[Date Prev][Date Next]
(ITS#4278) pwdExtop doesn't set all fields of the modification structure
Full_Name: Darin Broady
Version: 2.3.12 (HEAD)
OS: Solaris 9
Submission from: (NULL) (126.96.36.199)
In servers/slapd/passwd.c, between lines 256-262 in HEAD and 2.3, the pwdExtOp
code is creating the Modifications list to get ready for the call to be_modify.
However, it fails to set the sml_type berval to anything. Since the ml struct
is allocated by ch_malloc, the sml_type variable will not be initialized
correctly. Any code that attempts to copy this Modification structure will
coredump because sml_type.bv_val will be pointing to garbarge. Specifically, if
a SLAPI plugin calls:
slapi_pblock_get(pb, SLAPI_MODIFY_MODS, (void*)&mods);
slapd will coredump while attempting to copy the structure at
servers/slapd/slapi/slapi_pblock.c:625, slapi_int_modifications2ldapmods, which
eventually gets to line 2719 of servers/slapd/slapi/slapi_utils.c, attempting to
strdup the sml_type variable.
A simple fix that I used to stop the coredump was to do the following in
passwd.c near line 260:
I don't know if this is most appropriate fix, but it worked for me. Another
solution would be to use ch_calloc() instead of ch_malloc().