ldap/servers/plugins/automember/automember.c | 5 ++
ldap/servers/plugins/chainingdb/cb_bind.c | 64 ++++++++++++++-------------
ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c | 38 ++++++++--------
ldap/servers/slapd/dn.c | 4 +
ldap/servers/slapd/opshared.c | 1
5 files changed, 62 insertions(+), 50 deletions(-)
New commits:
commit 9a7c2da4a9117d0f03dbcfe2895961c80b99f4f6
Author: Noriko Hosoi <nhosoi(a)jiji.usersys.redhat.com>
Date: Thu Nov 3 11:32:52 2011 -0700
Bug 750625 - Fix Coverity (12196) Dereference before null check
https://bugzilla.redhat.com/show_bug.cgi?id=750625
slapd/back-ldbm/ldbm_entryrdn.c (entryrdn_lookup_dn)
Bug Description: Dreferencing "db" before a null check.
Fix Description: Adding a check if the variable "db" returned
from _entryrdn_open_index is NULL or not. If NULL, it returns
or goto bail there.
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c
b/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c
index 1573f1f..2b9115a 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c
@@ -205,7 +205,7 @@ entryrdn_index_entry(backend *be,
int flags, /* BE_INDEX_ADD or BE_INDEX_DEL */
back_txn *txn)
{
- int rc = 0;
+ int rc = -1;
struct attrinfo *ai = NULL;
DB *db = NULL;
DBC *cursor = NULL;
@@ -219,12 +219,11 @@ entryrdn_index_entry(backend *be,
slapi_log_error(SLAPI_LOG_FATAL, ENTRYRDN_TAG,
"entryrdn_index_entry: Param error: Empty %s\n",
NULL==be?"backend":NULL==e?"entry":"unknown");
- rc = -1;
- goto bail;
+ return rc;
}
/* Open the entryrdn index */
rc = _entryrdn_open_index(be, &ai, &db);
- if (rc) {
+ if (rc || (NULL == db)) {
slapi_log_error(SLAPI_LOG_FATAL, ENTRYRDN_TAG,
"entryrdn_index_entry: Opening the index failed: "
"%s(%d)\n",
@@ -347,11 +346,12 @@ entryrdn_index_read(backend *be,
/* Open the entryrdn index */
rc = _entryrdn_open_index(be, &ai, &db);
- if (rc) {
+ if (rc || (NULL == db)) {
slapi_log_error(SLAPI_LOG_FATAL, ENTRYRDN_TAG,
"entryrdn_index_read: Opening the index failed: "
"%s(%d)\n",
rc<0?dblayer_strerror(rc):"Invalid parameter", rc);
+ db = NULL;
goto bail;
}
@@ -508,11 +508,12 @@ entryrdn_rename_subtree(backend *be,
/* Open the entryrdn index */
rc = _entryrdn_open_index(be, &ai, &db);
- if (rc) {
+ if (rc || (NULL == db)) {
slapi_log_error(SLAPI_LOG_FATAL, ENTRYRDN_TAG,
"entryrdn_rename_subtree: Opening the index failed: "
"%s(%d)\n",
rc<0?dblayer_strerror(rc):"Invalid parameter", rc);
+ db = NULL;
return rc;
}
@@ -915,11 +916,12 @@ entryrdn_get_subordinates(backend *be,
/* Open the entryrdn index */
rc = _entryrdn_open_index(be, &ai, &db);
- if (rc) {
+ if (rc || (NULL == db)) {
slapi_log_error(SLAPI_LOG_FATAL, ENTRYRDN_TAG,
"entryrdn_get_subordinates: Opening the index failed:
"
"%s(%d)\n",
rc<0?dblayer_strerror(rc):"Invalid parameter", rc);
+ db = NULL;
goto bail;
}
@@ -1003,7 +1005,7 @@ entryrdn_lookup_dn(backend *be,
char **dn,
back_txn *txn)
{
- int rc = 0;
+ int rc = -1;
struct attrinfo *ai = NULL;
DB *db = NULL;
DBC *cursor = NULL;
@@ -1032,7 +1034,7 @@ entryrdn_lookup_dn(backend *be,
*dn = NULL;
/* Open the entryrdn index */
rc = _entryrdn_open_index(be, &ai, &db);
- if (rc) {
+ if (rc || (NULL == db)) {
slapi_log_error(SLAPI_LOG_FATAL, ENTRYRDN_TAG,
"entryrdn_lookup_dn: Opening the index failed: "
"%s(%d)\n",
@@ -1146,9 +1148,8 @@ bail:
dblayer_strerror(myrc), myrc);
}
}
- if (db) {
- dblayer_release_index_file(be, ai, db);
- }
+ /* it is guaranteed that db is not NULL. */
+ dblayer_release_index_file(be, ai, db);
slapi_rdn_free(&srdn);
slapi_ch_free_string(&nrdn);
slapi_ch_free_string(&keybuf);
@@ -1173,7 +1174,7 @@ entryrdn_get_parent(backend *be,
ID *pid,
back_txn *txn)
{
- int rc = 0;
+ int rc = -1;
struct attrinfo *ai = NULL;
DB *db = NULL;
DBC *cursor = NULL;
@@ -1197,14 +1198,14 @@ entryrdn_get_parent(backend *be,
NULL==be?"backend":NULL==rdn?"rdn":0==id?"id":
NULL==rdn?"rdn container":
NULL==pid?"pid":"unknown");
- goto bail;
+ return rc;
}
*prdn = NULL;
*pid = 0;
/* Open the entryrdn index */
rc = _entryrdn_open_index(be, &ai, &db);
- if (rc) {
+ if (rc || (NULL == db)) {
slapi_log_error(SLAPI_LOG_FATAL, ENTRYRDN_TAG,
"entryrdn_get_parent: Opening the index failed: "
"%s(%d)\n",
@@ -1294,9 +1295,8 @@ bail:
dblayer_strerror(rc), rc);
}
}
- if (db) {
- dblayer_release_index_file(be, ai, db);
- }
+ /* it is guaranteed that db is not NULL. */
+ dblayer_release_index_file(be, ai, db);
slapi_log_error(SLAPI_LOG_TRACE, ENTRYRDN_TAG,
"<-- entryrdn_get_parent\n");
return rc;
@@ -1414,6 +1414,8 @@ _entryrdn_open_index(backend *be, struct attrinfo **ai, DB **dbp)
NULL==dbp?"db container":"unknown");
goto bail;
}
+ *ai = NULL;
+ *dbp = NULL;
/* Open the entryrdn index */
ainfo_get(be, LDBM_ENTRYRDN_STR, ai);
if (NULL == *ai) {
commit 68abfd6d81e6f3dcf40409c528abe6791e8b82d9
Author: Noriko Hosoi <nhosoi(a)jiji.usersys.redhat.com>
Date: Thu Nov 3 11:45:58 2011 -0700
Bug 750625 - Fix Coverity (12195) Dereference after null check
https://bugzilla.redhat.com/show_bug.cgi?id=750625
slapd/dn.c (slapi_dn_normalize_ext)
Bug Description: Dereferencing null variable "dest_len".
Missed to check the NULL possibility of the argument "dest_len"
to return the normalized dn size.
Fix Description: Assinging 0 to "*dest_len" only when "dest_len"
is not NULL.
diff --git a/ldap/servers/slapd/dn.c b/ldap/servers/slapd/dn.c
index 2b0b338..ec92790 100644
--- a/ldap/servers/slapd/dn.c
+++ b/ldap/servers/slapd/dn.c
@@ -1080,7 +1080,9 @@ bail:
*dest = NULL;
}
}
- *dest_len = 0;
+ if (dest_len != NULL) {
+ *dest_len = 0;
+ }
} else if (d && rc > 0) {
/* We terminate the str with NULL only when we allocate the str */
*d = '\0';
commit dcb6ad7d9ca65a4e60ffd24d00287ca144ca6310
Author: Noriko Hosoi <nhosoi(a)jiji.usersys.redhat.com>
Date: Thu Nov 3 10:01:32 2011 -0700
Bug 750625 - Fix Coverity (11066-2) Unused pointer value
https://bugzilla.redhat.com/show_bug.cgi?id=750625
slapd/opshared.c (op_shared_search)
Bug Description: A pointer "normbase" returned by "slapi_sdn_get_
dn(sdn)" is never used.
Fix description: removing the line that normbase is set.
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index bf6b016..f475b9d 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -679,7 +679,6 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
slapi_sdn_free(&sdn);
sdn = slapi_sdn_dup(be_suffix);
slapi_pblock_set(pb, SLAPI_SEARCH_TARGET_SDN, (void *)sdn);
- normbase = slapi_sdn_get_dn(sdn);
}
else if (slapi_sdn_issuffix(basesdn, be_suffix))
{
commit 92a3f9920211ec66bbe531cf3ba1d3e77abca34b
Author: Noriko Hosoi <nhosoi(a)jiji.usersys.redhat.com>
Date: Thu Nov 3 10:08:26 2011 -0700
Bug 750625 - Fix Coverity (11062) Resource leak
https://bugzilla.redhat.com/show_bug.cgi?id=750625
plugins/chainingdb/cb_bind.c (chainingdb_bind)
Bug Description: Variable "sdn" going out of scope leaks
the storage it points to. If SLAPI_BIND_TARGET_SDN is not
given (anonymous bind) to cb_bind, sizeof(Slapi_DN) leaks.
Fix Description: Free sdn if the structure Slapi_DN is locally
allocated.
diff --git a/ldap/servers/plugins/chainingdb/cb_bind.c
b/ldap/servers/plugins/chainingdb/cb_bind.c
index edc45f3..18e526a 100644
--- a/ldap/servers/plugins/chainingdb/cb_bind.c
+++ b/ldap/servers/plugins/chainingdb/cb_bind.c
@@ -238,6 +238,7 @@ chainingdb_bind( Slapi_PBlock *pb )
Slapi_Backend *be;
const char *dn = NULL;
Slapi_DN *sdn = NULL;
+ Slapi_DN *mysdn = NULL;
int method;
struct berval *creds, **urls;
char *matcheddn,*errmsg;
@@ -246,20 +247,20 @@ chainingdb_bind( Slapi_PBlock *pb )
int freectrls=1;
int bind_retry;
- if ( LDAP_SUCCESS != (rc = cb_forward_operation(pb) )) {
- cb_send_ldap_result( pb, rc, NULL, "Chaining forbidden", 0, NULL );
- return SLAPI_BIND_FAIL;
- }
+ if ( LDAP_SUCCESS != (rc = cb_forward_operation(pb) )) {
+ cb_send_ldap_result( pb, rc, NULL, "Chaining forbidden", 0, NULL );
+ return SLAPI_BIND_FAIL;
+ }
ctrls=NULL;
/* don't add proxy auth control. use this call to check for supported */
/* controls only. */
- if ( LDAP_SUCCESS != ( rc = cb_update_controls( pb, NULL, &ctrls, 0 )) ) {
- cb_send_ldap_result( pb, rc, NULL, NULL, 0, NULL );
+ if ( LDAP_SUCCESS != ( rc = cb_update_controls( pb, NULL, &ctrls, 0 )) ) {
+ cb_send_ldap_result( pb, rc, NULL, NULL, 0, NULL );
if (ctrls)
ldap_controls_free(ctrls);
- return SLAPI_BIND_FAIL;
- }
+ return SLAPI_BIND_FAIL;
+ }
if (ctrls)
ldap_controls_free(ctrls);
@@ -272,30 +273,32 @@ chainingdb_bind( Slapi_PBlock *pb )
cb = cb_get_instance(be);
if ( NULL == sdn ) {
- sdn = slapi_sdn_new_ndn_byval("");
+ sdn = mysdn = slapi_sdn_new_ndn_byval("");
}
dn = slapi_sdn_get_ndn(sdn);
- /* always allow noauth simple binds */
- if (( method == LDAP_AUTH_SIMPLE) && creds->bv_len == 0 ) {
- return( SLAPI_BIND_ANONYMOUS );
- }
+ /* always allow noauth simple binds */
+ if (( method == LDAP_AUTH_SIMPLE) && creds->bv_len == 0 ) {
+ slapi_sdn_free(&mysdn);
+ return( SLAPI_BIND_ANONYMOUS );
+ }
- cb_update_monitor_info(pb,cb,SLAPI_OPERATION_BIND);
+ cb_update_monitor_info(pb,cb,SLAPI_OPERATION_BIND);
matcheddn=errmsg=NULL;
- allocated_errmsg = 0;
+ allocated_errmsg = 0;
resctrls=NULL;
urls=NULL;
/* Check wether the chaining BE is available or not */
- if ( cb_check_availability( cb, pb ) == FARMSERVER_UNAVAILABLE ){
- return -1;
- }
+ if ( cb_check_availability( cb, pb ) == FARMSERVER_UNAVAILABLE ){
+ slapi_sdn_free(&mysdn);
+ return -1;
+ }
- slapi_rwlock_rdlock(cb->rwl_config_lock);
+ slapi_rwlock_rdlock(cb->rwl_config_lock);
bind_retry=cb->bind_retry;
- slapi_rwlock_unlock(cb->rwl_config_lock);
+ slapi_rwlock_unlock(cb->rwl_config_lock);
rc = cb_sasl_bind_s(pb, cb->bind_pool, bind_retry, dn, method,
mechanism, creds, reqctrls, &matcheddn, &errmsg,
@@ -322,17 +325,18 @@ chainingdb_bind( Slapi_PBlock *pb )
}
}
- if ( urls != NULL ) {
- cb_free_bervals( urls );
- }
- if ( freectrls && ( resctrls != NULL )) {
- ldap_controls_free( resctrls );
- }
- slapi_ch_free((void **)& matcheddn );
- if ( allocated_errmsg && errmsg != NULL ) {
- slapi_ch_free((void **)& errmsg );
- }
+ if ( urls != NULL ) {
+ cb_free_bervals( urls );
+ }
+ if ( freectrls && ( resctrls != NULL )) {
+ ldap_controls_free( resctrls );
+ }
+ slapi_ch_free((void **)& matcheddn );
+ if ( allocated_errmsg && errmsg != NULL ) {
+ slapi_ch_free((void **)& errmsg );
+ }
+ slapi_sdn_free(&mysdn);
return ((rc == LDAP_SUCCESS ) ? SLAPI_BIND_SUCCESS : SLAPI_BIND_FAIL );
}
commit 777673ecf7bf4c6f0d41e18c550dc4d86f7e897b
Author: Noriko Hosoi <nhosoi(a)jiji.usersys.redhat.com>
Date: Thu Nov 3 09:50:55 2011 -0700
Bug 750625 - Fix Coverity (11055-2) Explicit null dereferenced
https://bugzilla.redhat.com/show_bug.cgi?id=750625
plugins/automember/automember.c (automember_pre_op)
Bug Description: Passing null variable "e" to function
"automember_parse_config_entry", which dereferences it.
Missing a check of the NULL possibility of target entry "e" when
modop is not a supported op type.
Fix Description: If modop is not a supported type, it bails there.
diff --git a/ldap/servers/plugins/automember/automember.c
b/ldap/servers/plugins/automember/automember.c
index 010b5ac..1195a15 100644
--- a/ldap/servers/plugins/automember/automember.c
+++ b/ldap/servers/plugins/automember/automember.c
@@ -1623,6 +1623,11 @@ automember_pre_op(Slapi_PBlock * pb, int modop)
* to let the main server handle it. */
goto bailmod;
}
+ } else {
+ errstr = slapi_ch_smprintf("automember_pre_op: invalid op type
%d",
+ modop);
+ ret = LDAP_PARAM_ERROR;
+ goto bail;
}
if (automember_parse_config_entry(e, 0) != 0) {