ldap/servers/plugins/referint/referint.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
New commits:
commit 614b7bb50480e3edee881e544a6c0305d20b78a9
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Dec 13 10:14:41 2013 -0500
Ticket 47603 - should not modify pre op entry during config validation
Description: Modifying the preop entry directly can cause crashing in some cases.
Make a copy of the preop entry when appling the mods for config
validation.
https://fedorahosted.org/389/ticket/47603
Reviewed by: rmeggins(Thanks!)
diff --git a/ldap/servers/plugins/referint/referint.c
b/ldap/servers/plugins/referint/referint.c
index 013ffa3..6576c88 100644
--- a/ldap/servers/plugins/referint/referint.c
+++ b/ldap/servers/plugins/referint/referint.c
@@ -1669,6 +1669,7 @@ referint_validate_config(Slapi_PBlock *pb)
{
Slapi_Entry *config_e = NULL, *e = NULL;
Slapi_Entry *pre_entry = NULL;
+ Slapi_Entry *resulting_entry = NULL;
Slapi_DN *config_sdn = NULL;
Slapi_DN *sdn = NULL;
Slapi_Mods *smods = NULL;
@@ -1687,14 +1688,17 @@ referint_validate_config(Slapi_PBlock *pb)
slapi_pblock_get(pb, SLAPI_MODIFY_MODS, &mods);
smods = slapi_mods_new();
slapi_mods_init_byref(smods, mods);
-
- /* Apply the mods to create the resulting entry. */
- if (mods && (slapi_entry_apply_mods(pre_entry, mods) != LDAP_SUCCESS)) {
+ /*
+ * Create a copy of the entry and apply the
+ * mods to create the resulting entry.
+ */
+ resulting_entry = slapi_entry_dup(pre_entry);
+ if (mods && (slapi_entry_apply_mods(resulting_entry, mods) !=
LDAP_SUCCESS)) {
/* we don't care about this, the update is invalid and will be caught
later */
goto bail;
}
- if ( SLAPI_PLUGIN_FAILURE == load_config(pb, pre_entry, 0)) {
+ if ( SLAPI_PLUGIN_FAILURE == load_config(pb, resulting_entry, 0)) {
slapi_log_error( SLAPI_LOG_FATAL, REFERINT_PLUGIN_SUBSYSTEM,
"referint_validate_config: "
"configuration validation failed.\n");
rc = LDAP_UNWILLING_TO_PERFORM;
@@ -1709,12 +1713,13 @@ referint_validate_config(Slapi_PBlock *pb)
slapi_mods_init_byref(smods, mods);
/* Apply the mods to create the resulting entry. */
- if (mods && (slapi_entry_apply_mods(pre_entry, mods) != LDAP_SUCCESS))
{
+ resulting_entry = slapi_entry_dup(pre_entry);
+ if (mods && (slapi_entry_apply_mods(resulting_entry, mods) !=
LDAP_SUCCESS)) {
/* we don't care about this, the update is invalid and will be caught
later */
goto bail;
}
- if((config_area = slapi_entry_attr_get_charptr(pre_entry,
SLAPI_PLUGIN_SHARED_CONFIG_AREA))){
+ if((config_area = slapi_entry_attr_get_charptr(resulting_entry,
SLAPI_PLUGIN_SHARED_CONFIG_AREA))){
rc = slapi_dn_syntax_check(pb, config_area, 1);
if (rc) { /* syntax check failed */
slapi_log_error( SLAPI_LOG_FATAL, REFERINT_PLUGIN_SUBSYSTEM,
"referint_validate_config: "
@@ -1743,7 +1748,7 @@ referint_validate_config(Slapi_PBlock *pb)
}
}
} else {
- config_e = pre_entry;
+ config_e = resulting_entry;
}
if(load_config(pb, config_e, 0) != LDAP_SUCCESS){
rc = LDAP_UNWILLING_TO_PERFORM;
@@ -1754,6 +1759,7 @@ referint_validate_config(Slapi_PBlock *pb)
bail:
slapi_entry_free(e);
+ slapi_entry_free(resulting_entry);
slapi_sdn_free(&config_sdn);
slapi_ch_free_string(&config_area);
slapi_mods_free(&smods);