Re: segfault in ldap_back_search() with ENABLE_REWRITE (ITS#2825)

[ftr@highstreetnetworks.com]

This is a multi-part message in MIME format.
--------------040507020600070408090206
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Pierangelo Masarati wrote:

>I assumed "base" would always be set; however,
>
slap_sasl_match(), slap_sasl2dn() and two places in sasl.c call it 
explicitly with NULL:
                                                              vvvvv
        (*be->be_search)( be, conn, &op, NULL, &dn,
                scope, LDAP_DEREF_NEVER, 1, 0,
                filter, NULL, NULL, 1 );

I tried applying the attached patch, but there are many other places 
further down that make this same assumption.

-- 
Tom Riddle
HighStreet Networks
www.highstreetnetworks.com


--------------040507020600070408090206
Content-Type: text/plain;
 name="hsn1.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="hsn1.patch"

--- openldap-2.1.22-orig/servers/slapd/back-ldap/search.c	2003-03-12 17:27:57.000000000 -0500
+++ openldap-2.1.22/servers/slapd/back-ldap/search.c	2003-11-12 09:53:32.000000000 -0500
@@ -157,18 +157,18 @@
 	*/
 #ifdef ENABLE_REWRITE
  	switch ( rewrite_session( li->rwinfo, "searchBase",
- 				base->bv_val, conn, &mbase.bv_val ) ) {
+ 			base ? base->bv_val : NULL, conn, &mbase.bv_val ) ) {
 	case REWRITE_REGEXEC_OK:
-		if ( mbase.bv_val == NULL ) {
+		if ( mbase.bv_val == NULL && base) {
 			mbase = *base;
 		}
 #ifdef NEW_LOGGING
 		LDAP_LOG( BACK_LDAP, DETAIL1, 
 			"[rw] searchBase: \"%s\" -> \"%s\"\n", 
-			base->bv_val, mbase.bv_val, 0 );
+			base ? base->bv_val : "", mbase.bv_val, 0 );
 #else /* !NEW_LOGGING */
 		Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n%s",
-				base->bv_val, mbase.bv_val, "" );
+			base ? base->bv_val : "", mbase.bv_val, "" );
 #endif /* !NEW_LOGGING */
 		break;
 		

--------------040507020600070408090206--