Re: (ITS#5960) [rwm] segfault with slapcat on cn=config

[hyc@symas.com]

tchemineau@linagora.com wrote:
> Full_Name: Thomas Chemineau
> Version: RE24 and HEAD
> OS: CentOS
> URL: ftp://ftp.openldap.org/incoming/thomas-chemineau-090219.patch
> Submission from: (NULL) (213.41.243.192)
>
>
> Hi,
>
> Here is the following configuration :
>
> 8<----
> include         /opt/openldap-2.4.14/etc/openldap/schema/core.schema
> pidfile         /opt/openldap-2.4.14/var/run/slapd.pid
> argsfile        /opt/openlidap-2.4.14/var/run/slapd.args
>
> database        ldap
> suffix          "o=proxy"
> uri             ldap://server.lan
> idassert-bind   mode=none flags=prescriptive bindmethod=simple timeout=0
> network-timeout=0 binddn="cn=administrateur,cn=users,dc=otherdemo,dc=lan"
> credentials="secret"
> overlay rwm
> rwm-suffixmassage   "o=proxy" "dc=otherdemo,dc=lan"
>
> database        bdb
> suffix          "dc=my-domain,dc=com"
> rootdn          "cn=Manager,dc=my-domain,dc=com"
> rootpw          secret
> directory       /opt/openldap-2.4.14/var/openldap-data
> index   objectClass     eq
> 8<----
>
> Initializing cn=config via slapd -f ... -F works fine. Now, if I want to do a
> slapcat on cn=config with the following command, I had a segmentation fault.
>
> 8<----
> ldif_read_file: read entry file:
> "/usr/local/openldap-2.4/etc/openldap/slapd.d/cn=config/olcDatabase={1}ldap/olcOverlay={0}rwm.ldif"
> =>  str2entry: "dn: olcOverlay={0}rwm
> objectClass: olcOverlayConfig
> objectClass: olcRwmConfig
> olcOverlay: {0}rwm
> olcRwmRewrite: {0}rwm-suffixmassage "o=proxy" "dc=otherdemo,dc=lan"
> olcRwmTFSupport: false
> olcRwmNormalizeMapped: FALSE
> structuralObjectClass: olcRwmConfig
> entryUUID: 8d7c51c4-239f-48f5-9ad5-751a50942eec
> creatorsName: cn=config
> createTimestamp: 20090219101010Z
> entryCSN: 20090219101010.781439Z#000000#000#000000
> modifiersName: cn=config
> modifyTimestamp: 20090219101010Z
> "
>>>> dnPrettyNormal:<olcOverlay={0}rwm>
> <<<  dnPrettyNormal:<olcOverlay={0}rwm>,<olcOverlay={0}rwm>
>>>> dnPretty:<cn=config>
> <<<  dnPretty:<cn=config>
>>>> dnNormalize:<cn=config>
> <<<  dnNormalize:<cn=config>
>>>> dnPretty:<cn=config>
> <<<  dnPretty:<cn=config>
>>>> dnNormalize:<cn=config>
> <<<  dnNormalize:<cn=config>
> <= str2entry(olcOverlay={0}rwm) ->  0x124cbe48
> =>  test_filter
>      PRESENT
> =>  access_allowed: search access to
> "olcOverlay={0}rwm,olcDatabase={1}ldap,cn=config" "objectClass" requested
> <= root access granted
> =>  access_allowed: search access granted by manage(=mwrscxd)
> <= test_filter 6
> Erreur de segmentation
> 8<----
>
> I run GDB, and I had this:
>
> 8<---=>  access_allowed: search access to
> "olcOverlay={0}rwm,olcDatabase={1}ldap,cn=config" "objectClass" requested
> <= root access granted
> =>  access_allowed: search access granted by manage(=mwrscxd)
> <= test_filter 6
>
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 46972859751984 (LWP 9462)]
> 0x00000000004e08cf in rwm_cf_gen (c=0x7ffff26060b0) at rwm.c:2165
> 2165                            for ( last = 0; !BER_BVISNULL(
> &rwmap->rwm_bva_rewrite[ last ] ); last++ )-
> 8<----
>
> It seems that rwmap->rm_bva_rewrite is null. By the way, even if I correct this,
> I have a similar issue in the rwm_db_destroy function, because rwmap->rwm_rw is
> null too. So, freeing memory on a null pointer causes a segfault too. The above
> patch corrects this problem. My apologies if I have missed something here.
>
> By the way, I make a mistake during the upload file on ftp.openldap.org, you
> will find 2 files (both the same): servers.slapd.overlays.rwm.c.patch and the
> other one specified above.
>
Thanks for the report. The last chunk of the patch was solving the wrong 
problem, so a different fix is in HEAD.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/