(ITS#7542) slapd segfault on modify

[m.gr@gmx.de]

Full_Name: Matthias Grau
Version: 2.4.34
OS: debian 6.7.0 x64
URL: ftp://ftp.openldap.org/incoming/matthias.grau.130318.bz2
Submission from: (NULL) (94.217.193.246)


slapd can cause a segfault when sorting values in modify operation.
Under rare circumstances modify.c:802: jstack += 2; can reach a value of greater
63 which leads to an overwritten pointer for AttributeDescription.

Changing the size of istack from sizeof(int) * 16 to sizeof(int)*16 + 1 solves
the segfault. But I don't think that's the correct solution.
As shown here:
http://theory.stanford.edu/~amitp/rants/c++-vs-c/test5.cc
there should be a condition to break if jstack reaches the size of of istack.



root@debian:/root# gdb /usr/local/libexec/slapd 
GNU gdb (GDB) 7.0.1-debian
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/local/libexec/slapd...done.
(gdb) r  -h ldap://localhost:389 -f /root/slapd.conf -d 0
Starting program: /usr/local/libexec/slapd -h ldap://localhost:389 -f
/root/slapd.conf -d 0
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff6dc8700 (LWP 3728)]
[New Thread 0x7ffff65c7700 (LWP 3730)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff65c7700 (LWP 3730)]
0x000000000045135b in ordered_value_match (match=0x7ffff65c56cc, ad=0x17c4,
mr=0x92ddb0, flags=269, v1=0xcc0820, v2=0x7ffff65c56b0, text=0x7ffff65c6a90) at
value.c:633
633		if ( ad->ad_type->sat_flags & SLAP_AT_ORDERED ) {
(gdb) bt
#0  0x000000000045135b in ordered_value_match (match=0x7ffff65c56cc, ad=0x17c4,
mr=0x92ddb0, flags=269, v1=0xcc0820, v2=0x7ffff65c56b0, text=0x7ffff65c6a90) at
value.c:633
#1  0x000000000044b71c in slap_sort_vals (ml=0xca8900, text=0x7ffff65c6a90,
dup=0x7ffff65c587c, ctx=0x0) at modify.c:741
#2  0x000000000044b497 in slap_mods_check (op=0xaae2a0, ml=0xca8900,
text=0x7ffff65c6a90, textbuf=0x7ffff65c6900 "", textlen=256, ctx=0x0) at
modify.c:652
#3  0x000000000044a125 in do_modify (op=0xaae2a0, rs=0x7ffff65c6a70) at
modify.c:168
#4  0x000000000042a7b0 in connection_operation (ctx=0x7ffff65c6ba0,
arg_v=0xaae2a0) at connection.c:1150
#5  0x000000000042ad51 in connection_read_thread (ctx=0x7ffff65c6ba0, argv=0xd)
at connection.c:1286
#6  0x00000000005ad930 in ldap_int_thread_pool_wrapper (xpool=<value optimized
out>) at tpool.c:688
#7  0x00007ffff784f8ca in start_thread () from /lib/libpthread.so.0
#8  0x00007ffff7169b6d in clone () from /lib/libc.so.6
#9  0x0000000000000000 in ?? ()
(gdb) p ad
$1 = (AttributeDescription *) 0x17c4
(gdb) p *ad
Cannot access memory at address 0x17c4
(gdb)