Author: nhosoi

Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/acl In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv14369/ldap/servers/plugins/acl

Modified Files: acllas.c aclparse.c Log Message: Resolves: #339791 Summary: rhds71sp1 rhel3u6 - ns-slapd process dies with segmentation fault Description: ldap_utf8prev, LDAP_UTF8PREV, and LDAP_UTF8DEC were sometimes used without checking the returned pointer going back beyond the beginning of the string.

Index: acllas.c =================================================================== RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/acl/acllas.c,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- acllas.c 19 Oct 2007 15:36:01 -0000 1.10 +++ acllas.c 24 Oct 2007 18:41:15 -0000 1.11 @@ -562,7 +562,10 @@ /* ignore trailing whitespace */ len = strlen(user); ptr = user+len-1; - while(ldap_utf8isspace(ptr)){ *ptr = '\0'; LDAP_UTF8DEC(ptr); } + while(ptr >= user && ldap_utf8isspace(ptr)) { + *ptr = '\0'; + LDAP_UTF8DEC(ptr); + } }

/* @@ -806,7 +809,10 @@ /* ignore trailing whitespace */ len = strlen(groupName); ptr = groupName+len-1; - while(ldap_utf8isspace(ptr)) { *ptr = '\0'; LDAP_UTF8DEC(ptr); } + while(ptr >= groupName && ldap_utf8isspace(ptr)) { + *ptr = '\0'; + LDAP_UTF8DEC(ptr); + } }

/* @@ -966,7 +972,10 @@ /* ignore trailing whitespace */ len = strlen(role); ptr = role+len-1; - while(ldap_utf8isspace(ptr)) { *ptr = '\0'; LDAP_UTF8DEC(ptr); } + while(ptr >= role && ldap_utf8isspace(ptr)) { + *ptr = '\0'; + LDAP_UTF8DEC(ptr); + } }

/* @@ -1118,7 +1127,10 @@ while(ldap_utf8isspace(attrName)) LDAP_UTF8INC(attrName); len = strlen(attrName); ptr = attrName+len-1; - while(ldap_utf8isspace(ptr)) { *ptr = '\0'; LDAP_UTF8DEC(ptr); } + while(ptr >= attrName && ldap_utf8isspace(ptr)) { + *ptr = '\0'; + LDAP_UTF8DEC(ptr); + }

/* See if we have a parent[2].attr" rule */ @@ -1346,7 +1358,10 @@ while(ldap_utf8isspace(attr)) LDAP_UTF8INC(attr); len = strlen(attr); ptr = attr+len-1; - while(ldap_utf8isspace(ptr)) { *ptr = '\0'; LDAP_UTF8DEC(ptr); } + while(ptr >= attr && ldap_utf8isspace(ptr)) { + *ptr = '\0'; + LDAP_UTF8DEC(ptr); + }

slapi_log_error( SLAPI_LOG_ACL, plugin_name, "DS_LASAuthMethodEval:authtype:%s authmethod:%s\n", @@ -2124,7 +2139,10 @@ while(ldap_utf8isspace(attrName)) LDAP_UTF8INC(attrName); len = strlen(attrName); ptr = attrName+len-1; - while(ldap_utf8isspace(ptr)) { *ptr = '\0'; LDAP_UTF8DEC(ptr); } + while(ptr >= attrName && ldap_utf8isspace(ptr)) { + *ptr = '\0'; + LDAP_UTF8DEC(ptr); + }

slapi_log_error( SLAPI_LOG_ACL, plugin_name,"Attr:%s\n" , attrName, 0,0);

Index: aclparse.c =================================================================== RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/acl/aclparse.c,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- aclparse.c 19 Oct 2007 22:14:56 -0000 1.10 +++ aclparse.c 24 Oct 2007 18:41:15 -0000 1.11 @@ -464,7 +464,7 @@ char *next; next = s + 12; s--; - while (s != str && ldap_utf8isspace(s)) LDAP_UTF8DEC(s); + while (s > str && ldap_utf8isspace(s)) LDAP_UTF8DEC(s); if (s && *s == ';') { /* We don't support authenticate stuff */ return ACL_INVALID_AUTHORIZATION; @@ -1542,9 +1542,12 @@

if (*str) { /* ignore trailing whitespace */ - len = strlen(str); - ptr = str+len-1; - while(ldap_utf8isspace(ptr)){ *ptr = '\0'; LDAP_UTF8DEC(ptr); } + len = strlen(str); + ptr = str+len-1; + while(ptr >= str && ldap_utf8isspace(ptr)) { + *ptr = '\0'; + LDAP_UTF8DEC(ptr); + } } }