From df5000efced2d00aa0fc6546fcf6fc7b02e27256 Mon Sep 17 00:00:00 2001 From: Mark Reynolds Date: Mon, 6 Nov 2017 22:30:55 -0500 Subject: [PATCH] Ticket 49441 - Import crashes with large indexed binary attributes Bug Description: Importing an ldif file that contains entries with large binary attributes that are indexed crashes the server. The crash occurs when "encoding" the binary value to a string for debug logging, where we "underflow" the buffer space index which then allows the string buffer to overflow. Fix Description: While filling the string buffer with the encoded binary value we need to make sure if the buffer space is greater than zero before decrementing it. Also check if trace logging is being used before we actually call the logging function which calls the "encoded" function first. This way we avoid this costly "encoding" on every index call we make. https://pagure.io/389-ds-base/issue/49441 Reviewed by: firstyear(Thanks!) --- ldap/servers/slapd/back-ldbm/index.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c index d4de28ca3..d62052a22 100644 --- a/ldap/servers/slapd/back-ldbm/index.c +++ b/ldap/servers/slapd/back-ldbm/index.c @@ -808,7 +808,10 @@ encode (const struct berval* data, char buf[BUFSIZ]) bufSpace -= (s - first); } do { - *bufNext++ = '\\'; --bufSpace; + if (bufSpace) { + *bufNext++ = '\\'; + --bufSpace; + } if (bufSpace < 2) { memcpy (bufNext, "..", 2); bufNext += 2; @@ -903,8 +906,10 @@ index_read_ext_allids( slapi_log_err(SLAPI_LOG_ERR, "index_read_ext_allids", "NULL prefix\n"); return NULL; } - slapi_log_err(SLAPI_LOG_TRACE, "index_read_ext_allids", "=> ( \"%s\" %s \"%s\" )\n", - type, prefix, encode (val, buf)); + if (slapi_is_loglevel_set(LDAP_DEBUG_TRACE)) { + slapi_log_err(SLAPI_LOG_TRACE, "index_read_ext_allids", "=> ( \"%s\" %s \"%s\" )\n", + type, prefix, encode (val, buf)); + } basetype = typebuf; if ( (basetmp = slapi_attr_basetype( type, typebuf, sizeof(typebuf) )) @@ -1737,16 +1742,13 @@ addordel_values( */ key.flags = DB_DBT_USERMEM; key.ulen = tmpbuflen; -#ifdef LDAP_ERROR_LOGGING - /* XXX if ( slapd_ldap_debug & LDAP_DEBUG_TRACE ) XXX */ - { + if (slapi_is_loglevel_set(LDAP_DEBUG_TRACE)) { char encbuf[BUFSIZ]; slapi_log_err(SLAPI_LOG_TRACE, "addordel_values", "%s_value(\"%s\")\n", (flags & BE_INDEX_ADD) ? "add" : "del", encoded (&key, encbuf)); } -#endif if (NULL != txn) { db_txn = txn->back_txn_txn; @@ -1907,16 +1909,13 @@ addordel_values_sv( */ key.flags = DB_DBT_USERMEM; key.ulen = tmpbuflen; -#ifdef LDAP_ERROR_LOGGING - /* XXX if ( slapd_ldap_debug & LDAP_DEBUG_TRACE ) XXX */ - { + if (slapi_is_loglevel_set(LDAP_DEBUG_TRACE)) { char encbuf[BUFSIZ]; slapi_log_err(SLAPI_LOG_TRACE, "addordel_values_sv", "%s_value(\"%s\")\n", (flags & BE_INDEX_ADD) ? "add" : "del", encoded (&key, encbuf)); } -#endif if (NULL != txn) { db_txn = txn->back_txn_txn; -- 2.13.6