Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/syntaxes
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv14583
Modified Files:
Tag: Directory_Server_8_0_Branch
string.c
Log Message:
Resolves: #448831
Summary: attacker can tie up CPU in regex code (comment #11)
Description: string_filter_sub always expected SLAPI_SEARCH_TIMELIMIT and
SLAPI_OPINITIATED_TIME were set in pblock, but it was not true. Fixed to check
the container of these values first, and retrieve them only if the container is
in the pblock. Otherwise, set -1 to timelimit (no timelimit).
Index: string.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/syntaxes/string.c,v
retrieving revision 1.9.2.2
retrieving revision 1.9.2.3
diff -u -r1.9.2.2 -r1.9.2.3
--- string.c 11 Jul 2008 17:18:43 -0000 1.9.2.2
+++ string.c 18 Jul 2008 23:13:41 -0000 1.9.2.3
@@ -199,11 +199,18 @@
time_t time_up = 0;
time_t optime = 0; /* time op was initiated */
int timelimit = 0; /* search timelimit */
+ Operation *op = NULL;
LDAPDebug( LDAP_DEBUG_FILTER, "=> string_filter_sub\n",
0, 0, 0 );
- slapi_pblock_get( pb, SLAPI_SEARCH_TIMELIMIT, &timelimit );
- slapi_pblock_get( pb, SLAPI_OPINITIATED_TIME, &optime );
+ slapi_pblock_get( pb, SLAPI_OPERATION, &op );
+ if (NULL != op) {
+ slapi_pblock_get( pb, SLAPI_SEARCH_TIMELIMIT, &timelimit );
+ slapi_pblock_get( pb, SLAPI_OPINITIATED_TIME, &optime );
+ } else {
+ /* timelimit is not passed via pblock */
+ timelimit = -1;
+ }
/*
* (timelimit==-1) means no time limit
*/
Show replies by date