[Fedora-directory-commits] ldapserver/ldap/servers/slapd/back-ldbm archive.c, 1.8, 1.9 dbhelp.c, 1.4, 1.5 dllmain.c, 1.4, 1.5 import-merge.c, 1.5, 1.6 import.h, 1.5, 1.6 ldbm_attrcrypt.c, 1.7, 1.8 ldbm_config.c, 1.5, 1.6 ldif2ldbm.c, 1.8, 1.9
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/slapd/back-ldbm
Modified Files:
archive.c dbhelp.c dllmain.c import-merge.c import.h
ldbm_attrcrypt.c ldbm_config.c ldif2ldbm.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: archive.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/archive.c,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- archive.c 12 Jan 2006 00:29:04 -0000 1.8
+++ archive.c 11 Apr 2006 02:14:45 -0000 1.9
@@ -207,7 +207,7 @@
c = *p;
*p = '\0';
}
- bakup_dir = slapi_ch_smprintf("%s%ctmp_%010d", directory, c, time(0));
+ bakup_dir = slapi_ch_smprintf("%s%ctmp_%010ld", directory, c, time(0));
LDAPDebug( LDAP_DEBUG_ANY,
"archive2db: backup dir: %s\n", bakup_dir, 0, 0);
*p = c;
@@ -315,10 +315,10 @@
if (task) {
slapi_task_log_notice(task,
"Failed to rename \"%s\" to \"%s\".",
- directory, dir_bak, 0);
+ directory, dir_bak);
slapi_task_log_notice(task,
SLAPI_COMPONENT_NAME_NSPR " error %d (%s)",
- prerr, slapd_pr_strerror(prerr), 0);
+ prerr, slapd_pr_strerror(prerr));
}
return_value = -1;
goto out;
Index: dbhelp.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/dbhelp.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- dbhelp.c 19 Apr 2005 22:07:37 -0000 1.4
+++ dbhelp.c 11 Apr 2006 02:14:45 -0000 1.5
@@ -51,7 +51,7 @@
DB *source_file = NULL;
DB *destination_file = NULL;
DBC *source_cursor = NULL;
- int dbtype = 0;
+ DBTYPE dbtype = 0;
int dbflags = 0;
int dbpagesize = 0;
int cursor_flag = 0;
Index: dllmain.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/dllmain.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- dllmain.c 19 Apr 2005 22:07:38 -0000 1.4
+++ dllmain.c 11 Apr 2006 02:14:45 -0000 1.5
@@ -136,6 +136,7 @@
va_list ap;
va_start (ap, fmt);
_snprintf (debugBuf, sizeof(debugBuf), fmt, ap);
+ debugBuf[sizeof(debugBuf)-1] = 0;
va_end (ap);
OutputDebugString (debugBuf);
Index: import-merge.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/import-merge.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- import-merge.c 19 Apr 2005 22:07:38 -0000 1.5
+++ import-merge.c 11 Apr 2006 02:14:45 -0000 1.6
@@ -654,8 +654,7 @@
int passes = job->current_pass;
if (1 == job->number_indexers) {
- import_log_notice(job, "Beginning %d-way merge of one file...", passes,
- job->number_indexers);
+ import_log_notice(job, "Beginning %d-way merge of one file...", passes);
} else {
import_log_notice(job, "Beginning %d-way merge of up to %lu files...",
passes, job->number_indexers);
Index: import.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/import.h,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- import.h 6 Dec 2005 18:28:14 -0000 1.5
+++ import.h 11 Apr 2006 02:14:45 -0000 1.6
@@ -203,7 +203,13 @@
/* import.c */
FifoItem *import_fifo_fetch(ImportJob *job, ID id, int worker, int shift);
void import_free_job(ImportJob *job);
-void import_log_notice(ImportJob *job, char *format, ...);
+void import_log_notice(ImportJob *job, char *format, ...)
+#ifdef __GNUC__
+ __attribute__ ((format (printf, 2, 3)));
+#else
+ ;
+#endif
+
void import_abort_all(ImportJob *job, int wait_for_them);
int import_entry_belongs_here(Slapi_Entry *e, backend *be);
int import_make_merge_filenames(char *directory, char *indexname, int pass,
Index: ldbm_attrcrypt.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- ldbm_attrcrypt.c 19 Apr 2005 22:07:38 -0000 1.7
+++ ldbm_attrcrypt.c 11 Apr 2006 02:14:45 -0000 1.8
@@ -199,7 +199,7 @@
key_as_berval.bv_len = wrapped_symmetric_key.len;
key_value = slapi_value_new_berval(&key_as_berval);
/* key_value is now a copy of key_as_berval - free wrapped_symmetric_key */
- slapi_ch_free(&wrapped_symmetric_key.data);
+ slapi_ch_free_string((char **)&wrapped_symmetric_key.data);
slapi_entry_add_value(e, KEY_ATTRIBUTE_NAME, key_value);
slapi_value_free(&key_value);
/* Store the entry */
Index: ldbm_config.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/ldbm_config.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- ldbm_config.c 19 Apr 2005 22:07:38 -0000 1.5
+++ ldbm_config.c 11 Apr 2006 02:14:45 -0000 1.6
@@ -1371,6 +1371,7 @@
void ldbm_config_get(void *arg, config_info *config, char *buf)
{
char *tmp_string;
+ size_t val = 0;
if (config == NULL) {
buf[0] = '\0';
@@ -1387,7 +1388,8 @@
sprintf(buf, "%ld", (long) config->config_get_fn(arg));
break;
case CONFIG_TYPE_SIZE_T:
- sprintf(buf, "%lu", (size_t) config->config_get_fn(arg));
+ val = (size_t) config->config_get_fn(arg);
+ sprintf(buf, "%lu", val);
break;
case CONFIG_TYPE_STRING:
/* Remember the get function for strings returns memory
Index: ldif2ldbm.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/ldif2ldbm.c,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- ldif2ldbm.c 16 Mar 2006 03:02:33 -0000 1.8
+++ ldif2ldbm.c 11 Apr 2006 02:14:45 -0000 1.9
@@ -1307,7 +1307,7 @@
if (NULL == inst) {
if (task) {
slapi_task_log_notice(task, "Unknown ldbm instance %s",
- instance_name, 0, 0);
+ instance_name);
}
LDAPDebug(LDAP_DEBUG_ANY, "Unknown ldbm instance %s\n",
instance_name, 0, 0);
@@ -2081,7 +2081,7 @@
{
time_t tm = time(0); /* long */
- char *tmpname = slapi_ch_smprintf("%s/%d", dest_dir, tm);
+ char *tmpname = slapi_ch_smprintf("%s/%ld", dest_dir, tm);
dest_dir = tmpname;
}
else /* not a directory */
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/slapd abandon.c, 1.4, 1.5 auth.c, 1.5, 1.6 csn.c, 1.4, 1.5 csngen.c, 1.5, 1.6 daemon.c, 1.7, 1.8 eventq.c, 1.4, 1.5 filter.c, 1.6, 1.7 log.c, 1.12, 1.13 proto-slap.h, 1.17, 1.18 resourcelimit.c, 1.4, 1.5 result.c, 1.6, 1.7 schema.c, 1.7, 1.8 slapi-plugin.h, 1.9, 1.10 slapi-private.h, 1.9, 1.10
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/slapd
Modified Files:
abandon.c auth.c csn.c csngen.c daemon.c eventq.c filter.c
log.c proto-slap.h resourcelimit.c result.c schema.c
slapi-plugin.h slapi-private.h
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: abandon.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/abandon.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- abandon.c 19 Apr 2005 22:07:36 -0000 1.4
+++ abandon.c 11 Apr 2006 02:14:44 -0000 1.5
@@ -158,7 +158,7 @@
pb->pb_conn->c_connid, pb->pb_op->o_opid, id );
} else {
slapi_log_access( LDAP_DEBUG_STATS, "conn=%d op=%d ABANDON"
- " targetop=%d msgid=%d nentries=%d etime=%d\n",
+ " targetop=%d msgid=%d nentries=%d etime=%ld\n",
pb->pb_conn->c_connid, pb->pb_op->o_opid, o->o_opid, id,
o->o_results.r.r_search.nentries, current_time() - o->o_time );
Index: auth.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/auth.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- auth.c 19 Apr 2005 22:07:36 -0000 1.5
+++ auth.c 11 Apr 2006 02:14:44 -0000 1.6
@@ -445,7 +445,7 @@
!= SECSuccess) {
PRErrorCode errorCode = PR_GetError();
slapi_log_access (LDAP_DEBUG_STATS,
- "conn=%d SSL failed to obtain cipher info; ",
+ "conn=%d SSL failed to obtain cipher info; "
SLAPI_COMPONENT_NAME_NSPR " error %i (%s)\n",
conn->c_connid, errorCode, slapd_pr_strerror(errorCode));
return;
Index: csn.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/csn.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- csn.c 19 Apr 2005 22:07:36 -0000 1.4
+++ csn.c 11 Apr 2006 02:14:44 -0000 1.5
@@ -372,11 +372,12 @@
int csn_increment_subsequence (CSN *csn)
{
+ PRUint16 maxsubseq = (PRUint16)0xFFFFFFFF;
if (csn == NULL)
{
return -1;
}
- else if (csn->subseqnum == 0xFFFFFFFF)
+ else if (csn->subseqnum == maxsubseq)
{
slapi_log_error(SLAPI_LOG_FATAL, NULL,
"csn_increment_subsequence: subsequence overflow\n");
Index: csngen.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/csngen.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- csngen.c 19 Apr 2005 22:07:36 -0000 1.5
+++ csngen.c 11 Apr 2006 02:14:44 -0000 1.6
@@ -338,8 +338,8 @@
else /* remote_offset > CSN_MAX_TIME_ADJUST */
{
slapi_log_error (SLAPI_LOG_FATAL, NULL, "csngen_adjust_time: "
- "adjustment limit exceeded; value - %d, limit - %d\n",
- remote_offset, CSN_MAX_TIME_ADJUST);
+ "adjustment limit exceeded; value - %ld, limit - %ld\n",
+ remote_offset, (long)CSN_MAX_TIME_ADJUST);
PR_RWLock_Unlock (gen->lock);
return CSN_LIMIT_EXCEEDED;
}
@@ -427,9 +427,9 @@
PR_RWLock_Rlock (gen->lock);
slapi_log_error(SLAPI_LOG_FATAL, NULL, "CSN generator's state:\n");
slapi_log_error(SLAPI_LOG_FATAL, NULL, "\treplica id: %d\n", gen->state.rid);
- slapi_log_error(SLAPI_LOG_FATAL, NULL, "\tsampled time: %d\n", gen->state.sampled_time);
- slapi_log_error(SLAPI_LOG_FATAL, NULL, "\tlocal offset: %d\n", gen->state.local_offset);
- slapi_log_error(SLAPI_LOG_FATAL, NULL, "\tremote offset: %d\n", gen->state.remote_offset);
+ slapi_log_error(SLAPI_LOG_FATAL, NULL, "\tsampled time: %ld\n", gen->state.sampled_time);
+ slapi_log_error(SLAPI_LOG_FATAL, NULL, "\tlocal offset: %ld\n", gen->state.local_offset);
+ slapi_log_error(SLAPI_LOG_FATAL, NULL, "\tremote offset: %ld\n", gen->state.remote_offset);
slapi_log_error(SLAPI_LOG_FATAL, NULL, "\tsequence number: %d\n", gen->state.seq_num);
PR_RWLock_Unlock (gen->lock);
}
Index: daemon.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/daemon.c,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- daemon.c 18 Nov 2005 21:07:38 -0000 1.7
+++ daemon.c 11 Apr 2006 02:14:44 -0000 1.8
@@ -2588,7 +2588,7 @@
if ( NULL == nspr_layer_fd ) {
slapi_log_error( SLAPI_LOG_FATAL, "configure_pr_socket",
"Unable to move socket file descriptor %d above %d:"
- " PR_GetIdentitiesLayer( 0x%x, PR_NSPR_IO_LAYER )"
+ " PR_GetIdentitiesLayer( %p, PR_NSPR_IO_LAYER )"
" failed\n", ns, reservedescriptors, *pr_socket );
close( newfd ); /* can't fix things up in NSPR -- close copy */
} else {
Index: eventq.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/eventq.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- eventq.c 19 Apr 2005 22:07:36 -0000 1.4
+++ eventq.c 11 Apr 2006 02:14:44 -0000 1.5
@@ -143,7 +143,7 @@
/* scheduling. Too bad */
slapi_log_error(SLAPI_LOG_HOUSE, NULL,
- "added one-time event id 0x%x at time %u\n",
+ "added one-time event id %p at time %ld\n",
id, when);
return(id);
}
@@ -175,7 +175,7 @@
tmp = eq_new(fn, arg, when, interval);
eq_enqueue(tmp);
slapi_log_error(SLAPI_LOG_HOUSE, NULL,
- "added repeating event id 0x%x at time %u, interval %u\n",
+ "added repeating event id %p at time %ld, interval %lu\n",
tmp->ec_id, when, interval);
return(tmp->ec_id);
}
@@ -212,7 +212,7 @@
PR_Unlock(eq->eq_lock);
}
slapi_log_error(SLAPI_LOG_HOUSE, NULL,
- "cancellation of event id 0x%x requested: %s\n",
+ "cancellation of event id %p requested: %s\n",
ctx, found ? "cancellation succeeded" : "event not found");
return found;
}
@@ -306,7 +306,7 @@
/* Call the scheduled function */
p->ec_fn(p->ec_when, p->ec_arg);
slapi_log_error(SLAPI_LOG_HOUSE, NULL,
- "Event id 0x%x called at %u (scheduled for %u)\n",
+ "Event id %p called at %ld (scheduled for %ld)\n",
p->ec_id, current_time(), p->ec_when);
if (0UL != p->ec_interval) {
/* This is a repeating event. Requeue it. */
Index: filter.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/filter.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- filter.c 23 Feb 2006 20:45:16 -0000 1.6
+++ filter.c 11 Apr 2006 02:14:44 -0000 1.7
@@ -100,14 +100,14 @@
logbuf = slapi_ch_malloc(logbufsize);
*logbuf = '\0';
slapi_log_error( SLAPI_LOG_FATAL, "get_filter", "before optimize: %s\n",
- slapi_filter_to_string(*filt, logbuf, logbufsize), 0, 0 );
+ slapi_filter_to_string(*filt, logbuf, logbufsize));
}
filter_optimize(*filt);
if (NULL != logbuf) {
slapi_log_error( SLAPI_LOG_FATAL, "get_filter", " after optimize: %s\n",
- slapi_filter_to_string(*filt, logbuf, logbufsize), 0, 0 );
+ slapi_filter_to_string(*filt, logbuf, logbufsize));
slapi_ch_free_string( &logbuf );
}
Index: log.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/log.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- log.c 19 Mar 2006 18:36:40 -0000 1.12
+++ log.c 11 Apr 2006 02:14:44 -0000 1.13
@@ -2269,7 +2269,7 @@
"LOGINFO:End of Log because size exceeded(Max:%d bytes) (Is:%d bytes)\n", maxlogsize, f_size, 0);
} else if ( type == LOG_EXPIRED) {
LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:End of Log because time exceeded(Max:%d secs) (Is:%d secs)\n",
+ "LOGINFO:End of Log because time exceeded(Max:%d secs) (Is:%ld secs)\n",
rotationtime_secs, curr_time - log_createtime,0);
}
}
Index: proto-slap.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/proto-slap.h,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -r1.17 -r1.18
--- proto-slap.h 18 Mar 2006 17:57:39 -0000 1.17
+++ proto-slap.h 11 Apr 2006 02:14:44 -0000 1.18
@@ -557,7 +557,13 @@
* log.c
*/
int slapd_log_error_proc( char *subsystem, char *fmt, ... );
-int slapi_log_access( int level, char *fmt, ... );
+
+int slapi_log_access( int level, char *fmt, ... )
+#ifdef __GNUC__
+ __attribute__ ((format (printf, 2, 3)));
+#else
+ ;
+#endif
int slapd_log_audit_proc(char *buffer, int buf_len);
void log_access_flush();
Index: resourcelimit.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/resourcelimit.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- resourcelimit.c 19 Apr 2005 22:07:37 -0000 1.4
+++ resourcelimit.c 11 Apr 2006 02:14:44 -0000 1.5
@@ -474,7 +474,7 @@
if ( slapi_valueset_next_value( vs, index, &v ) != -1 ) {
char ebuf[ BUFSIZ ];
slapi_log_error( SLAPI_LOG_FATAL, SLAPI_RESLIMIT_MODULE,
- "%s: ignoring multiple values for %s in entry \n",
+ "%s: ignoring multiple values for %s in entry %s\n",
fnname, reslimit_map[ i ].rlmap_at,
escape_string( slapi_entry_get_dn_const( e ),
ebuf ));
Index: result.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/result.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- result.c 19 Apr 2005 22:07:37 -0000 1.6
+++ result.c 11 Apr 2006 02:14:44 -0000 1.7
@@ -1696,7 +1696,7 @@
{
slapi_log_access( LDAP_DEBUG_STATS,
"conn=%d op=%d RESULT err=%d"
- " tag=%d nentries=%d etime=%s%s%s"
+ " tag=%lu nentries=%d etime=%s%s%s"
", SASL bind in progress\n",
op->o_connid,
op->o_opid,
@@ -1708,7 +1708,7 @@
{
slapi_log_access( LDAP_DEBUG_ARGS,
"conn=%s op=%d RESULT err=%d"
- " tag=%d nentries=%d etime=%s%s%s"
+ " tag=%lu nentries=%d etime=%s%s%s"
", SASL bind in progress\n",
LOG_INTERNAL_OP_CON_ID,
LOG_INTERNAL_OP_OP_ID,
@@ -1728,7 +1728,7 @@
{
slapi_log_access( LDAP_DEBUG_STATS,
"conn=%d op=%d RESULT err=%d"
- " tag=%d nentries=%d etime=%s%s%s"
+ " tag=%lu nentries=%d etime=%s%s%s"
" dn=\"%s\"\n",
op->o_connid,
op->o_opid,
@@ -1740,7 +1740,7 @@
{
slapi_log_access( LDAP_DEBUG_ARGS,
"conn=%s op=%d RESULT err=%d"
- " tag=%d nentries=%d etime=%s%s%s"
+ " tag=%lu nentries=%d etime=%s%s%s"
" dn=\"%s\"\n",
LOG_INTERNAL_OP_CON_ID,
LOG_INTERNAL_OP_OP_ID,
@@ -1754,7 +1754,7 @@
{
slapi_log_access( LDAP_DEBUG_STATS,
"conn=%d op=%d RESULT err=%d"
- " tag=%d nentries=%d etime=%s%s%s\n",
+ " tag=%lu nentries=%d etime=%s%s%s\n",
op->o_connid,
op->o_opid,
err, tag, nentries,
@@ -1765,7 +1765,7 @@
{
slapi_log_access( LDAP_DEBUG_ARGS,
"conn=%s op=%d RESULT err=%d"
- " tag=%d nentries=%d etime=%s%s%s\n",
+ " tag=%lu nentries=%d etime=%s%s%s\n",
LOG_INTERNAL_OP_CON_ID,
LOG_INTERNAL_OP_OP_ID,
err, tag, nentries,
Index: schema.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/schema.c,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- schema.c 19 Apr 2005 22:07:37 -0000 1.7
+++ schema.c 11 Apr 2006 02:14:44 -0000 1.8
@@ -151,7 +151,13 @@
const char *ignorestr );
static PRBool schema_type_is_interesting( const char *type );
static void schema_create_errormsg( char *errorbuf, size_t errorbufsize,
- const char *prefix, const char *name, const char *fmt, ... );
+ const char *prefix, const char *name, const char *fmt, ... )
+#ifdef __GNUC__
+ __attribute__ ((format (printf, 5, 6)));
+#else
+ ;
+#endif
+
/* Some utility functions for dealing with a dynamic buffer */
@@ -4066,7 +4072,7 @@
{
slapi_log_error(SLAPI_LOG_FATAL, "schema", "Could not add"
" attribute type \"objectClass\" to the schema: %s\n",
- errorbuf, 0, 0);
+ errorbuf);
}
rc = dse_read_file(pschemadse, &pb);
Index: slapi-plugin.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slapi-plugin.h,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- slapi-plugin.h 23 Feb 2006 20:47:59 -0000 1.9
+++ slapi-plugin.h 11 Apr 2006 02:14:44 -0000 1.10
@@ -850,7 +850,12 @@
struct berval* slapi_ch_bvdup(const struct berval*);
struct berval** slapi_ch_bvecdup(struct berval**);
void slapi_ch_bvfree(struct berval** v);
-char * slapi_ch_smprintf(const char *fmt, ...);
+char * slapi_ch_smprintf(const char *fmt, ...)
+#ifdef __GNUC__
+ __attribute__ ((format (printf, 1, 2)));
+#else
+ ;
+#endif
/*
* syntax plugin routines
Index: slapi-private.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slapi-private.h,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- slapi-private.h 12 Aug 2005 05:49:54 -0000 1.9
+++ slapi-private.h 11 Apr 2006 02:14:44 -0000 1.10
@@ -1211,8 +1211,19 @@
int slapi_task_register_handler(const char *name, dseCallbackFn func);
void slapi_task_status_changed(Slapi_Task *task);
-void slapi_task_log_status(Slapi_Task *task, char *format, ...);
-void slapi_task_log_notice(Slapi_Task *task, char *format, ...);
+void slapi_task_log_status(Slapi_Task *task, char *format, ...)
+#ifdef __GNUC__
+ __attribute__ ((format (printf, 2, 3)));
+#else
+ ;
+#endif
+
+void slapi_task_log_notice(Slapi_Task *task, char *format, ...)
+#ifdef __GNUC__
+ __attribute__ ((format (printf, 2, 3)));
+#else
+ ;
+#endif
/* End of interface to support online tasks **********************************/
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/syntaxes dllmain.c, 1.4, 1.5
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/syntaxes
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/syntaxes
Modified Files:
dllmain.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: dllmain.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/syntaxes/dllmain.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- dllmain.c 19 Apr 2005 22:07:35 -0000 1.4
+++ dllmain.c 11 Apr 2006 02:14:43 -0000 1.5
@@ -141,6 +141,7 @@
va_list ap;
va_start (ap, fmt);
_snprintf (debugBuf, sizeof(debugBuf), fmt, ap);
+ debugBuf[sizeof(debugBuf)-1] = 0;
va_end (ap);
OutputDebugString (debugBuf);
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/replication cl5_api.c, 1.9, 1.10 repl.h, 1.5, 1.6 repl5_inc_protocol.c, 1.8, 1.9 repl5_replica.c, 1.12, 1.13 repl5_tot_protocol.c, 1.7, 1.8 windows_connection.c, 1.13, 1.14 windows_inc_protocol.c, 1.11, 1.12 windows_private.c, 1.10, 1.11 windows_protocol_util.c, 1.25, 1.26
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/replication
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/replication
Modified Files:
cl5_api.c repl.h repl5_inc_protocol.c repl5_replica.c
repl5_tot_protocol.c windows_connection.c
windows_inc_protocol.c windows_private.c
windows_protocol_util.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: cl5_api.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/cl5_api.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- cl5_api.c 19 Apr 2005 22:07:32 -0000 1.9
+++ cl5_api.c 11 Apr 2006 02:14:42 -0000 1.10
@@ -51,6 +51,7 @@
#include "cl5_api.h"
#include "plhash.h"
+#include "plstr.h"
#include "db.h"
#include "cl5_clcache.h" /* To use the Changelog Cache */
@@ -2124,7 +2125,7 @@
}
/* directory does not exist - try to create */
- strncpy (buff, dirName, MAXPATHLEN);
+ PL_strncpyz (buff, dirName, sizeof(buff)-1);
t = strchr (buff, '/');
/* skip first slash */
Index: repl.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl.h,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- repl.h 19 Apr 2005 22:07:32 -0000 1.5
+++ repl.h 11 Apr 2006 02:14:42 -0000 1.6
@@ -61,10 +61,9 @@
} schedule_item;
/* XXXggood - copied from slap.h - bad */
-#if defined( XP_WIN32 )
+/* XXXrichm - copied to match definition in slap.h - 20060406 */
+#ifndef NO_TIME
#define NO_TIME (time_t)0 /* cannot be -1, NT's localtime( -1 ) returns NULL */
-#else
-#define NO_TIME (time_t)-1 /* a value that time() does not return */
#endif
/*
Index: repl5_inc_protocol.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl5_inc_protocol.c,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- repl5_inc_protocol.c 4 May 2005 23:58:51 -0000 1.8
+++ repl5_inc_protocol.c 11 Apr 2006 02:14:42 -0000 1.9
@@ -242,6 +242,7 @@
return conres;
}
+#if NEEDED_FOR_DEBUGGING
static void
repl5_inc_log_operation_failure(int operation_code, int ldap_error, char* ldap_error_string, const char *agreement_name)
{
@@ -253,12 +254,12 @@
ldap_error, ldap_error_string ? ldap_error_string : "NULL",
op_string ? op_string : "NULL");
}
+#endif
/* Thread that collects results from async operations sent to the consumer */
static void repl5_inc_result_threadmain(void *param)
{
result_data *rd = (result_data*) param;
- int res = 0;
ConnResult conres = 0;
Repl_Connection *conn = rd->prp->conn;
int finished = 0;
@@ -384,7 +385,6 @@
static void
repl5_inc_rd_list_destroy(repl5_inc_operation *op)
{
- repl5_inc_operation *cur = op;
while (op) {
repl5_inc_operation *next = op->next;
repl5_inc_op_free(op);
@@ -689,7 +689,7 @@
/* just ignore it and go to sleep */
protocol_sleep(prp, PR_INTERVAL_NO_TIMEOUT);
}
- else if (e1 = event_occurred(prp, EVENT_WINDOW_CLOSED) ||
+ else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) ||
event_occurred(prp, EVENT_BACKOFF_EXPIRED))
{
/* this events - should not occur - log a warning and go to sleep */
@@ -748,7 +748,7 @@
next_state = STATE_READY_TO_ACQUIRE;
wait_change_timer_set = 0;
}
- else if (e1 = event_occurred(prp, EVENT_WINDOW_OPENED) ||
+ else if ((e1 = event_occurred(prp, EVENT_WINDOW_OPENED)) ||
event_occurred(prp, EVENT_BACKOFF_EXPIRED))
{
/* this events - should not occur - log a warning and clear the event */
@@ -849,7 +849,7 @@
{
/* consume and ignore */
}
- else if (e1 = event_occurred (prp, EVENT_WINDOW_OPENED) ||
+ else if ((e1 = event_occurred (prp, EVENT_WINDOW_OPENED)) ||
event_occurred (prp, EVENT_BACKOFF_EXPIRED))
{
/* This should never happen */
Index: repl5_replica.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl5_replica.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- repl5_replica.c 15 Feb 2006 22:54:07 -0000 1.12
+++ repl5_replica.c 11 Apr 2006 02:14:43 -0000 1.13
@@ -1539,7 +1539,7 @@
PR_ASSERT (r);
if (r->repl_root == NULL || r->repl_type == 0 || r->repl_rid == 0 ||
- r->repl_rid > MAX_REPLICA_ID || r->repl_csngen == NULL || r->repl_name == NULL)
+ r->repl_csngen == NULL || r->repl_name == NULL)
{
return -1;
}
Index: repl5_tot_protocol.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl5_tot_protocol.c,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- repl5_tot_protocol.c 19 Apr 2005 22:07:32 -0000 1.7
+++ repl5_tot_protocol.c 11 Apr 2006 02:14:43 -0000 1.8
@@ -125,7 +125,6 @@
static void repl5_tot_result_threadmain(void *param)
{
callback_data *cb = (callback_data*) param;
- int res = 0;
ConnResult conres = 0;
Repl_Connection *conn = cb->prp->conn;
int finished = 0;
Index: windows_connection.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/windows_connection.c,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- windows_connection.c 20 Feb 2006 19:36:24 -0000 1.13
+++ windows_connection.c 11 Apr 2006 02:14:43 -0000 1.14
@@ -665,8 +665,6 @@
const char* old_dn = NULL;
char* dn = NULL;
- int i=0;
- int num_comp=0;
LDAPDebug( LDAP_DEBUG_TRACE, "=> send_dirsync_search\n", 0, 0, 0 );
@@ -810,13 +808,10 @@
Slapi_Entry * windows_conn_get_search_result(Repl_Connection *conn)
{
int rc=0;
- int matches=0;
LDAPMessage *res = NULL;
Slapi_Entry *e = NULL;
LDAPMessage *lm = NULL;
- char *a = "";
char *dn = "";
- BerElement *ber = NULL;
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_conn_get_search_result\n", 0, 0, 0 );
Index: windows_inc_protocol.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/windows_inc_protocol.c,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- windows_inc_protocol.c 6 May 2005 03:33:36 -0000 1.11
+++ windows_inc_protocol.c 11 Apr 2006 02:14:43 -0000 1.12
@@ -386,7 +386,7 @@
/* just ignore it and go to sleep */
protocol_sleep(prp, PR_INTERVAL_NO_TIMEOUT);
}
- else if (e1 = event_occurred(prp, EVENT_WINDOW_CLOSED) ||
+ else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) ||
event_occurred(prp, EVENT_BACKOFF_EXPIRED))
{
/* this events - should not occur - log a warning and go to sleep */
@@ -458,7 +458,7 @@
next_state = STATE_READY_TO_ACQUIRE;
wait_change_timer_set = 0;
}
- else if (e1 = event_occurred(prp, EVENT_WINDOW_OPENED) ||
+ else if ((e1 = event_occurred(prp, EVENT_WINDOW_OPENED)) ||
event_occurred(prp, EVENT_BACKOFF_EXPIRED))
{
/* this events - should not occur - log a warning and clear the event */
@@ -570,7 +570,7 @@
{
/* consume and ignore */
}
- else if (e1 = event_occurred (prp, EVENT_WINDOW_OPENED) ||
+ else if ((e1 = event_occurred (prp, EVENT_WINDOW_OPENED)) ||
event_occurred (prp, EVENT_BACKOFF_EXPIRED))
{
/* This should never happen */
Index: windows_private.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/windows_private.c,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- windows_private.c 16 May 2005 22:26:25 -0000 1.10
+++ windows_private.c 11 Apr 2006 02:14:43 -0000 1.11
@@ -423,7 +423,6 @@
{
LDAPControl *control = NULL;
- LDAPControl **lc = &control ;
BerElement *ber;
Dirsync_Private *dp;
@@ -498,7 +497,7 @@
goto choke;
}
- slapi_ch_free(&dp->dirsync_cookie);
+ slapi_ch_free_string(&dp->dirsync_cookie);
dp->dirsync_cookie = ( char* ) slapi_ch_malloc(serverCookie->bv_len + 1);
memcpy(dp->dirsync_cookie, serverCookie->bv_val, serverCookie->bv_len);
@@ -548,7 +547,7 @@
PR_ASSERT (dp);
dp->dirsync_cookie_len = 0;
- slapi_ch_free(&dp->dirsync_cookie);
+ slapi_ch_free_string(&dp->dirsync_cookie);
dp->dirsync_cookie = NULL;
LDAPDebug( LDAP_DEBUG_TRACE, "<= windows_private_null_dirsync_control\n", 0, 0, 0 );
@@ -630,7 +629,6 @@
Slapi_DN* sdn = NULL;
int rc = 0;
Slapi_Entry *entry = NULL;
- char* cookie = NULL;
Slapi_Attr *attr = NULL;
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_private_load_dirsync_cookie\n", 0, 0, 0 );
@@ -658,7 +656,7 @@
if (vals)
{
dp->dirsync_cookie_len = (int) (vals[0])->bv_len;
- slapi_ch_free(&dp->dirsync_cookie);
+ slapi_ch_free_string(&dp->dirsync_cookie);
dp->dirsync_cookie = ( char* ) slapi_ch_malloc(dp->dirsync_cookie_len + 1);
memcpy(dp->dirsync_cookie,(vals[0]->bv_val), (vals[0])->bv_len+1);
Index: windows_protocol_util.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/windows_protocol_util.c,v
retrieving revision 1.25
retrieving revision 1.26
diff -u -r1.25 -r1.26
--- windows_protocol_util.c 20 Mar 2006 17:47:16 -0000 1.25
+++ windows_protocol_util.c 11 Apr 2006 02:14:43 -0000 1.26
@@ -64,12 +64,12 @@
static int windows_create_remote_entry(Private_Repl_Protocol *prp,Slapi_Entry *original_entry, Slapi_DN *remote_sdn, Slapi_Entry **remote_entry, char** password);
static int windows_get_local_entry(const Slapi_DN* local_dn,Slapi_Entry **local_entry);
static int windows_get_local_entry_by_uniqueid(Private_Repl_Protocol *prp,const char* uniqueid,Slapi_Entry **local_entry);
-static int map_entry_dn_outbound(Slapi_Entry *e, const Slapi_DN **dn, Private_Repl_Protocol *prp, int *missing_entry, int want_guid);
+static int map_entry_dn_outbound(Slapi_Entry *e, Slapi_DN **dn, Private_Repl_Protocol *prp, int *missing_entry, int want_guid);
static char* extract_ntuserdomainid_from_entry(Slapi_Entry *e);
static int windows_get_remote_entry (Private_Repl_Protocol *prp, const Slapi_DN* remote_dn,Slapi_Entry **remote_entry);
static const char* op2string (int op);
static int is_subject_of_agreemeent_remote(Slapi_Entry *e, const Repl_Agmt *ra);
-static int map_entry_dn_inbound(Slapi_Entry *e, const Slapi_DN **dn, const Repl_Agmt *ra);
+static int map_entry_dn_inbound(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra);
static int windows_update_remote_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,Slapi_Entry *local_entry);
@@ -678,12 +678,6 @@
void
windows_release_replica(Private_Repl_Protocol *prp)
{
-
- struct berval *retdata = NULL;
- char *retoid = NULL;
- struct berval *payload = NULL;
- Slapi_DN *replarea_sdn = NULL;
-
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_release_replica\n", 0, 0, 0 );
PR_ASSERT(NULL != prp);
@@ -1248,14 +1242,12 @@
int retval = 0;
char *entry_string = NULL;
Slapi_Entry *new_entry = NULL;
- Slapi_PBlock* pb = NULL;
int rc = 0;
int is_user = 0;
int is_group = 0;
Slapi_Attr *attr = NULL;
char *username = NULL;
const char *dn_string = NULL;
- char *remote_entry_template = NULL;
char *fqusername = NULL;
const char *domain_name = windows_private_get_windows_domain(prp->agmt);
int is_nt4 = windows_private_get_isnt4(prp->agmt);
@@ -1309,7 +1301,6 @@
for (rc = slapi_entry_first_attr(original_entry, &attr); rc == 0;
rc = slapi_entry_next_attr(original_entry, attr, &attr))
{
- Slapi_Value *value = NULL;
char *type = NULL;
Slapi_ValueSet *vs = NULL;
int mapdn = 0;
@@ -1449,7 +1440,6 @@
Slapi_Mods smods = {0};
Slapi_Mods mapped_smods = {0};
LDAPMod *mod = NULL;
- int i=0;
int is_nt4 = windows_private_get_isnt4(prp->agmt);
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_map_mods_for_replay\n", 0, 0, 0 );
@@ -1944,7 +1934,7 @@
/* Given a non-tombstone entry, return the DN of its peer in AD (whether present or not) */
static int
-map_entry_dn_outbound(Slapi_Entry *e, const Slapi_DN **dn, Private_Repl_Protocol *prp, int *missing_entry, int guid_form)
+map_entry_dn_outbound(Slapi_Entry *e, Slapi_DN **dn, Private_Repl_Protocol *prp, int *missing_entry, int guid_form)
{
int retval = 0;
char *guid = NULL;
@@ -2048,7 +2038,7 @@
/* Given a tombstone entry, return the DN of its peer in this server (if present) */
static int
-map_tombstone_dn_inbound(Slapi_Entry *e, const Slapi_DN **dn, const Repl_Agmt *ra)
+map_tombstone_dn_inbound(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra)
{
int retval = 0;
Slapi_DN *new_dn = NULL;
@@ -2106,7 +2096,7 @@
/* Given a non-tombstone entry, return the DN of its peer in this server (whether present or not) */
static int
-map_entry_dn_inbound(Slapi_Entry *e, const Slapi_DN **dn, const Repl_Agmt *ra)
+map_entry_dn_inbound(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra)
{
int retval = 0;
Slapi_DN *new_dn = NULL;
@@ -2366,7 +2356,6 @@
for (rc = slapi_entry_first_attr(remote_entry, &attr); rc == 0;
rc = slapi_entry_next_attr(remote_entry, attr, &attr))
{
- Slapi_Value *value = NULL;
char *type = NULL;
Slapi_ValueSet *vs = NULL;
int mapdn = 0;
@@ -2517,7 +2506,6 @@
rc = slapi_entry_next_attr(remote_entry, attr, &attr))
{
int is_present_local = 0;
- Slapi_Value *value = NULL;
char *type = NULL;
Slapi_ValueSet *vs = NULL;
char *local_type = NULL;
@@ -2723,7 +2711,6 @@
{
Slapi_Mods smods = {0};
int retval = 0;
- int rc = 0;
Slapi_PBlock *pb = NULL;
int do_modify = 0;
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/presence presence.c, 1.4, 1.5
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/presence
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/presence
Modified Files:
presence.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: presence.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/presence/presence.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- presence.c 19 Apr 2005 22:07:31 -0000 1.4
+++ presence.c 11 Apr 2006 02:14:42 -0000 1.5
@@ -61,7 +61,13 @@
/*** from proto-slap.h ***/
-int slapd_log_error_proc( char *subsystem, char *fmt, ... );
+int slapd_log_error_proc( char *subsystem, char *fmt, ... )
+#ifdef __GNUC__
+ __attribute__ ((format (printf, 2, 3)));
+#else
+ ;
+#endif
+
/*** from ldaplog.h ***/
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/passthru ptdllmain.c, 1.4, 1.5
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/passthru
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/passthru
Modified Files:
ptdllmain.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: ptdllmain.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/passthru/ptdllmain.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- ptdllmain.c 19 Apr 2005 22:07:31 -0000 1.4
+++ ptdllmain.c 11 Apr 2006 02:14:41 -0000 1.5
@@ -139,6 +139,7 @@
va_list ap;
va_start (ap, fmt);
_snprintf (debugBuf, sizeof(debugBuf), fmt, ap);
+ debugBuf[sizeof(debugBuf)-1] = 0;
va_end (ap);
OutputDebugString (debugBuf);
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/pam_passthru pam_ptdllmain.c, 1.4, 1.5
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/pam_passthru
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/pam_passthru
Modified Files:
pam_ptdllmain.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: pam_ptdllmain.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/pam_passthru/pam_ptdllmain.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- pam_ptdllmain.c 19 Apr 2005 22:07:30 -0000 1.4
+++ pam_ptdllmain.c 11 Apr 2006 02:14:41 -0000 1.5
@@ -138,6 +138,7 @@
va_list ap;
va_start (ap, fmt);
_snprintf (debugBuf, sizeof(debugBuf), fmt, ap);
+ debugBuf[sizeof(debugBuf)-1] = 0;
va_end (ap);
OutputDebugString (debugBuf);
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/http http_impl.c, 1.7, 1.8
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/http
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/http
Modified Files:
http_impl.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: http_impl.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/http/http_impl.c,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- http_impl.c 19 Apr 2005 22:07:30 -0000 1.7
+++ http_impl.c 11 Apr 2006 02:14:40 -0000 1.8
@@ -62,6 +62,7 @@
/*** from proto-slap.h ***/
int slapd_log_error_proc( char *subsystem, char *fmt, ... );
+
char *config_get_instancedir();
/*** from ldaplog.h ***/
@@ -965,11 +966,11 @@
{
PRStatus status = PR_SUCCESS;
char *dir = "%s%s";
- *path = (char *)PR_Calloc(1, (strlen(dir) + 1024));
+ *path = (char *)PR_Calloc(1, strlen(dir) + strlen(url) + 2);
/* Just write the path and check for a starting / */
if ('/' != *url) {
- PR_sscanf(*path, dir, "/", url);
+ sprintf(*path, dir, "/", url);
} else {
strcpy(*path, url);
}
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/collation dllmain.c, 1.4, 1.5
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/collation
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/collation
Modified Files:
dllmain.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: dllmain.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/collation/dllmain.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- dllmain.c 19 Apr 2005 22:07:29 -0000 1.4
+++ dllmain.c 11 Apr 2006 02:14:39 -0000 1.5
@@ -139,6 +139,7 @@
va_list ap;
va_start (ap, fmt);
_snprintf (debugBuf, sizeof(debugBuf), fmt, ap);
+ debugBuf[sizeof(debugBuf)-1] = 0;
va_end (ap);
OutputDebugString (debugBuf);
18 years
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/chainingdb cb_instance.c, 1.5, 1.6 cb_monitor.c, 1.4, 1.5
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/chainingdb
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8136/ldapserver/ldap/servers/plugins/chainingdb
Modified Files:
cb_instance.c cb_monitor.c
Log Message:
Bug(s) fixed: 186280
Bug Description: ldapserver: Close potential security vulnerabilities in CGI code
Reviewed by: Nathan, Noriko, and Pete (Thanks!)
Fix Description: Clean up usage of sprintf, strcpy, fgets instead of
gets, fixed buffer usage, etc., mostly in the CGI code and other user
facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick
to force it to check printf style varargs functions, to check the format
string against the argument string, for type mismatches, missing
arguments, and too many arguments.
In the CGI form argument parsing code, we needed to be more careful
about checking for bad input - good input is supposed to look like this:
name=value&name=value&.....
&name=value. I don't think the original code
was checking properly for something like name&name=value.
There was another place where we were not checking to see if a buffer
had enough room before appending a string to it.
I had to change a couple of functions to allow passing in the size of
the buffer.
Fixed some issues raised by Noriko and Nathan.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: cb_instance.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/chainingdb/cb_instance.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- cb_instance.c 19 Apr 2005 22:07:29 -0000 1.5
+++ cb_instance.c 11 Apr 2006 02:14:39 -0000 1.6
@@ -1436,7 +1436,7 @@
sprintf(buf, "%o", (int) config->config_get_fn(arg));
break;
case CB_CONFIG_TYPE_LONG:
- sprintf(buf, "%d", (long) config->config_get_fn(arg));
+ sprintf(buf, "%ld", (long) config->config_get_fn(arg));
break;
case CB_CONFIG_TYPE_STRING:
/* Remember the get function for strings returns memory
Index: cb_monitor.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/chainingdb/cb_monitor.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- cb_monitor.c 19 Apr 2005 22:07:29 -0000 1.4
+++ cb_monitor.c 11 Apr 2006 02:14:39 -0000 1.5
@@ -76,9 +76,9 @@
char buf[CB_BUFSIZE];
struct berval val;
struct berval *vals[2];
- int deletecount,addcount,modifycount,modrdncount,searchbasecount,searchonelevelcount;
- int searchsubtreecount,abandoncount,bindcount,unbindcount,comparecount;
- int outgoingconn, outgoingbindconn;
+ unsigned long deletecount,addcount,modifycount,modrdncount,searchbasecount,searchonelevelcount;
+ unsigned long searchsubtreecount,abandoncount,bindcount,unbindcount,comparecount;
+ unsigned int outgoingconn, outgoingbindconn;
cb_backend_instance *inst = (cb_backend_instance *)arg;
/* First make sure the backend instance is configured */
@@ -178,12 +178,12 @@
val.bv_len = strlen( buf );
slapi_entry_attr_replace( e, CB_MONITOR_COMPARECOUNT, ( struct berval **)vals );
- sprintf( buf, "%d", outgoingconn );
+ sprintf( buf, "%u", outgoingconn );
val.bv_val = buf;
val.bv_len = strlen( buf );
slapi_entry_attr_replace( e, CB_MONITOR_OUTGOINGCONN, ( struct berval **)vals );
- sprintf( buf, "%d", outgoingbindconn );
+ sprintf( buf, "%u", outgoingbindconn );
val.bv_val = buf;
val.bv_len = strlen( buf );
slapi_entry_attr_replace( e, CB_MONITOR_OUTGOINGBINDCOUNT, ( struct berval **)vals );
18 years