(ITS#5432) syncrepl seg. faults if received a sync cookie with an empty csn= value

[rein@basefarm.no]

Full_Name: Rein Tollevik
Version: 2.4.8
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (84.215.2.34)


The attached patch fixes a seg. fault in compare_csns() in syncrepl.c if it
receives a sync cookie with an empty "csn=" value.

syncprov_playlog() in syncprov.c generates such invalid cookies when replaying a
sessionlog where no entries has been deleted.  The patch also fixes this bug.

Rein Tollevik
Basefarm AS

Index: OpenLDAP/servers/slapd/syncrepl.c
diff -u OpenLDAP/servers/slapd/syncrepl.c:1.6
OpenLDAP/servers/slapd/syncrepl.c:1.7
--- OpenLDAP/servers/slapd/syncrepl.c:1.6	Fri Mar 14 16:27:41 2008
+++ OpenLDAP/servers/slapd/syncrepl.c	Tue Mar 18 17:15:30 2008
@@ -669,8 +669,8 @@
 		return -1;
 	}
 
-	for (i=0; !BER_BVISNULL( &sc1->ctxcsn[i] ); i++) {
-		for (j=0; !BER_BVISNULL( &sc2->ctxcsn[j] ); j++) {
+	for (i=0; !BER_BVISEMPTY( &sc1->ctxcsn[i] ); i++) {
+		for (j=0; !BER_BVISEMPTY( &sc2->ctxcsn[j] ); j++) {
 			if ( sc1->sids[i] != sc2->sids[j] )
 				continue;
 			value_match( &match, slap_schema.si_ad_entryCSN,
Index: OpenLDAP/servers/slapd/overlays/syncprov.c
diff -u OpenLDAP/servers/slapd/overlays/syncprov.c:1.5
OpenLDAP/servers/slapd/overlays/syncprov.c:1.6
--- OpenLDAP/servers/slapd/overlays/syncprov.c:1.5	Fri Mar 14 16:23:48 2008
+++ OpenLDAP/servers/slapd/overlays/syncprov.c	Tue Mar 18 17:22:41 2008
@@ -1413,8 +1413,7 @@
 		num * UUID_LEN, op->o_tmpmemctx );
 	uuids[0].bv_val = (char *)(uuids + num + 1);
 
-	delcsn[0].bv_len = 0;
-	delcsn[0].bv_val = cbuf;
+	BER_BVZERO(&delcsn[0]);
 	BER_BVZERO(&delcsn[1]);
 
 	/* Make a copy of the relevant UUIDs. Put the Deletes up front
@@ -1453,6 +1452,7 @@
 			i++;
 			AC_MEMCPY( cbuf, se->se_csn.bv_val, se->se_csn.bv_len );
 			delcsn[0].bv_len = se->se_csn.bv_len;
+			delcsn[0].bv_val = cbuf;
 			delcsn[0].bv_val[delcsn[0].bv_len] = '\0';
 		} else {
 			nmods++;