ldap/servers/plugins/uiduniq/7bit.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
New commits:
commit d07d1b5d63afc0a2875faaca3fa3811799e0e65b
Author: William Brown <firstyear(a)redhat.com>
Date: Wed Dec 23 13:33:56 2015 +1000
Ticket 48395 - ASAN - Use after free in uiduniq 7bit.c
Bug Description: Asan detected a use after free in 7bit.c during a modrdn
operation. This may cause the directory to crash if a specially crafted modrdn
request is made, or may be exploitable in some other way.
Fix Description: We move the issue_error directive before the slapi_entry is
freed, which means that we are using before the free instead.
https://fedorahosted.org/389/ticket/48395
Author: wibrown
Review by: nhosoi (Thank you!)
diff --git a/dirsrvtests/tmp/__init__.py b/dirsrvtests/tmp/__init__.py
deleted file mode 100644
index e69de29..0000000
diff --git a/ldap/servers/plugins/uiduniq/7bit.c b/ldap/servers/plugins/uiduniq/7bit.c
index bb7dc64..fe43f98 100644
--- a/ldap/servers/plugins/uiduniq/7bit.c
+++ b/ldap/servers/plugins/uiduniq/7bit.c
@@ -650,17 +650,20 @@ preop_modrdn(Slapi_PBlock *pb)
}
}
/* don't have to go on if there is a value not 7-bit clean */
- if (result) break;
+ if (result) {
+ /* WB we need to issue the error before we free slapi_entry, else we
+ * are triggering a use after free because we free violated.
+ */
+ issue_error(pb, result, "MODRDN", violated);
+ break;
+ }
+
}
END
/* Clean-up */
if (e) slapi_entry_free(e);
- if (result) {
- issue_error(pb, result, "MODRDN", violated);
- }
-
return (result==LDAP_SUCCESS)?0:-1;
}