ldap/servers/plugins/acl/acleffectiverights.c | 3 +--
ldap/servers/plugins/replication/repl5_connection.c | 3 +--
ldap/servers/slapd/back-ldbm/sort.c | 19 ++++++++++++++-----
ldap/servers/slapd/entrywsi.c | 9 +++++----
4 files changed, 21 insertions(+), 13 deletions(-)
New commits:
commit 03a6bb77b0c1ff86ea67a79f7d0d3d232dff03ce
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Mar 28 14:43:33 2011 -0700
Bug 691574 - (cov#10575) Check return value of ldap_get_option
We should check the return value of ldap_get_option() in the
replication code when we check if we are ready to write data.
diff --git a/ldap/servers/plugins/replication/repl5_connection.c
b/ldap/servers/plugins/replication/repl5_connection.c
index 068f1f4..ebde0b6 100644
--- a/ldap/servers/plugins/replication/repl5_connection.c
+++ b/ldap/servers/plugins/replication/repl5_connection.c
@@ -509,8 +509,7 @@ see_if_write_available(Repl_Connection *conn, PRIntervalTime timeout)
int rc;
/* get the sockbuf */
- ldap_get_option(conn->ld, LDAP_OPT_DESC, &fd);
- if (fd <= 0) {
+ if ((ldap_get_option(conn->ld, LDAP_OPT_DESC, &fd) != LDAP_OPT_SUCCESS) || (fd
<= 0)) {
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
"%s: invalid connection insee_if_write_available \n",
agmt_get_long_name(conn->agmt));
commit 53da4c81903a44d75e8b111ea652f8d97baa623b
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Mar 28 14:27:48 2011 -0700
Bug 691574 - (cov#10573) check return value in GER code
We should check the return value of proxyauth_get_dn() in the
get effective rights code.
diff --git a/ldap/servers/plugins/acl/acleffectiverights.c
b/ldap/servers/plugins/acl/acleffectiverights.c
index a866664..e30370d 100644
--- a/ldap/servers/plugins/acl/acleffectiverights.c
+++ b/ldap/servers/plugins/acl/acleffectiverights.c
@@ -124,8 +124,7 @@ _ger_g_permission_granted (
/*
* The requestor may be either the bind dn or a proxy dn
*/
- proxyauth_get_dn ( pb, &proxydn, &errtext );
- if ( proxydn != NULL )
+ if ((proxyauth_get_dn( pb, &proxydn, &errtext ) == LDAP_SUCCESS) && (
proxydn != NULL )) {
{
requestor_sdn = slapi_sdn_new_dn_passin ( proxydn );
}
commit d55024da1176fe98f9fdf7486474cbb042fd94ba
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Mar 28 14:08:16 2011 -0700
Bug 691574 - (cov#10577) Check return types when adding RDN CSNs
We are not checking the return types when searching for RDN attrs
and values to create the RDN CSNs. This could result in us using
a deleted attribute or value when we should only be looking at
present attributes and values. Checking the return type allows
us to verify that we found a present attribute or value.
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 499b2b7..9087651 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -262,17 +262,18 @@ entry_add_rdn_csn(Slapi_Entry *e, const CSN *csn)
{
Slapi_Attr *a= NULL;
Slapi_Value *v= NULL;
- entry_attr_find_wsi(e, type, &a);
- if(a!=NULL)
+ if ((entry_attr_find_wsi(e, type, &a) == ATTRIBUTE_PRESENT) && (a!=NULL))
{
struct berval bv;
bv.bv_len= strlen(value);
bv.bv_val= (void*)value;
- attr_value_find_wsi(a, &bv, &v);
+ if (attr_value_find_wsi(a, &bv, &v) == VALUE_DELETED) {
+ v = NULL;
+ }
}
if(v!=NULL)
{
- value_update_csn(v,CSN_TYPE_VALUE_DISTINGUISHED,csn);
+ value_update_csn(v,CSN_TYPE_VALUE_DISTINGUISHED,csn);
}
else
{
commit af1a33b7b13eca3f19e76ad922e360d6735faea5
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Mar 28 13:53:19 2011 -0700
Bug 691574 - (cov#10579) Check return value of ber_scanf() in sort code
We should check if there was an error returned from ber_scanf()
when processing the sort control.
diff --git a/ldap/servers/slapd/back-ldbm/sort.c b/ldap/servers/slapd/back-ldbm/sort.c
index 2c9595d..ae3f3d6 100644
--- a/ldap/servers/slapd/back-ldbm/sort.c
+++ b/ldap/servers/slapd/back-ldbm/sort.c
@@ -345,18 +345,23 @@ int parse_sort_spec(struct berval *sort_spec_ber, sort_spec **ps)
/* Is it the matching rule ? */
if (LDAP_TAG_SK_MATCHRULE == next_tag) {
/* If so, get it */
- ber_scanf(ber,"a",&matchrule);
+ return_value = ber_scanf(ber,"a",&matchrule);
+ if (LBER_ERROR == return_value) {
+ rc = LDAP_PROTOCOL_ERROR;
+ goto err;
+ }
+
/* That can be followed by a reverse indicator */
len = -1; /* reset - not used here */
next_tag = ber_next_element(ber,&len, inner_last);
if (LDAP_TAG_SK_REVERSE == next_tag) {
/* Get the reverse sort indicator here */
- ber_scanf(ber,"b",&reverse);
+ return_value = ber_scanf(ber,"b",&reverse);
/* The protocol police say--"You must have other than your default value"
*/
- if (0 == reverse) {
+ if ((LBER_ERROR == return_value) || (0 == reverse)) {
/* Protocol error */
rc = LDAP_PROTOCOL_ERROR;
- goto err;
+ goto err;
}
} else {
/* Perhaps we're done now ? */
@@ -372,7 +377,11 @@ int parse_sort_spec(struct berval *sort_spec_ber, sort_spec **ps)
/* Is it the reverse indicator ? */
if (LDAP_TAG_SK_REVERSE == next_tag) {
/* If so, get it */
- ber_scanf(ber,"b",&reverse);
+ return_value = ber_scanf(ber,"b",&reverse);
+ if (LBER_ERROR == return_value) {
+ rc = LDAP_PROTOCOL_ERROR;
+ goto err;
+ }
} else {
/* Protocol error---tag which isn't either of the legal ones came first */
rc = LDAP_PROTOCOL_ERROR;