OpenLDAP
Up to top level
Build   Contrib   Development   Documentation   Historical   Incoming   Software Bugs   Software Enhancements   Web  

Logged in as guest

Viewing Archive.Incoming/6756
Full headers

From: jgilmour@techsmog.com
Subject: ldapsearch crashes - double free or corruption (!prev): 0x0989f5f8
Compose comment
Download message
State:
0 replies:
1 followups: 1

Major security issue: yes  no

Notes:

Notification:


Date: Thu, 30 Dec 2010 21:06:14 +0000
From: jgilmour@techsmog.com
To: openldap-its@OpenLDAP.org
Subject: ldapsearch crashes - double free or corruption (!prev): 0x0989f5f8
Full_Name: Josh Gilmour
Version: ldapsearch 2.3.43 (Nov 29 2010 03:47:14)
OS: CentOS release 5.4 32bit
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (38.112.23.58)


I get a segfault when using the following command and applying a filter file. If
we remove the -f, the command runs properly. It doesn't seem to be a major
security issue (or one at all, I'm not sure), but it does seem to be a bug I
believe...

the file i'm using for the -f parameter, 'testing', just has the letter 'a' in
it.

Here is the process output from gdb:

[jgilmour@xijgilmour ~]$ gdb ldapsearch
GNU gdb Fedora (6.8-37.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
(no debugging symbols found)
(gdb) r -x -LLL -h xxx.local -D "xxx@xxx.local" -E pr=1/noprompt -w password -b
"OU=xxx,dc=xxx,dc=local" -S sAMAccountName -f testing
Starting program: /usr/bin/ldapsearch -x -LLL -h xxx.local -D "xxx@xxx.local" -E
pr=1/noprompt -w password -b "OU=xxx,dc=xxx,dc=local" -S sAMAccountName -f
testing
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
dn: OU=xxx,DC=xxx,DC=LOCAL
objectClass: top
objectClass: organizationalUnit
ou: xxx
distinguishedName: OU=xxx,DC=xxx,DC=LOCAL
instanceType: 4
whenCreated: 20050103174000.0Z
whenChanged: 20081117191042.0Z
uSNCreated: 12371
uSNChanged: 6388825
name: xxx
objectGUID:: qjRiugCNd0eXyrXkHlETpA==
objectCategory: CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=xxx,D
 C=LOCAL
dSCorePropagationData: 20080818221029.0Z
dSCorePropagationData: 20080628202026.0Z
dSCorePropagationData: 20070611215308.0Z
dSCorePropagationData: 20070611213209.0Z
dSCorePropagationData: 16010714223649.0Z

*** glibc detected *** /usr/bin/ldapsearch: double free or corruption (!prev):
0x086a35f8 ***

Program received signal SIGSEGV, Segmentation fault.
0x00c67a3f in _int_malloc () from /lib/i686/nosegneg/libc.so.6
(gdb) i r
eax            0x169    361
ecx            0xd43170 13906288
edx            0x86a35f0        141178352
ebx            0xd41ff4 13901812
esp            0xbf9a7078       0xbf9a7078
ebp            0xbf9a713c       0xbf9a713c
esi            0x168    360
edi            0xb7fdb000       -1208111104
eip            0xc67a3f 0xc67a3f <_int_malloc+703>
eflags         0x210283 [ CF SF IF RF ID ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) bt
#0  0x00c67a3f in _int_malloc () from /lib/i686/nosegneg/libc.so.6
#1  0x00c69a1e in malloc () from /lib/i686/nosegneg/libc.so.6
#2  0x00235998 in _dl_map_object () from /lib/ld-linux.so.2
#3  0x0023ead1 in dl_open_worker () from /lib/ld-linux.so.2
#4  0x0023ae66 in _dl_catch_error () from /lib/ld-linux.so.2
#5  0x0023e4b2 in _dl_open () from /lib/ld-linux.so.2
#6  0x00d08072 in do_dlopen () from /lib/i686/nosegneg/libc.so.6
#7  0x0023ae66 in _dl_catch_error () from /lib/ld-linux.so.2
#8  0x00d08225 in __libc_dlopen_mode () from /lib/i686/nosegneg/libc.so.6
#9  0x00ce44d9 in init () from /lib/i686/nosegneg/libc.so.6
#10 0x00ce4673 in backtrace () from /lib/i686/nosegneg/libc.so.6
#11 0x00c5ee51 in __libc_message () from /lib/i686/nosegneg/libc.so.6
#12 0x00c671d5 in _int_free () from /lib/i686/nosegneg/libc.so.6
#13 0x00c67619 in free () from /lib/i686/nosegneg/libc.so.6
#14 0x00c55756 in fclose@@GLIBC_2.1 () from /lib/i686/nosegneg/libc.so.6
#15 0x0804ca88 in ?? ()
#16 0x00c12e9c in __libc_start_main () from /lib/i686/nosegneg/libc.so.6
#17 0x0804a3f1 in ?? ()
(gdb) q
The program is running.  Exit anyway? (y or n) y
[jgilmour@xijgilmour ~]$ uname -a
Linux xijgilmour.xxx.local 2.6.18-164.11.1.el5xen #1 SMP Wed Jan 20 08:53:10 EST
2010 i686 i686 i386 GNU/Linux


Followup 1

Download message
From: Josh Gilmour <jgilmour@brightcove.com>
Date: Thu, 30 Dec 2010 16:07:12 -0500
Subject: Re: (ITS#6756) ldapsearch crashes - double free or corruption
 (!prev): 0x0989f5f8
To: openldap-its@openldap.org
--90e6ba211d7d01d52c0498a713c3
Content-Type: text/plain; charset=ISO-8859-1

oops, sorry, this is a duplicate

On Thu, Dec 30, 2010 at 4:06 PM, <openldap-its@openldap.org> wrote:

>
> *** THIS IS AN AUTOMATICALLY GENERATED REPLY ***
>
> Thanks for your report to the OpenLDAP Issue Tracking System.  Your
> report has been assigned the tracking number ITS#6756.
>
> One of our support engineers will look at your report in due course.
> Note that this may take some time because our support engineers
> are volunteers.  They only work on OpenLDAP when they have spare
> time.
>
> If you need to provide additional information in regards to your
> issue report, you may do so by replying to this message.  Note that
> any mail sent to openldap-its@openldap.org with (ITS#6756)
> in the subject will automatically be attached to the issue report.
>
>        mailto:openldap-its@openldap.org?subject=(ITS#6756)
>
> You may follow the progress of this report by loading the following
> URL in a web browser:
>    http://www.OpenLDAP.org/its/index.cgi?findid=6756
>
> Please remember to retain your issue tracking number (ITS#6756)
> on any further messages you send to us regarding this report.  If
> you don't then you'll just waste our time and yours because we
> won't be able to properly track the report.
>
> Please note that the Issue Tracking System is not intended to
> be used to seek help in the proper use of OpenLDAP Software.
> Such requests will be closed.
>
> OpenLDAP Software is user supported.
>        http://www.OpenLDAP.org/support/
>
> --------------
> Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved.
>
>


-- 
Josh Gilmour | Windows Systems & Network Administrator

Brightcove, Inc. www.brightcove.com
One Cambridge Center, 12th Floor, Cambridge, MA 02142
P: 617.395.5843 F: 617.395.8352

++++++++++

Brightcove PLAY 2011 Global Customer Conference

May 23-25, Boston Seaport Hotel & World Trade Center

Registration Now Open: http://brightcove.com/play2011

++++++++++

--90e6ba211d7d01d52c0498a713c3
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

oops, sorry, this is a duplicate<br><br><div
class=3D"gmail_quote">On Thu, =
Dec 30, 2010 at 4:06 PM,  <span dir=3D"ltr">&lt;<a
href=3D"mailto:openldap-=
its@openldap.org">openldap-its@openldap.org</a>&gt;</span>
wrote:<br><block=
quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc=
 solid;padding-left:1ex;">

<br>
*** THIS IS AN AUTOMATICALLY GENERATED REPLY ***<br>
<br>
Thanks for your report to the OpenLDAP Issue Tracking System. =A0Your<br>
report has been assigned the tracking number ITS#6756.<br>
<br>
One of our support engineers will look at your report in due course.<br>
Note that this may take some time because our support engineers<br>
are volunteers. =A0They only work on OpenLDAP when they have spare<br>
time.<br>
<br>
If you need to provide additional information in regards to your<br>
issue report, you may do so by replying to this message. =A0Note that<br>
any mail sent to <a
href=3D"mailto:openldap-its@openldap.org">openldap-its@=
openldap.org</a> with (ITS#6756)<br>
in the subject will automatically be attached to the issue report.<br>
<br>
 =A0 =A0 =A0 =A0mailto:<a
href=3D"mailto:openldap-its@openldap.org">openlda=
p-its@openldap.org</a>?subject=3D(ITS#6756)<br>
<br>
You may follow the progress of this report by loading the following<br>
URL in a web browser:<br>
 =A0 =A0<a href=3D"http://www.OpenLDAP.org/its/index.cgi?findid=3D6756" tar=
get=3D"_blank">http://www.OpenLDAP.org/its/index.cgi?findid=3D6756</a><br>
<br>
Please remember to retain your issue tracking number (ITS#6756)<br>
on any further messages you send to us regarding this report. =A0If<br>
you don&#39;t then you&#39;ll just waste our time and yours because
we<br>
won&#39;t be able to properly track the report.<br>
<br>
Please note that the Issue Tracking System is not intended to<br>
be used to seek help in the proper use of OpenLDAP Software.<br>
Such requests will be closed.<br>
<br>
OpenLDAP Software is user supported.<br>
 =A0 =A0 =A0 =A0<a href=3D"http://www.OpenLDAP.org/support/" target=3D"_bla=
nk">http://www.OpenLDAP.org/support/</a><br>
<br>
--------------<br>
Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved.<br>
<br>
</blockquote></div><br><br clear=3D"all"><br>--
<br>Josh Gilmour | Windows =
Systems &amp; Network Administrator<br><br>Brightcove, Inc.
<a href=3D"http=
://ww

Message of length 5571 truncated

Up to top level
Build   Contrib   Development   Documentation   Historical   Incoming   Software Bugs   Software Enhancements   Web  

Logged in as guest


The OpenLDAP Issue Tracking System uses a hacked version of JitterBug

______________
© Copyright 2013, OpenLDAP Foundation, info@OpenLDAP.org