName || audio ||internationaliSDNNumber || postalAddress || roomNumber || mozillaWorkStreet2 || givenName || mozillaSecondEmail || userPKCS12 || userPassword || teletexTerminalIdentifier || mobile || manager || objectClass || userSMIMECertificate || mozillaHomeStreet || destinationIndicator || telexNumber || employeeNumber || secretary || uid || userCertificate || st || mozillaCustom4 || mozillaCustom3 || mozillaCustom2 || mozillaCustom1 || description || mozillaHomePostalCode || mail || labeledUri || businessCategory || x500UniqueIdentifier || ou || seeAlso || photo || mozillaNickname || mozillaHomeLocalityName || shadowLastChange || title || street || departmentNumber || mozillaHomeStreet2 || mozillaUseHtmlMail || mozillaHomeState || o || cn || l || initials || telephoneNumber || mozillaHomeUrl || x121Address") (version 3.0; acl "Authenticated user self access"; allow (read,compare,search,write)(userdn="ldap:///cn=Userami,dc=example,dc=com");) > EOF modifying entry "dc=example,dc=com" No Crash found, hence VERIFIED.