ldap/servers/plugins/acl/aclparse.c | 4 ++++
1 file changed, 4 insertions(+)
New commits:
commit 91c6799b07ca48bce85482136ceb244b484fc91b
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Aug 24 13:13:35 2011 -0600
Bug 733103 - large targetattr list with syntax errors cause server to crash or hang
https://bugzilla.redhat.com/show_bug.cgi?id=733103
Resolves: bug 733103
Bug Description: large targetattr list with syntax errors cause server to crash or
hang
Reviewed by: nhosoi (Thanks!)
Branch: master
Fix Description: If we need to realloc the list to hold more target attributes,
the list is not NULL terminated. If there are syntax errors in the aci, the
function returns with an unterminated list, and this will either cause the
loop in the free code to go off the end of the list or crash with a segfault.
The fix is to make sure the list is always NULL terminated.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index 014df1b..a137db9 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -1447,6 +1447,10 @@ __aclp__init_targetattr (aci_t *aci, char *attr_val, char
**errbuf)
}
slapi_ch_free_string(&errstr);
slapi_ch_free((void **)&attr);
+ /* NULL terminate the list - the realloc below does not NULL terminate
+ the list, and the list is normally only NULL terminated when the
+ function returns with success */
+ attrArray[numattr] = NULL;
return ACL_SYNTAX_ERR;
}
}