[Date Prev][Date Next] [Chronological] [Thread] [Top]

Bug causing infinite loop in result.c



We have found a bug in libraries/libldap/result.c which may cause an
infinite loop in some situations.

The error is this, in the function wait4msg():

	if ( rc == LDAP_MSG_X_KEEP_LOOKING && tvp != NULL ) {
			tmp_time = time( NULL );
			tv0.tv_sec -= ( tmp_time - start_time );
			if ( tv0.tv_sec <= 0 ) {
				rc = 0;	/* timed out */
				ld->ld_errno = LDAP_TIMEOUT;
				break;
			}
			tv.tv_sec = tv0.tv_sec;
                        ...
          }

   The problem is this:  The check ( tv0.tv_sec <= 0 ) is always true, since tv_sec (on our
system, at least) is an unsigned int.

The problem is fixed by casting it to int:
  
     if ( (int) tv0.tv_sec <= 0 ) { 
          ...
      }

however this might not be the most suitable way to fix it. 

best regards, 

Carsten Agger
Software Consultant, 
TietoEnator A/S, Denmark
http://www.tietoenator.dk