Bug 822700 - Bad DNs in ACIs can segfault ns-slapd
Summary: Bad DNs in ACIs can segfault ns-slapd
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: 389-ds-base
Version: 6.3
Hardware: Unspecified
OS: Unspecified
urgent
unspecified
Target Milestone: rc
: ---
Assignee: Rich Megginson
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-05-17 20:08 UTC by Rich Megginson
Modified: 2012-06-20 07:15 UTC (History)
3 users (show)

Fixed In Version: 389-ds-base-1.2.10.2-13.el6
Doc Type: Bug Fix
Doc Text:
Cause: A bad DN in a userdn/groupdn/other dn in an aci would cause the server to crash during startup or after an online import Consequence: Server could not be started until the offending aci was fixed an re-imported offline Fix: The code rejects bad DNs Result: Bad DNs are rejected by the aci handling code and the server does not crash
Clone Of:
Environment:
Last Closed: 2012-06-20 07:15:44 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0813 normal SHIPPED_LIVE Low: 389-ds-base security, bug fix, and enhancement update 2012-06-19 19:29:15 UTC

Description Rich Megginson 2012-05-17 20:08:44 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/361

Version 1.2.10 segfaults on start up if an ACI has an bad DN. The segmentation fault occurs during the parsing of the ACI in function __aclp__copy_normalized_str. I tracked the defect to this commit:

http://git.fedorahosted.org/git/?p=389/ds.git;a=commitdiff;h=f6397113666f06848412bb12f754f04258cfa5fa

A bad DN can will make the DN normalization fail which is not tested any more. I am attaching a trivial patch that tests for this case and returns -1 when the normalization failed, thus restoring the previous behaviour of the function.

Comment 2 Rich Megginson 2012-05-18 02:16:38 UTC
RHEL63
r6532 | rmeggins@REDHAT.COM | 2012-05-17 19:44:42 -0600 (Thu, 17 May 2012) | 3 lines

added test for https://bugzilla.redhat.com/show_bug.cgi?id=822700
https://fedorahosted.org/389/ticket/361

acl/syntax.sh

trunk
r6533 | rmeggins@REDHAT.COM | 2012-05-17 20:15:53 -0600 (Thu, 17 May 2012) | 3 lines

added test for https://bugzilla.redhat.com/show_bug.cgi?id=822700
https://fedorahosted.org/389/ticket/361

Comment 3 Rich Megginson 2012-05-18 02:39:41 UTC
To ssh://rmeggins@pkgs.devel.redhat.com/rpms/389-ds-base
   dfa26bf..0125409  rhel-6.3 -> rhel-6.3

Comment 5 Rich Megginson 2012-05-18 02:54:31 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:  A bad DN in a userdn/groupdn/other dn in an aci would cause the server to crash during startup or after an online import
Consequence: Server could not be started until the offending aci was fixed an re-imported offline
Fix: The code rejects bad DNs
Result: Bad DNs are rejected by the aci handling code and the server does not crash

Comment 6 Amita Sharma 2012-05-21 11:57:23 UTC
Executed test "ticket361" in acl/syntax.sh
AND

quickinstall startup 	100% (2/2) 	  	 
Acl startup(o=ace industry,c=us) 	100% (1/1) 	  	 
Acl run(o=ace industry,c=us) 	100% (1/1) 	  	 
Acl cleanup 	100% (1/1) 	 

So marking the test as PASSED.

Comment 7 errata-xmlrpc 2012-06-20 07:15:44 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0813.html


Note You need to log in before you can comment on or make changes to this bug.