|
 |
27c138 |
From 1386b140d8cc81d37fdea6593487fe542587ccac Mon Sep 17 00:00:00 2001
|
|
|
27c138 |
From: Mark Reynolds <mreynolds@redhat.com>
|
|
|
27c138 |
Date: Wed, 9 Dec 2020 09:52:08 -0500
|
|
|
27c138 |
Subject: [PATCH] Issue 4483 - heap-use-after-free in slapi_be_getsuffix
|
|
|
27c138 |
|
|
|
27c138 |
Description: heap-use-after-free in slapi_be_getsuffix after disk
|
|
|
27c138 |
monitoring runs. This feature is freeing a list of
|
|
|
27c138 |
backends which it does not need to do.
|
|
|
27c138 |
|
|
|
27c138 |
Fixes: https://github.com/389ds/389-ds-base/issues/4483
|
|
|
27c138 |
|
|
|
27c138 |
Reviewed by: firstyear & tbordaz(Thanks!!)
|
|
|
27c138 |
---
|
|
|
27c138 |
ldap/servers/slapd/daemon.c | 13 +------------
|
|
|
27c138 |
1 file changed, 1 insertion(+), 12 deletions(-)
|
|
|
27c138 |
|
|
|
27c138 |
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
|
|
|
27c138 |
index 49199e4df..691f77570 100644
|
|
|
27c138 |
--- a/ldap/servers/slapd/daemon.c
|
|
|
27c138 |
+++ b/ldap/servers/slapd/daemon.c
|
|
|
27c138 |
@@ -606,12 +606,6 @@ disk_monitoring_thread(void *nothing __attribute__((unused)))
|
|
|
27c138 |
now = start;
|
|
|
27c138 |
while ((now - start) < grace_period) {
|
|
|
27c138 |
if (g_get_shutdown()) {
|
|
|
27c138 |
- be_index = 0;
|
|
|
27c138 |
- if (be_list[be_index] != NULL) {
|
|
|
27c138 |
- while ((be = be_list[be_index++])) {
|
|
|
27c138 |
- slapi_be_free(&be);
|
|
|
27c138 |
- }
|
|
|
27c138 |
- }
|
|
|
27c138 |
slapi_ch_array_free(dirs);
|
|
|
27c138 |
dirs = NULL;
|
|
|
27c138 |
return;
|
|
|
27c138 |
@@ -706,12 +700,7 @@ disk_monitoring_thread(void *nothing __attribute__((unused)))
|
|
|
27c138 |
}
|
|
|
27c138 |
}
|
|
|
27c138 |
}
|
|
|
27c138 |
- be_index = 0;
|
|
|
27c138 |
- if (be_list[be_index] != NULL) {
|
|
|
27c138 |
- while ((be = be_list[be_index++])) {
|
|
|
27c138 |
- slapi_be_free(&be);
|
|
|
27c138 |
- }
|
|
|
27c138 |
- }
|
|
|
27c138 |
+
|
|
|
27c138 |
slapi_ch_array_free(dirs);
|
|
|
27c138 |
dirs = NULL; /* now it is not needed but the code may be changed in the future and it'd better be more robust */
|
|
|
27c138 |
g_set_shutdown(SLAPI_SHUTDOWN_DISKFULL);
|
|
|
27c138 |
--
|
|
|
27c138 |
2.26.2
|
|
|
27c138 |
|