Full_Name: 
Version: 2.4.40-1
OS: debian / UCS 4.1 amd64
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (82.198.197.8)


A malformed URI in the sasl-regexp directive of slapd.conf caused a segfault of
slapd.

"""
sasl-regexp
    uid=(.*),cn=saml,cn=auth
    ldap:///0.0.0.0:7389,389/"dc=dev,dc=local"??sub?uid=$1
"""
The URI starts with 3 slashes after the scheme instead of 2 slashes.

When doing authentication via SASL /usr/sbin/slapd segfaults.

I think it is easy to reproduce. I can provide a core dump if needed.

The backtrace:

Thread 1 (Thread 0x7f933827c700 (LWP 18575)):
#0  *__GI___li_freree (mem=0x20) at malloc.c:3709
#1  0x000000000044d08e in ava_free (op=0x1aa6ce0, ava=0x1aa8410,
freeit=1) at ../../../../servers/slapd/ava.c:50
#2  0x00000000004354aa in filter_free_x (op=0x1aa6ce0, f=0x1aa8450,
freeme=1) at ../../../%./servers/slapd/filter.c:531
#3  0x00000000004798a3 in slap_sasl2dn (opx=opx@entry=0x1aa6ce0,
saslname=saslname@entry=0x7f933827b600,
sasldn=sasldn@entry=0x7f933827b450, flags=flags@entry=2) at
../../../../servers/slapd/saslauthz.c:2018
#4  0x0000000000480c0f in slap_sasl_getdn (conn=<optimized out>,
op=0x1aa6ce0, op@entry=0x0, id=id@entry=0x7f933827b610,
user_realm=user_realm@entry=0x0, dn=dn@entry=0x7f933827b600, flags=2) at
../../../../servers/slapd/sasl.c:1884
#5  0x00000000004811a1 in slap_sasl_canonicalize (sconn=0x190a7e0,
context=<optimized out>, in=0x1a864b0 "Administrator", inlen=13,
flags=<optimized out>, user_realm=0x0, out=0x190b581 "", out_max=1024,
out_len=0x190b06c) at ../../../../servers/slapd/sasl.c:656
#6  0x00007f93c16b2558 in _sasl_canon_user (conn=conn@entry=0x190a7e0,
user=0x1a864b0 "Administrator", ulen=13, flags=flags@entry=3,
oparams=oparams@entry=0x190b050) at ../../lib/canonusr.c:109
#7  0x00007f93c16b2870 in _sasl_canon_user_lookup (conn=0x190a7e0,
user=<optimized out>, ulen=<optimized out>, flags=3, oparams=0x190b050)
at ../../lib/canonusr.c:273
#8  0x00007f93bd46b936 in saml_server_mech_step (conn_context=0x1a2e8e0,
params=0x190b9f0, clientin=0x1a55bea "", clientinlen=<optimized out>,
serverout=<optimized out>, serveroutlen=<optimized out>,
oparams=0x190b050) at cy2_saml.c:281
#9  0x00007f93c16be605 in sasl_server_step (serveroutlen=<optimized
out>, serverout=0x7f933827b958, clientinlen=<optimized out>,
clientin=<optimized out>, conn=0x190a7e0) at ../../lib/server.c:1614
#10 sasl_server_ste%2(conn=0x190a7e0, clientin=<optimized out>,
clientinlen=<optimized out>, serverout=0x7f933827b958,
serveroutlen=<optimized out>) at ../../lib/server.c:1585
#11 0x00007f93c16beb44 in sasl_server_start (conn=<optimized out>,
mech=<optimized out>, clientin=0x1a55bea "", clientinlen=<optimized
out>, serverout=serverout@entry=0x7f933827b958,
serveroutlen=serveroutlen@entry=0x7f933827b938) at ../../lib/server.c:1529
#12 0x000000000048020e in slap_sasl_bind (op=op@entry=0x1aa6ce0,
rs=rs@entry=0x7f933827ba60) at ../../../../servers/slapd/sasl.c:1512
#13 0x000000000044e217 in fe_op_bind (op=0x1aa6ce0, rs=0x7f933827ba60)
at ../../../../servers/slapd/bind.c:280
#14 0x000000000044dab1 in do_bind (op=0x1aa6ce0, rs=0x7f933827ba60) at
../../../../servers/slapd/bind.c:205
#15 0x00000000004315d5 in connection_operation
(ctx=ctx@entry=0x7f933827bba0, arg_v=arg_v@entry=0x1aa6ce0) at
../../../../servers/slapd/connection.c:1155
#16 0x00000000004318be in connection_read_thread (ctx=0x7f933827bba0,
argv=<optimized out>) at ../../../../servers/slapd/connection.c:1291
#17 0x00007f93c22e4c33 in ldap_int_thread_pool_wrapper (xpool=0x1447450)
at ../../../../libraries/libldap_r/tpool.c:688
#18 0x00007f93c03c3b50 in start_thread (arg=<optimized out>) at
pthread_create.c:304
#19 0x00007f93c010d70d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#20 0x0000000000000000 in ?? ()

Some more context:
(gdb) f 1
#1  0x000000000044d08e in ava_free (op=0x1aa6ce0, ava=0x1aa8410, freeit=1) at
../../../../servers/slapd/ava.c:50
50              op->o_tmpfree( ava->aa_value.bv_val, op->o_tmpmemctx );
(gdb) list
45      {
46      #ifdef LDAP_COMP_MATCH
47              if ( ava->aa_cf && ava->aa_cf->cf_ca->ca_comp_data.cd_mem_op )
48                      nibble_mem_free (
ava->aa_cf->cf_ca->ca_comp_data.cd_mem_op );
49      #endif
50              op->o_tmpfree( ava->aa_value.bv_val, op->o_tmpmemctx );
51              if ( ava->aa_desc->ad_flags & SLAP_DESC_TEMPORARY )
52                      op->o_tmpfree( ava->aa_desc, op->o_tmpmemctx );
53              if ( freeit ) op->o_tmpfree( (char *) ava, op->o_tmpmemctx );
54      }
(gdb) up
#2  0x00000000004354aa in filter_free_x (op=0x1aa6ce0, f=0x1aa8450, freeme=1) at
../../../../servers/slapd/filter.c:531
531                     ava_free( op, f->f_ava, 1 );
(gdb) list
526
527             case LDAP_FILTER_EQUALITY:
528             case LDAP_FILTER_GE:
529             case LDAP_FILTER_LE:
530             case LDAP_FILTER_APPROX:
531                     ava_free( op, f->f_ava, 1 );
532                     break;
533
534             case LDAP_FILTER_SUBSTRINGS:
535                     if ( f->f_sub_initial.bv_val != NULL ) {
(gdb) up
#3  0x00000000004798a3 in slap_sasl2dn (opx=opx@entry=0x1aa6ce0,
saslname=saslname@entry=0x7f933827b600, sasldn=sasldn@entry=0x7f933827b450,
flags=flags@entry=2) at ../../../../servers/slapd/saslauthz.c:2018
2018                    filter_free_x( opx, op.ors_filter, 1 );
(gdb) list
1313            }
2014            if( !BER_BVISNULL( &op.o_req_ndn ) ) {
2015                    slap_sl_free( op.o_req_ndn.bv_val, opx->o_tmpmemctx );
2016            }
2017            if( op.ors_filter ) {
2018                    filter_free_x( opx, op.ors_filter! 1 );
2019            }
2020            if( !BER_BVISNULL( &op.ors_filterstr ) ) {
2021                    ch_free( op.ors_filterstr.bv_val );
2022            }
(gdb) up
(gdb) up
#4  0x0000000000480c0f in slap_sasl_getdn (conn=<optimized out>, op=0x1aa6ce0,
op@entry=0x0, id=id@entry=0x7f933827b610, user_realm=user_realm@entry=0x0,
dn=dn@entry=0x7f933827b600, flags=2) at ../../../../servers/slapd/sasl.c:1884
1884            slap_sasl2dn( op, dn, &dn2, flags );
(gdb) list
1879                    }
1880                    *dn = dn2;
1881            }
1882
1883            /* Run thru regexp */
1884            slap_sasl2dn( op, dn, &dn2, flags );
1885            if( !BER_BVISNULL( &dn2 ) ) {
1886                    slap_sl_free( dn->bv_val, op->o_tmpmemctx );
1887                    *dn = dn2;
1888                    Debug( LDAP_DEBUG_TRACE,
(gdb) up
#5  0x00000000004811a1 in slap_sasl_canonicalize (sconn=0x190a7e0,
context=<optimized out>, in=0x1a864b0 "Administrator", inlen=13,
flags=<optimized out>,seser_realm=0x0, out=0x190b581 "", out_max=1024,
out_len=0x190b06c) at ../../../../servers/slapd/sasl.c:656
656             rc = slap_sasl_getdn( conn, NULL, &bvin, (char *)user_realm,
&dn,
(gdb) list
651                     if ( !rc ) goto nene;
652             }
653
654             bvin.bv_val = (char *)in;
655             bvin.bv_len = inlen;
656             rc = slap_sasl_getdn( conn, NULL, &bvin, (char *)user_realm,
&dn,
657                     (flags & SASL_CU_AUTHID) ? SLAP_GETDN_AUTIDID :
SLAP_GETDN_AUTHZID );
658             if ( rc != LDAP_SUCCESS ) {
659                     sasl_seterror( sconn, 0, ldap_err2string( rc ) );
660                     return SASL_NOAUTHZ;
(gdb) up
#6  0x00007f93c16b2558 in _sasl_canon_user (conn=conn@entry=0x190a7e0,
user=0x1a864b0 "Administrator", ulen=13, flags=flags@entry=3,
oparams=oparams@entry=0x190b050) at ../../lib/canonusr.c:109
109     ../../lib/canonusr.c: Datei oder Verzeichnis nicht gefunden.
(gdb) list
104     result = _sasl_getcallback(conn,
105                                SASL_CB_CANON_USER,
106                                (sasl_callback_ft *)&cuser_cb,
107                                &context);
108     if(result == SASL_OK && cuser_cb) {
109         result = cuser_cb(conn,
110                           context,
111                           user,
112                           ulen,
113                           flags,
114                           (conn->type == SASL_CONN_SERVER ?
115                                 sconn->user_realm :
116                                 NULL),
117                           user_buf,
118                           CANON_BUF_SIZE,
119                           lenp);
(gdb) up
#7  0x00007f93c16b2870 in _sasl_canon_user_lookup (conn=0x190a7e0,
user=<optimized out>, ulen=<optimized out>, flags=3, oparams=0x190b050) at
../../lib/canonusr.c:273

271     int result;
272 
273     result = _sasl_canon_user (conn,
274                                user,
275                                ulen,
276                                flags,
277                                oparams);

 (gdb) up
#8  0x00007f93bd46b936 in saml_server_mech_step (conn_context=0x1a2e8e0,
params=0x190b9f0, clientin=0x1a55bea "", clientinlen=<optimized out>,
serverout=<optimized out>, serveroutlen=<optimized out>, oparams=0x190b050) at
cy2_saml.c:281
281                     if ((error = params->canon_user(params->utils->conn,
userid, 0,
(gdb) list
276                             goto out;
277                     if ((error = params->canon_user(params->utils->conn,
userid, 0,
278                         SASL_CU_AUTHID, oparams)) != SASL_OK) 
279                             goto out;
280             } else {
281                     if ((error = params->canon_user(params->utils->conn,
userid, 0,
282                         SASL_CU_AUTHID|SASL_CU_AUTHZID, oparams)) !=
SASL_OK) 
283                             goto out;
284             }
285

Memory information:
In frame1 ava->bv_val is not "Administrator" (the user I authenticated with) but
the bv_len is 13.

(gdb) print *ava
$13 = {aa_desc = 0x1444650, aa_value = {bv_len = 13, bv_val = 0x20 <Address 0x20
out of bounds>}}