(ITS#5960) [rwm] segfault with slapcat on cn=config

[tchemineau@linagora.com]

Full_Name: Thomas Chemineau
Version: RE24 and HEAD
OS: CentOS
URL: ftp://ftp.openldap.org/incoming/thomas-chemineau-090219.patch
Submission from: (NULL) (213.41.243.192)


Hi,

Here is the following configuration :

8<----
include         /opt/openldap-2.4.14/etc/openldap/schema/core.schema
pidfile         /opt/openldap-2.4.14/var/run/slapd.pid
argsfile        /opt/openlidap-2.4.14/var/run/slapd.args

database        ldap
suffix          "o=proxy"
uri             ldap://server.lan
idassert-bind   mode=none flags=prescriptive bindmethod=simple timeout=0
network-timeout=0 binddn="cn=administrateur,cn=users,dc=otherdemo,dc=lan"
credentials="secret"
overlay rwm
rwm-suffixmassage   "o=proxy" "dc=otherdemo,dc=lan"

database        bdb
suffix          "dc=my-domain,dc=com"
rootdn          "cn=Manager,dc=my-domain,dc=com"
rootpw          secret
directory       /opt/openldap-2.4.14/var/openldap-data
index   objectClass     eq
8<----

Initializing cn=config via slapd -f ... -F works fine. Now, if I want to do a
slapcat on cn=config with the following command, I had a segmentation fault.

8<----
ldif_read_file: read entry file:
"/usr/local/openldap-2.4/etc/openldap/slapd.d/cn=config/olcDatabase={1}ldap/olcOverlay={0}rwm.ldif"
=> str2entry: "dn: olcOverlay={0}rwm
objectClass: olcOverlayConfig
objectClass: olcRwmConfig
olcOverlay: {0}rwm
olcRwmRewrite: {0}rwm-suffixmassage "o=proxy" "dc=otherdemo,dc=lan"
olcRwmTFSupport: false
olcRwmNormalizeMapped: FALSE
structuralObjectClass: olcRwmConfig
entryUUID: 8d7c51c4-239f-48f5-9ad5-751a50942eec
creatorsName: cn=config
createTimestamp: 20090219101010Z
entryCSN: 20090219101010.781439Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20090219101010Z
"
>>> dnPrettyNormal: <olcOverlay={0}rwm>
<<< dnPrettyNormal: <olcOverlay={0}rwm>, <olcOverlay={0}rwm>
>>> dnPretty: <cn=config>
<<< dnPretty: <cn=config>
>>> dnNormalize: <cn=config>
<<< dnNormalize: <cn=config>
>>> dnPretty: <cn=config>
<<< dnPretty: <cn=config>
>>> dnNormalize: <cn=config>
<<< dnNormalize: <cn=config>
<= str2entry(olcOverlay={0}rwm) -> 0x124cbe48
=> test_filter
    PRESENT
=> access_allowed: search access to
"olcOverlay={0}rwm,olcDatabase={1}ldap,cn=config" "objectClass" requested
<= root access granted
=> access_allowed: search access granted by manage(=mwrscxd)
<= test_filter 6
Erreur de segmentation
8<----

I run GDB, and I had this:

8<---=> access_allowed: search access to
"olcOverlay={0}rwm,olcDatabase={1}ldap,cn=config" "objectClass" requested
<= root access granted
=> access_allowed: search access granted by manage(=mwrscxd)
<= test_filter 6

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 46972859751984 (LWP 9462)]
0x00000000004e08cf in rwm_cf_gen (c=0x7ffff26060b0) at rwm.c:2165
2165                            for ( last = 0; !BER_BVISNULL(
&rwmap->rwm_bva_rewrite[ last ] ); last++ )-
8<----

It seems that rwmap->rm_bva_rewrite is null. By the way, even if I correct this,
I have a similar issue in the rwm_db_destroy function, because rwmap->rwm_rw is
null too. So, freeing memory on a null pointer causes a segfault too. The above
patch corrects this problem. My apologies if I have missed something here.

By the way, I make a mistake during the upload file on ftp.openldap.org, you
will find 2 files (both the same): servers.slapd.overlays.rwm.c.patch and the
other one specified above.