Logged in as guest
Viewing Software Bugs/7414 Full headers
Major security issue: yes no
Notes: fixed in master fixed in RE24 Notification:
Date: Thu, 11 Oct 2012 14:24:26 +0000 From: jvcelak@redhat.com To: openldap-its@OpenLDAP.org Subject: rwm: ldapmodify, slapd segmentation fault
Full_Name: Jan Vcelak Version: 2.4.33 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (209.132.186.34) Hello, it is possible to crash slapd in certain configuration with rwm overlay enabled, using specific ldapmodify. This problem seems to be present for a very long time. Configuration used (slapd.ldif): dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap/slapd.args olcPidFile: /var/run/openldap/slapd.pid dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib64/openldap olcModuleload: rwm.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///etc/openldap/schema/core.ldif include: file:///etc/openldap/schema/cosine.ldif include: file:///etc/openldap/schema/inetorgperson.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcRootPW: secret olcDbDirectory: /var/lib/ldap olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub dn: olcOverlay=rwm,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: {0}rwm-rewriteEngine "on" olcRwmRewrite: {1}rwm-rewriteContext "bindDN" olcRwmRewrite: {2}rwm-rewriteRule "cn=([a-z]+),ou=People,dc=my-domain,dc=com" "uid=$1,ou=People,dc=my-domain,dc=com" Set up and start the server. Add the initial data: dn: dc=my-domain,dc=com objectClass: dcObject objectClass: organizationalUnit description: Root LDAP entry dc: my-domain ou: rootobject dn: cn=Manager,dc=my-domain,dc=com objectClass: organizationalRole cn: Manager dn: ou=People,dc=my-domain,dc=com objectClass: top objectClass: organizationalunit ou: People dn: cn=test1,ou=People,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test1 sn: test Perform following modify operation: dn: cn=test1,ou=People,dc=my-domain,dc=com changetype: modrdn newrdn: cn=test2 deleteoldrdn: 1 newsuperior: ou=People,dc=my-domain,dc=com The slapd daemon will crash, here is the full backtrace: #0 rwm_op_rollback (op=op@entry=0x7fffe8000930, ros=0x7fffe8001738, rs=<optimized out>) at rwm.c:110 No locals. #1 0x00007ffff210f1c2 in rwm_op_cleanup (op=0x7fffe8000930, rs=<optimized out>) at rwm.c:165 cb = 0x7fffe8001718 ros = <optimized out> #2 0x00005555555a606b in slap_cleanup_play (op=op@entry=0x7fffe8000930, rs=rs@entry=0x7ffff1106930) at result.c:541 sc_next = 0x7ffff11065c0 sc_nextp = 0x7fffe8001718 sc = 0x7fffe8001718 scp = 0x7ffff1106018 #3 0x00005555555a6573 in send_ldap_response (op=op@entry=0x7fffe8000930, rs=rs@entry=0x7ffff1106930) at result.c:733 berbuf = { buffer = "\000\000\001\000\001\000\000\000\377\377\377\377\377\377\377\377", '\000' <repeats 24 times>, "F\030\000\350\377\177\000\000\024(\000\350\377\177\000\000\000\000\000\000\000\000\000\000F\030\000\350\377\177\000\000\320\016\000\350\377\177\000\000P\373\275UUU\000\000\200v\357\367\377\177\000\000\001\000\000\000hw\001", '\000' <repeats 17 times>"\266, \252r\367\377\177", '\000' <repeats 11 times>, "a\370<\316m]\037\200*\227\367\377\177\000\000\001\000\000\000UU\000\000\321\323vP\000\000\000\000\350\n\000\350\377\177\000\000\003", '\000' <repeats 23 times>"\225, \362\227\367\311\362\245\303\000\000\000\000\000\000\000\000+\246fUUU\000\000\030..UUU\000\000\223\204+\366\377\177\000\000\060\065\020\350\377\177\000\000\000a\370<\316m]\037", ialign = 65536, lalign = 4295032832, falign = 9.18354962e-41, dalign = 2.1220281700514382e-314, palign = 0x100010000 <Address 0x100010000 out of bounds>} ber = <optimized out> rc = 32768 bytes = <optimized out> __PRETTY_FUNCTION__ = "send_ldap_response" #4 0x00005555555a7126 in slap_send_ldap_result (op=0x7fffe8000930, rs=0x7ffff1106930) at result.c:860 tmp = 0x0 otext = 0x0 oref = 0x0 __PRETTY_FUNCTION__ = "slap_send_ldap_result" #5 0x0000555555621a50 in hdb_modrdn (op=0x7fffe8000930, rs=0x7ffff1106930) at modrdn.c:789 bdb = 0x5555559fa4f0 children = 0x55555599d260 entry = 0x55555599cfc0 p_dn = {bv_len = 29, bv_val = 0x7fffe8102399 "ou=People,dc=my-domain,dc=com"} p_ndn = {bv_len = 29, bv_val = 0x7fffe81023c9 ""} new_dn = {bv_len = 38, bv_val = 0x0} new_ndn = {bv_len = 38, bv_val = 0x0} e = <optimized out> p = <optimized out> ei = 0x7fffe8103f00 eip = 0x7fffe410a0a0 nei = 0x7fffe410a0a0 neip = 0x0 textbuf = "0\t\000\350\377\177\000\000\000e\020\361\377\177\000\000 i\23
Date: Thu, 11 Oct 2012 08:04:41 -0700 From: Howard Chu <hyc@symas.com> To: jvcelak@redhat.com CC: openldap-its@OpenLDAP.org Subject: Re: (ITS#7414) rwm: ldapmodify, slapd segmentation fault
jvcelak@redhat.com wrote: > Full_Name: Jan Vcelak > Version: 2.4.33 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (209.132.186.34) > > > Hello, > > it is possible to crash slapd in certain configuration with rwm overlay enabled, > using specific ldapmodify. This problem seems to be present for a very long > time. > > Configuration used (slapd.ldif): > > dn: cn=config > objectClass: olcGlobal > cn: config > olcArgsFile: /var/run/openldap/slapd.args > olcPidFile: /var/run/openldap/slapd.pid > > dn: cn=module,cn=config > objectClass: olcModuleList > cn: module > olcModulepath: /usr/lib64/openldap > olcModuleload: rwm.la > > dn: cn=schema,cn=config > objectClass: olcSchemaConfig > cn: schema > > include: file:///etc/openldap/schema/core.ldif > include: file:///etc/openldap/schema/cosine.ldif > include: file:///etc/openldap/schema/inetorgperson.ldif > > dn: olcDatabase=frontend,cn=config > objectClass: olcDatabaseConfig > olcDatabase: frontend > > dn: olcDatabase=hdb,cn=config > objectClass: olcDatabaseConfig > objectClass: olcHdbConfig > olcDatabase: hdb > olcSuffix: dc=my-domain,dc=com > olcRootDN: cn=Manager,dc=my-domain,dc=com > olcRootPW: secret > olcDbDirectory: /var/lib/ldap > olcDbIndex: objectClass eq,pres > olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub > > dn: olcOverlay=rwm,olcDatabase={1}hdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcRwmConfig > olcOverlay: rwm > olcRwmRewrite: {0}rwm-rewriteEngine "on" > olcRwmRewrite: {1}rwm-rewriteContext "bindDN" > olcRwmRewrite: {2}rwm-rewriteRule "cn=([a-z]+),ou=People,dc=my-domain,dc=com" > "uid=$1,ou=People,dc=my-domain,dc=com" > > > Set up and start the server. Add the initial data: > > dn: dc=my-domain,dc=com > objectClass: dcObject > objectClass: organizationalUnit > description: Root LDAP entry > dc: my-domain > ou: rootobject > > dn: cn=Manager,dc=my-domain,dc=com > objectClass: organizationalRole > cn: Manager > > dn: ou=People,dc=my-domain,dc=com > objectClass: top > objectClass: organizationalunit > ou: People > > dn: cn=test1,ou=People,dc=my-domain,dc=com > objectClass: inetOrgPerson > cn: test1 > sn: test > > > Perform following modify operation: > > dn: cn=test1,ou=People,dc=my-domain,dc=com > changetype: modrdn > newrdn: cn=test2 > deleteoldrdn: 1 > newsuperior: ou=People,dc=my-domain,dc=com > > > The slapd daemon will crash, here is the full backtrace: Thanks for the detailed report. Fixed now in master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
Date: Fri, 12 Oct 2012 02:32:43 -0400 (EDT) From: Jan Vcelak <jvcelak@redhat.com> To: hyc@symas.com Cc: openldap-its@openldap.org Subject: Re: (ITS#7414) rwm: ldapmodify, slapd segmentation fault
> > The slapd daemon will crash, here is the full backtrace: > > Thanks for the detailed report. Fixed now in master. > Thank you for the very fast resolution. Jan
______________ © Copyright 2013, OpenLDAP Foundation, info@OpenLDAP.org
