Blame SOURCES/0074-Ticket-48894-harden-valueset_array_to_sorted_quick-v.patch

6f51e1
From 91c80c06affa3f4bfe106d2291efc360ab2b421d Mon Sep 17 00:00:00 2001
40cd75
From: Mark Reynolds <mreynolds@redhat.com>
40cd75
Date: Thu, 26 Oct 2017 10:03:39 -0400
40cd75
Subject: [PATCH] Ticket 48894 - harden valueset_array_to_sorted_quick valueset
40cd75
  access
40cd75
40cd75
Description:  It's possible during the sorting of a valueset to access an
40cd75
              array element past the allocated size, and also go below the index 0.
40cd75
40cd75
https://pagure.io/389-ds-base/issue/48894
40cd75
40cd75
Reviewed by: nweiderm (Thanks!)
40cd75
40cd75
(cherry picked from commit 2086d052e338ddcbcf6bd3222617991641573a12)
40cd75
---
40cd75
 ldap/servers/slapd/valueset.c | 4 ++--
40cd75
 1 file changed, 2 insertions(+), 2 deletions(-)
40cd75
40cd75
diff --git a/ldap/servers/slapd/valueset.c b/ldap/servers/slapd/valueset.c
6f51e1
index 8a824ac4a..e22bc9c39 100644
40cd75
--- a/ldap/servers/slapd/valueset.c
40cd75
+++ b/ldap/servers/slapd/valueset.c
6f51e1
@@ -1054,11 +1054,11 @@ valueset_array_to_sorted_quick (const Slapi_Attr *a, Slapi_ValueSet *vs, size_t
40cd75
     while (1) {
40cd75
         do {
40cd75
             i++;
6f51e1
-        } while ( valueset_value_cmp(a, vs->va[vs->sorted[i]], vs->va[pivot]) < 0);
40cd75
+        } while (i < vs->max && valueset_value_cmp(a, vs->va[vs->sorted[i]], vs->va[pivot]) < 0);
40cd75
 
40cd75
         do {
40cd75
             j--;
6f51e1
-        } while ( valueset_value_cmp(a, vs->va[vs->sorted[j]], vs->va[pivot]) > 0);
40cd75
+        } while (valueset_value_cmp(a, vs->va[vs->sorted[j]], vs->va[pivot]) > 0 && j > 0);
40cd75
 
40cd75
         if (i >= j) {
40cd75
             break;
40cd75
-- 
40cd75
2.13.6
40cd75