Red Hat Bugzilla – Bug 822700
Bad DNs in ACIs can segfault ns-slapd
Last modified: 2012-06-20 03:15:44 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/389/ticket/361 Version 1.2.10 segfaults on start up if an ACI has an bad DN. The segmentation fault occurs during the parsing of the ACI in function __aclp__copy_normalized_str. I tracked the defect to this commit: http://git.fedorahosted.org/git/?p=389/ds.git;a=commitdiff;h=f6397113666f06848412bb12f754f04258cfa5fa A bad DN can will make the DN normalization fail which is not tested any more. I am attaching a trivial patch that tests for this case and returns -1 when the normalization failed, thus restoring the previous behaviour of the function.
RHEL63 r6532 | rmeggins@REDHAT.COM | 2012-05-17 19:44:42 -0600 (Thu, 17 May 2012) | 3 lines added test for https://bugzilla.redhat.com/show_bug.cgi?id=822700 https://fedorahosted.org/389/ticket/361 acl/syntax.sh trunk r6533 | rmeggins@REDHAT.COM | 2012-05-17 20:15:53 -0600 (Thu, 17 May 2012) | 3 lines added test for https://bugzilla.redhat.com/show_bug.cgi?id=822700 https://fedorahosted.org/389/ticket/361
To ssh://rmeggins@pkgs.devel.redhat.com/rpms/389-ds-base dfa26bf..0125409 rhel-6.3 -> rhel-6.3
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: A bad DN in a userdn/groupdn/other dn in an aci would cause the server to crash during startup or after an online import Consequence: Server could not be started until the offending aci was fixed an re-imported offline Fix: The code rejects bad DNs Result: Bad DNs are rejected by the aci handling code and the server does not crash
Executed test "ticket361" in acl/syntax.sh AND quickinstall startup 100% (2/2) Acl startup(o=ace industry,c=us) 100% (1/1) Acl run(o=ace industry,c=us) 100% (1/1) Acl cleanup 100% (1/1) So marking the test as PASSED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2012-0813.html