ldap/servers/plugins/acl/acl.c | 4 ++--
ldap/servers/plugins/usn/usn_cleanup.c | 1 +
ldap/servers/slapd/back-ldbm/ldif2ldbm.c | 10 ++++------
ldap/servers/slapd/connection.c | 7 +------
ldap/servers/slapd/delete.c | 19 ++++++++++++-------
ldap/servers/slapd/dynalib.c | 2 +-
ldap/servers/slapd/modify.c | 22 ++++++++++++++++++----
ldap/servers/slapd/tools/ldclt/ldapfct.c | 2 +-
ldap/servers/slapd/tools/ldif.c | 4 ++++
ldap/servers/slapd/vattr.c | 4 ++--
lib/base/plist.cpp | 3 ++-
lib/libaccess/lasdns.cpp | 1 +
12 files changed, 49 insertions(+), 30 deletions(-)
New commits:
commit 830d55e8cc9d4a69f099b1c0ee00a93817c8fabb
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 14:51:18 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: To avoid a potential double free, set ipaddrs to NULL
after freeing it.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/lib/libaccess/lasdns.cpp b/lib/libaccess/lasdns.cpp
index b345d1b..3bcbba1 100644
--- a/lib/libaccess/lasdns.cpp
+++ b/lib/libaccess/lasdns.cpp
@@ -289,6 +289,7 @@ LASDnsBuild(NSErr_t *errp, char *attr_pattern, LASDnsContext_t
*context, int ali
}
PERM_FREE(ipaddrs);
+ ipaddrs = NULL;
} /* if he */
commit a9a5a5d9fe0801988f51a77b4b11029349f67c10
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 14:40:34 2010 -0600
Bug 602531 - coverity: op_shared_delete: compare preop entry and GLUE_PARENT_ENTRY
before freeing them
https://bugzilla.redhat.com/show_bug.cgi?id=602531
Resolves: bug 602531
Bug Description: coverity: op_shared_delete: compare preop entry and
GLUE_PARENT_ENTRY before freeing them
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: Get the pre entry and glue parent entries separately,
compare them, and only free one of them if they are the same.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/delete.c b/ldap/servers/slapd/delete.c
index acb2e44..16d9293 100644
--- a/ldap/servers/slapd/delete.c
+++ b/ldap/servers/slapd/delete.c
@@ -372,15 +372,20 @@ static void op_shared_delete (Slapi_PBlock *pb)
}
free_and_return:
- if (be)
+ if (be) {
slapi_be_Unlock(be);
- slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &ecopy);
- slapi_entry_free(ecopy);
- slapi_pblock_get ( pb, SLAPI_DELETE_GLUE_PARENT_ENTRY, &ecopy );
- if (ecopy)
+ }
{
- slapi_entry_free (ecopy);
- slapi_pblock_set (pb, SLAPI_DELETE_GLUE_PARENT_ENTRY, NULL);
+ Slapi_Entry *epre = NULL, *eparent = NULL;
+ slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &epre);
+ slapi_pblock_get(pb, SLAPI_DELETE_GLUE_PARENT_ENTRY, &eparent);
+ slapi_pblock_set(pb, SLAPI_ENTRY_PRE_OP, NULL);
+ slapi_pblock_set(pb, SLAPI_DELETE_GLUE_PARENT_ENTRY, NULL);
+ if (epre == eparent) {
+ eparent = NULL;
+ }
+ slapi_entry_free(epre);
+ slapi_entry_free(eparent);
}
slapi_pblock_get(pb, SLAPI_URP_NAMING_COLLISION_DN, &dn);
slapi_ch_free((void **)&dn);
commit 8401a419da225ade87aa6f36f4b35bafce629c8a
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 14:35:16 2010 -0600
Bug 602530 - coverity: op_shared_modify: compare pre, post and original entries
before freeing them
https://bugzilla.redhat.com/show_bug.cgi?id=602530
Resolves: bug 602530
Bug Description: coverity: op_shared_modify: compare pre, post and original entries
before freeing them
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: Get the pre entry and post entry separately, compare them to
e and to each other before attempting to free them.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index ead066d..3f78b01 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -894,10 +894,24 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char
*old_pw)
}
free_and_return:
- slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &ecopy);
- slapi_entry_free(ecopy);
- slapi_pblock_get(pb, SLAPI_ENTRY_POST_OP, &ecopy);
- slapi_entry_free(ecopy);
+ {
+ Slapi_Entry *epre = NULL, *epost = NULL;
+ slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &epre);
+ slapi_pblock_get(pb, SLAPI_ENTRY_POST_OP, &epost);
+ if (epre == e) {
+ epre = NULL; /* to avoid possible double free below */
+ }
+ if (epost == e) {
+ epost = NULL; /* to avoid possible double free below */
+ }
+ if (epre == epost) {
+ epost = NULL; /* to avoid possible double free below */
+ }
+ slapi_pblock_set(pb, SLAPI_ENTRY_PRE_OP, NULL);
+ slapi_pblock_set(pb, SLAPI_ENTRY_POST_OP, NULL);
+ slapi_entry_free(epre);
+ slapi_entry_free(epost);
+ }
slapi_entry_free(e);
if (be)
commit 138daaa4b171b770e0372c19fb5f656309eea4b1
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 14:18:36 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: The code wants to allocate space for a struct berval, not
struct berval *.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c
b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index b19c689..4d1ac6a 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -1523,7 +1523,7 @@ buildNewModAttribFile (
{
int nbAttribs; /* Nb of attributes */
LDAPMod attribute; /* To build the attributes */
- struct berval *bv = malloc(sizeof(struct berval *));
+ struct berval *bv = malloc(sizeof(struct berval));
attribute.mod_bvalues = (struct berval **)malloc(2 * sizeof(struct berval *));
if ((bv == NULL) || (attribute.mod_bvalues == NULL)) {
commit d76bdddeb292b1d71e5d7b1dcdcd985d39025a15
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 14:15:37 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: The code is allocating space for an array of int which is
4 bytes. In this case, since type_name_disposition is int**, doing
*type_name_disposition is still a pointer type rather than the int type. We
have to do **type_name_disposition to get to the int type we want.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/vattr.c b/ldap/servers/slapd/vattr.c
index 270594d..b234582 100644
--- a/ldap/servers/slapd/vattr.c
+++ b/ldap/servers/slapd/vattr.c
@@ -886,7 +886,7 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c,
/* Complete analysis of type matching */
*type_name_disposition =
- (int *)slapi_ch_malloc(sizeof(*type_name_disposition));
+ (int *)slapi_ch_malloc(sizeof(**type_name_disposition));
if ( 0 == slapi_attr_type_cmp( type , **actual_type_name, SLAPI_TYPE_CMP_EXACT) )
{
**type_name_disposition =
@@ -984,7 +984,7 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c,
{
*results = (Slapi_ValueSet**)slapi_ch_calloc(1, sizeof(*results) * attr_count);
- *type_name_disposition = (int *)slapi_ch_malloc(sizeof(*type_name_disposition) *
attr_count);
+ *type_name_disposition = (int *)slapi_ch_malloc(sizeof(**type_name_disposition) *
attr_count);
*actual_type_name = (char**)slapi_ch_malloc(sizeof(*actual_type_name) * attr_count);
/* For attributes which are in the entry, we just need to get to the Slapi_Attr
structure and yank out the slapi_value_set
commit c1a89263495c933673f8b977f6c202f34e65b293
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 14:08:55 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: The code is allocating an array of struct dynalib *, so the
sizeof needs to use (struct dynalib *) not (struct dynalib).
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/dynalib.c b/ldap/servers/slapd/dynalib.c
index a659a5e..58481a8 100644
--- a/ldap/servers/slapd/dynalib.c
+++ b/ldap/servers/slapd/dynalib.c
@@ -129,7 +129,7 @@ sym_load_with_flags( char *libpath, char *symbol, char *plugin, int
report_error
}
libs = (struct dynalib **) slapi_ch_realloc( (char *) libs, (i + 2) *
- sizeof(struct dynalib) );
+ sizeof(struct dynalib *) );
libs[i] = (struct dynalib *) slapi_ch_malloc( sizeof(struct dynalib) );
libs[i]->dl_name = slapi_ch_strdup( libpath );
libs[i]->dl_handle = handle;
commit fc16d51c7349b07a405085fd80548a6d0aaf31e8
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 13:28:39 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: Do not allow pt->pt_sizendx to be == PLMAXSIZENDX
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/lib/base/plist.cpp b/lib/base/plist.cpp
index 3c3192d..56873ce 100644
--- a/lib/base/plist.cpp
+++ b/lib/base/plist.cpp
@@ -823,7 +823,8 @@ PListNameProp(PList_t plist, int pindex, const char *pname)
/* Is it time to grow the hash table? */
i = PLSIZENDX(pt->pt_sizendx);
- if (((size_t)pt->pt_sizendx < PLMAXSIZENDX) &&
+ /* cannot allow pt->pt_sizendx == PLMAXSIZENDX */
+ if (((size_t)(pt->pt_sizendx + 1) < PLMAXSIZENDX) &&
pt->pt_nsyms >= (i + i)) {
PLSymbolTable_t *npt;
commit 6098df0ea1aec1c25334b4229fe196ca02c0fc26
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 11:37:34 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: The point of this code is to copy the conn authtype to
the operation authtype, so just do that.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index cf88a59..57672af 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -2597,13 +2597,8 @@ op_copy_identity(Connection *conn, Operation *op)
if (dnlen <= 0 && typelen <= 0) {
op->o_authtype = NULL;
} else {
- char* id = slapi_ch_malloc (typelen + 1);
- if (typelen <= 0)
- id[dnlen+1] = '\0';
- else
- memcpy (id, conn->c_authtype, typelen + 1);
slapi_sdn_set_dn_byval(&op->o_sdn,conn->c_dn);
- op->o_authtype = id;
+ op->o_authtype = slapi_ch_strdup(conn->c_authtype);
}
/* XXX We should also copy c_client_cert into *op here; it's
* part of the authorization identity. The operation's copy
commit 858f45f80fa73367bc5cf18b3dd29e3129fbe70c
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 11:23:33 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: ACLPB_MAX_ATTR_LEN is the buffer size including the trailing
null, not the strlen.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 574c862..43b289e 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -1039,9 +1039,9 @@ acl_read_access_allowed_on_entry (
** sending
*/
len = strlen(attr_type);
- if ( len > ACLPB_MAX_ATTR_LEN) {
+ if ( (len + 1) > ACLPB_MAX_ATTR_LEN) {
slapi_ch_free ( (void **) &aclpb->aclpb_Evalattr);
- aclpb->aclpb_Evalattr = slapi_ch_malloc(len);
+ aclpb->aclpb_Evalattr = slapi_ch_malloc(len+1);
}
PL_strncpyz (aclpb->aclpb_Evalattr, attr_type, len);
if ( attr_index >= 0 ) {
commit 4739bf587db66c9d8ceabd446dabbe03bc3a0664
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 10:52:05 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: Just error and return if nread is < 0.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/tools/ldif.c b/ldap/servers/slapd/tools/ldif.c
index 892b6ee..e8e6f9b 100644
--- a/ldap/servers/slapd/tools/ldif.c
+++ b/ldap/servers/slapd/tools/ldif.c
@@ -125,6 +125,10 @@ int main( int argc, char **argv )
max = BUFSIZ;
cur = 0;
while ( (nread = read( 0, buf, BUFSIZ )) != 0 ) {
+ if (nread < 0) {
+ perror( "read error" );
+ return( 1 );
+ }
if ( nread + cur > max ) {
max += BUFSIZ;
if (( val = (char *) realloc( val, max )) ==
commit fabd35294d0159ca840b019b6108df2eb759fea3
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 10:46:52 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: If there was an error, set filter to NULL so we won't attempt
to free static memory.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/plugins/usn/usn_cleanup.c
b/ldap/servers/plugins/usn/usn_cleanup.c
index 1c92a5a..8234bd4 100644
--- a/ldap/servers/plugins/usn/usn_cleanup.c
+++ b/ldap/servers/plugins/usn/usn_cleanup.c
@@ -83,6 +83,7 @@ usn_cleanup_thread(void *arg)
slapi_log_error(SLAPI_LOG_FATAL, USN_PLUGIN_SUBSYSTEM,
"USN tombstone cleanup: USN plugin is not
initialized\n");
rv = -1;
+ filter = NULL; /* so we don't try to free it */
goto bail;
}
commit 99fa0c1363c32a2e3352c07be4b5aae751018d23
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Jun 30 10:43:20 2010 -0600
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: The cnt parameter is not used, so just get rid of it.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index 2858f5b..e2138eb 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -2436,7 +2436,7 @@ ldbm_exclude_attr_from_export( struct ldbminfo *li , const char
*attr,
*/
void upgradedb_core(Slapi_PBlock *pb, ldbm_instance *inst);
-int upgradedb_copy_logfiles(struct ldbminfo *li, char *destination_dir, int restore, int
*cnt);
+int upgradedb_copy_logfiles(struct ldbminfo *li, char *destination_dir, int restore);
int upgradedb_delete_indices_4cmd(ldbm_instance *inst, int flags);
static void normalize_dir(char *dir);
@@ -2649,7 +2649,7 @@ int ldbm_back_upgradedb(Slapi_PBlock *pb)
}
/* copy checkpoint logs */
- backup_rval += upgradedb_copy_logfiles(li, dest_dir, 0, &cnt);
+ backup_rval += upgradedb_copy_logfiles(li, dest_dir, 0);
if (run_from_cmdline)
ldbm_config_internal_set(li, CONFIG_DB_TRANSACTION_LOGGING, "off");
@@ -2769,7 +2769,7 @@ fail1:
inst_obj = objset_next_obj(li->li_instance_set, inst_obj);
}
- backup_rval = upgradedb_copy_logfiles(li, dest_dir, 1, &cnt);
+ backup_rval = upgradedb_copy_logfiles(li, dest_dir, 1);
if (backup_rval < 0)
slapi_log_error(SLAPI_LOG_FATAL, "upgrade DB",
"Failed to restore log files.\n");
@@ -2809,7 +2809,7 @@ normalize_dir(char *dir)
#define LOG "log."
#define LOGLEN 4
int upgradedb_copy_logfiles(struct ldbminfo *li, char *destination_dir,
- int restore, int *cnt)
+ int restore)
{
PRDir *dirhandle = NULL;
PRDirEntry *direntry = NULL;
@@ -2823,7 +2823,6 @@ int upgradedb_copy_logfiles(struct ldbminfo *li, char
*destination_dir,
char *from = NULL;
char *to = NULL;
- *cnt = 0;
if (restore)
{
src = destination_dir;
@@ -2888,7 +2887,6 @@ int upgradedb_copy_logfiles(struct ldbminfo *li, char
*destination_dir,
rval = dblayer_copyfile(from, to, 1, DEFAULT_MODE);
if (rval < 0)
break;
- cnt++;
}
}
slapi_ch_free_string(&from);