From c7f51115cdb11bf0a0c0e2398a080dd38701e199 Mon Sep 17 00:00:00 2001
From: William Brown <firstyear@redhat.com>
Date: Wed, 9 Mar 2016 14:00:42 +1000
Subject: [PATCH 415/425] Ticket 48665 - Prevent sefault in
ldbm_instance_modify_config_entry
Bug Description: python ldap sends a mod_delete then a mod_add to the server.
This causes a segfault in ldbm_instance_modify_config_entry which expects the
value of the delete operation to exist.
Fix Description: If there is no attribute in the delete operation, this now
passes a NULL to ldbm_config_set, which then rejects the op as NO_SUCH_ATTRIBUTE
There is an attached test case, which also checks that mod_replace is still
functional.
https://fedorahosted.org/389/ticket/48665
Author: wibrown
Review by: nhosoi (Thanks!)
(cherry picked from commit 9134b006948d7d8eeb926655640b7f068fc6724d)
(cherry picked from commit fa54d0ce631d29343d04b8dcea8ef8d9c235feb3)
---
dirsrvtests/tests/tickets/ticket48665_test.py | 101 +++++++++++++++++++++
.../servers/slapd/back-ldbm/ldbm_instance_config.c | 16 +++-
2 files changed, 114 insertions(+), 3 deletions(-)
create mode 100644 dirsrvtests/tests/tickets/ticket48665_test.py
diff --git a/dirsrvtests/tests/tickets/ticket48665_test.py b/dirsrvtests/tests/tickets/ticket48665_test.py
new file mode 100644
index 0000000..702319c
--- /dev/null
+++ b/dirsrvtests/tests/tickets/ticket48665_test.py
@@ -0,0 +1,101 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+@pytest.fixture(scope="module")
+def topology(request):
+ # Creating standalone instance ...
+ standalone = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ standalone.delete()
+ standalone.create()
+ standalone.open()
+
+ # Delete each instance in the end
+ def fin():
+ # This is useful for analysing the test env.
+ #standalone.db2ldif(bename=DEFAULT_BENAME, suffixes=[DEFAULT_SUFFIX], excludeSuffixes=[], encrypt=False, \
+ # repl_data=True, outputfile='%s/ldif/%s.ldif' % (standalone.dbdir,SERVERID_STANDALONE ))
+ #standalone.clearBackupFS()
+ #standalone.backupFS()
+ standalone.delete()
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ standalone.clearTmpDir(__file__)
+
+ return TopologyStandalone(standalone)
+
+
+def test_ticket48665(topology):
+ """
+ This tests deletion of certain cn=config values.
+
+ First, it should be able to delete, and not crash the server.
+
+ Second, we might be able to delete then add to replace values.
+
+ We should also still be able to mod replace the values and keep the server alive.
+ """
+ #topology.standalone.config.enable_log('audit')
+ #topology.standalone.config.enable_log('auditfail')
+ # This will trigger a mod delete then add.
+ try:
+ modlist = [(ldap.MOD_DELETE, 'nsslapd-cachememsize', None), (ldap.MOD_ADD, 'nsslapd-cachememsize', '1')]
+ topology.standalone.modify_s("cn=%s,cn=ldbm database,cn=plugins,cn=config" % DEFAULT_BENAME,
+ modlist)
+ except:
+ pass
+ # Check the server has not commited seppuku.
+ result = topology.standalone.whoami_s()
+ assert(DN_DM.lower() in result.lower())
+
+ # This has a magic hack to determine if we are in cn=config.
+ topology.standalone.backend.setProperties(bename=DEFAULT_BENAME,
+ prop='nsslapd-cachememsize', values='1')
+ # Check the server has not commited seppuku.
+ result = topology.standalone.whoami_s()
+ assert(DN_DM.lower() in result.lower())
+
+ # Now try with mod_replace. This should be okay.
+
+ modlist = [(ldap.MOD_REPLACE, 'nsslapd-cachememsize', '1')]
+ topology.standalone.modify_s("cn=%s,cn=ldbm database,cn=plugins,cn=config" % DEFAULT_BENAME,
+ modlist)
+ # Check the server has not commited seppuku.
+ result = topology.standalone.whoami_s()
+ assert(DN_DM.lower() in result.lower())
+
+ log.info('Test complete')
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
index 2037618..c269ab3 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c
@@ -789,9 +789,19 @@ ldbm_instance_modify_config_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryB
}
/* This assumes there is only one bval for this mod. */
- rc = ldbm_config_set((void *) inst, attr_name,
- ldbm_instance_config, mods[i]->mod_bvalues[0], returntext,
- CONFIG_PHASE_RUNNING, apply_mod, mods[i]->mod_op);
+ if (mods[i]->mod_bvalues == NULL) {
+ /* This avoids the null pointer deref.
+ * In ldbm_config.c ldbm_config_set, it checks for the NULL.
+ * If it's a NULL, we get NO_SUCH_ATTRIBUTE error.
+ */
+ rc = ldbm_config_set((void *) inst, attr_name,
+ ldbm_instance_config, NULL, returntext,
+ CONFIG_PHASE_RUNNING, apply_mod, mods[i]->mod_op);
+ } else {
+ rc = ldbm_config_set((void *) inst, attr_name,
+ ldbm_instance_config, mods[i]->mod_bvalues[0], returntext,
+ CONFIG_PHASE_RUNNING, apply_mod, mods[i]->mod_op);
+ }
}
}
--
2.9.3