From 896091407c244ed151f2fad39a82881a6e991d26 Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: Tue, 29 Oct 2013 13:47:35 -0600
Subject: [PATCH] Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches
https://fedorahosted.org/389/ticket/47605
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.3.1
Fix Description: The traversal of the attr list looking for GER objectclasses
was modifying the same attribute twice, removing the "@" from it. The second
time, since there was no "@" in the string, the strchr would return NULL, and
the code would not check for it.
The code was simplified and rewritten to use charray_merge_nodup
to build the gerattrs list with unique objectclass values, which I believe was
the intention of the original code. I also added some error checking to look
for invalid attributes like "@name" "name@" and "name@name@name".
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 7e03702932546e74f0044d11832e7e7e395cbb36)
(cherry picked from commit 12e54af6982ab5406f4bba6a02dd0724a0415501)
(cherry picked from commit 8c5e74b291d08c66e0afbf766f77f955725b9bf4)
---
ldap/servers/slapd/search.c | 79 +++++++++----------------------------------
1 files changed, 16 insertions(+), 63 deletions(-)
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index da1772f..59c4afb 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -246,8 +246,6 @@ do_search( Slapi_PBlock *pb )
}
if ( attrs != NULL ) {
- int gerattrsiz = 1;
- int gerattridx = 0;
int aciin = 0;
/*
* . store gerattrs if any
@@ -257,66 +255,25 @@ do_search( Slapi_PBlock *pb )
{
char *p = NULL;
/* check if @<objectclass> is included */
- p = strchr(attrs[i], '@');
- if ( p && '\0' != *(p+1) ) /* don't store "*@", e.g. */
+ p = strchr(attrs[i], '@');
+ if ( p )
{
- int j = 0;
- if (gerattridx + 1 >= gerattrsiz)
+ char *dummyary[2]; /* need a char ** for charray_merge_nodup */
+ if ((*(p + 1) == '\0') || (p == attrs[i]) || (strchr(p+1, '@'))) /* e.g. "foo@" or "@objectclassname" or "foo@bar@baz" */
{
- char **tmpgerattrs;
- gerattrsiz *= 2;
- tmpgerattrs =
- (char **)slapi_ch_calloc(1, gerattrsiz*sizeof(char *));
- if (NULL != gerattrs)
- {
- memcpy(tmpgerattrs, gerattrs, gerattrsiz*sizeof(char *));
- slapi_ch_free((void **)&gerattrs);
- }
- gerattrs = tmpgerattrs;
- }
- for ( j = 0; gerattrs; j++ )
- {
- char *attri = NULL;
- if ( NULL == gerattrs[j] )
- {
- if (0 == j)
- {
- /* first time */
- gerattrs[gerattridx++] = attrs[i];
- /* get rid of "@<objectclass>" part from the attr
- list, which is needed only in gerattr list */
- *p = '\0';
- attri = slapi_ch_strdup(attrs[i]);
- attrs[i] = attri;
- *p = '@';
- }
- else
- {
- break; /* done */
- }
- }
- else if ( 0 == strcasecmp( attrs[i], gerattrs[j] ))
- {
- /* skip if attrs[i] is already in gerattrs */
- continue;
- }
- else
- {
- char *q = strchr(gerattrs[j], '@'); /* q never be 0 */
- if ( 0 != strcasecmp( p+1, q+1 ))
- {
- /* you don't want to display the same template
- entry multiple times */
- gerattrs[gerattridx++] = attrs[i];
- }
- /* get rid of "@<objectclass>" part from the attr
- list, which is needed only in gerattr list */
- *p = '\0';
- attri = slapi_ch_strdup(attrs[i]);
- attrs[i] = attri;
- *p = '@';
- }
+ slapi_log_error( SLAPI_LOG_ARGS, "do_search",
+ "invalid attribute [%s] in list - must be of the form "
+ "attributename@objectclassname where attributename is the "
+ "name of an attribute or \"*\" or \"+\" and objectclassname "
+ "is the name of an objectclass\n", attrs[i] );
+ continue;
}
+ dummyary[0] = p; /* p = @objectclassname */
+ dummyary[1] = NULL;
+ /* copy string to gerattrs with leading @ - disallow dups */
+ charray_merge_nodup(&gerattrs, dummyary, 1);
+ /* null terminate the attribute name at the @ after it has been copied */
+ *p = '\0';
}
else if ( !aciin && strcasecmp(attrs[i], LDAP_ALL_USER_ATTRS) == 0 )
{
@@ -324,10 +281,6 @@ do_search( Slapi_PBlock *pb )
aciin = 1;
}
}
- if (NULL != gerattrs)
- {
- gerattrs[gerattridx] = NULL;
- }
if (config_get_return_orig_type_switch()) {
/* return the original type, e.g., "sn (surname)" */
--
1.7.1