ldap/servers/plugins/cos/cos_cache.c | 24 ++++++++++--------------
1 file changed, 10 insertions(+), 14 deletions(-)
New commits:
commit 142c8f0fe93d77990df8ce991a8020918276ddd8
Author: Mark Reynolds <mareynol(a)redhat.com>
Date: Fri Mar 2 11:51:58 2012 -0500
Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash
Bug Description: There is a potential double free in cos_cache_query_attr(). If you
run concurrent search or compares its very easy to crash the
server in this code
Fix Description: Moved the DN normalization into the cache rebuilding code.
https://fedorahosted.org/389/ticket/305
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index b2237ee..a93d0b5 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -786,6 +786,7 @@ static int cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
int valIndex = 0;
Slapi_Attr *dnAttr;
char *attrType = 0;
+ char *norm_dn = NULL;
info=(struct dn_defs_info *)callback_data;
@@ -807,9 +808,16 @@ static int cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
pSneakyVal = 0;
if(!slapi_utf8casecmp((unsigned char*)attrType, (unsigned
char*)"objectclass"))
pSneakyVal = &pObjectclass;
- else if(!slapi_utf8casecmp((unsigned char*)attrType, (unsigned
char*)"cosTargetTree"))
+ else if(!slapi_utf8casecmp((unsigned char*)attrType, (unsigned
char*)"cosTargetTree")){
+ if(pCosTargetTree){
+ norm_dn = slapi_create_dn_string("%s", pCosTargetTree->val);
+ if(norm_dn){
+ slapi_ch_free_string(&pCosTargetTree->val);
+ pCosTargetTree->val = norm_dn;
+ }
+ }
pSneakyVal = &pCosTargetTree;
- else if(!slapi_utf8casecmp((unsigned char*)attrType, (unsigned
char*)"cosTemplateDn"))
+ } else if(!slapi_utf8casecmp((unsigned char*)attrType, (unsigned
char*)"cosTemplateDn"))
pSneakyVal = &pCosTemplateDn;
else if(!slapi_utf8casecmp((unsigned char*)attrType, (unsigned
char*)"cosSpecifier"))
pSneakyVal = &pCosSpecifier;
@@ -2387,18 +2395,6 @@ static int cos_cache_query_attr(cos_cache *ptheCache, vattr_context
*context, Sl
* hits. We only check if this entry is a child of the target tree(s). */
while((hit == 0 || merge_mode) && pTargetTree)
{
- {
- char *normed = slapi_create_dn_string("%s", pTargetTree->val);
- if (normed) {
- slapi_ch_free_string(&pTargetTree->val);
- pTargetTree->val = normed;
- } else {
- LDAPDebug(LDAP_DEBUG_ANY,
- "cos_cache_query_attr: failed to normalize dn %s. "
- "Processing the pre normalized dn.\n",
- pTargetTree->val, 0, 0);
- }
- }
if( pTargetTree->val == 0 ||
slapi_dn_issuffix(pDn, pTargetTree->val) != 0 ||
(views_api && views_entry_exists(views_api, pTargetTree->val, e)) /* might
be in a view */