Segmentation fault in in.xfingerd

[Nalin Dahyabhai <nalin@redhat.com>]

Hello, we've got a new report in our bug-tracking database: queries with
commas in them cause in.xfingerd in 1.2.9 and 1.2.10 to dump core.  (The
report is at "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=11111";.)

I've advised the reporter to add an entry in ITS, and have attached a patch
that appears to fix the problem, though I don't know enough to be certain
that the default base DN for regular queries should also be used for UFN
queries.  I'd appreciate any comments you all have.

Nalin

This patch sets a default base for UFN queries, and adds using them as a
command-line option to in.xfingerd.  It also changes one instance of strdup()
to ldap_strdup() to match the rest of the library.

diff -uNr openldap-1.2.10/clients/finger/main.c openldap-1.2.10/clients/finger/main.c
--- openldap-1.2.10/clients/finger/main.c	Wed Nov  3 15:14:19 1999
+++ openldap-1.2.10/clients/finger/main.c	Tue May  2 15:22:43 2000
@@ -51,7 +51,7 @@
 static void
 usage( char *name )
 {
-	fprintf( stderr, "usage: %s [-l] [-x ldaphost] [-p ldapport] [-f filterfile] [-t templatefile] [-c rdncount]\r\n", name );
+	fprintf( stderr, "usage: %s [-i] [-l] [-x ldaphost] [-p ldapport] [-f filterfile] [-t templatefile] [-c rdncount] [-b base]\r\n", name );
 	exit( 1 );
 }
 
@@ -66,7 +66,7 @@
 	int			interactive = 0;
 
 	deref = FINGER_DEREF;
-	while ( (i = getopt( argc, argv, "f:ilp:t:x:p:c:" )) != EOF ) {
+	while ( (i = getopt( argc, argv, "f:ilp:t:x:p:c:b:" )) != EOF ) {
 		switch( i ) {
 		case 'f':	/* ldap filter file */
 			filterfile = strdup( optarg );
@@ -96,6 +96,10 @@
 			rdncount = atoi( optarg );
 			break;
 
+		case 'b':	/* specify a default UFN base */
+			base = strdup( optarg );
+			break;
+
 		default:
 			usage( argv[0] );
 		}
@@ -199,17 +203,24 @@
 		exit( 1 );
 	}
 
+	memset ( buf, '\0', sizeof(buf) );
 	if ( fgets( buf, sizeof(buf), stdin ) == NULL )
 		exit( 1 );
 
 	len = strlen( buf );
 
 	/* strip off \r \n */
-	if ( buf[len - 1] == '\n' ) {
+	if ( ( len > 0 ) && ( buf[len - 1] == '\n' ) ) {
+		buf[len - 1] = '\0';
+		len--;
+	}
+	if ( ( len > 0 ) && ( buf[len - 1] == '\r' ) ) {
 		buf[len - 1] = '\0';
 		len--;
 	}
-	if ( buf[len - 1] == '\r' ) {
+
+	/* strip off trailing whitespace */
+	while ( ( len > 0 ) && isspace(buf[len - 1]) ) {
 		buf[len - 1] = '\0';
 		len--;
 	}
@@ -228,6 +239,7 @@
 			p = buf;
 		}
 
+		/* skip leading whitespace */
 		for ( ; *p && isspace( (unsigned char) *p ); p++ )
 			;	/* NULL */
 
diff -uNr openldap-1.2.10/doc/man/man8/in.xfingerd.8 openldap-1.2.10/doc/man/man8/in.xfingerd.8
--- openldap-1.2.10/doc/man/man8/in.xfingerd.8	Sat Oct 24 19:41:52 1998
+++ openldap-1.2.10/doc/man/man8/in.xfingerd.8	Tue May  2 15:24:51 2000
@@ -1,10 +1,11 @@
-.TH IN.XFINGERD 8C "22 September 1998" "OpenLDAP LDVERSION"
+.TH IN.XFINGERD 8C "2 May 2000" "OpenLDAP LDVERSION"
 .SH NAME
 in.xfingerd \- Finger to LDAP/X.500 gateway daemon
 .SH SYNOPSIS
 .B LIBEXECDIR/in.xfingerd [\-f filterfile] [\-i]
 .B [\-l] [\-t templatefile] [\-c rdncount] [\-x hostname]
 .B [\-p port]
+.B [\-b base]
 .SH DESCRIPTION
 .B in.xfingerd
 is the LDAP/X.500 finger daemon.  It runs from
@@ -53,6 +54,9 @@
 .BR ldap_init_templates (3)
 facility, used by
 BR in.xfingerd .
+.TP
+.BI \-b " base"
+Specify a different base DN from the default used for user-friendly searches.
 .TP
 .BI \-c " rdncount"
 Specify the number of DN components to show for the names and DN attributes
diff -uNr openldap-1.2.10/libraries/libldap/request.c openldap-1.2.10/libraries/libldap/request.c
--- openldap-1.2.10/libraries/libldap/request.c	Fri Mar 10 18:33:55 2000
+++ openldap-1.2.10/libraries/libldap/request.c	Tue May  2 15:19:50 2000
@@ -86,7 +86,7 @@
 #if defined( LDAP_REFERRALS ) || defined( LDAP_DNS )
 		if (( srv = (LDAPServer *)calloc( 1, sizeof( LDAPServer ))) ==
 		    NULL || ( ld->ld_defhost != NULL && ( srv->lsrv_host =
-		    strdup( ld->ld_defhost )) == NULL ))
+		    ldap_strdup( ld->ld_defhost )) == NULL ))
 		{
 			if (srv != NULL) free( srv );
 			ld->ld_errno = LDAP_NO_MEMORY;
diff -uNr openldap-1.2.10/libraries/libldap/ufn.c openldap-1.2.10/libraries/libldap/ufn.c
--- openldap-1.2.10/libraries/libldap/ufn.c	Thu Dec 31 14:32:07 1998
+++ openldap-1.2.10/libraries/libldap/ufn.c	Tue May  2 15:19:08 2000
@@ -476,6 +476,9 @@
 	if ( ld->ld_ufnprefix != NULL )
 		free( ld->ld_ufnprefix );
 
+	if ( prefix == NULL )
+		prefix = openldap_ldap_global_options.ldo_defbase;
+
 	ld->ld_ufnprefix = ldap_strdup( prefix );
 }