|
 |
dc8c34 |
From 039d7b6178fb41374c07672ac05dce40fbce82d7 Mon Sep 17 00:00:00 2001
|
|
|
dc8c34 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
dc8c34 |
Date: Mon, 4 May 2015 14:06:43 -0700
|
|
|
dc8c34 |
Subject: [PATCH 319/319] Ticket #48146 - async simple paged results issue
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Description: Invalid index could cause Invalid read.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
https://fedorahosted.org/389/ticket/48146
|
|
|
dc8c34 |
(cherry picked from commit 8e21bfbe4fcac79cf39e5c6b579c4bc88e05257e)
|
|
|
dc8c34 |
(cherry picked from commit 644a116950d34bd11533a4426f6af6953865edf2)
|
|
|
dc8c34 |
(cherry picked from commit 82020ad65cf1b1762a8e9eaaf1a9cd7bc7b709f1)
|
|
|
dc8c34 |
---
|
|
|
dc8c34 |
ldap/servers/slapd/pagedresults.c | 8 ++++++++
|
|
|
dc8c34 |
1 file changed, 8 insertions(+)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
|
|
|
dc8c34 |
index a3a5fc4..327da54 100644
|
|
|
dc8c34 |
--- a/ldap/servers/slapd/pagedresults.c
|
|
|
dc8c34 |
+++ b/ldap/servers/slapd/pagedresults.c
|
|
|
dc8c34 |
@@ -138,6 +138,13 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
|
|
|
dc8c34 |
memcpy(ptr, cookie.bv_val, cookie.bv_len);
|
|
|
dc8c34 |
*(ptr+cookie.bv_len) = '\0';
|
|
|
dc8c34 |
*index = strtol(ptr, NULL, 10);
|
|
|
dc8c34 |
+ if (conn->c_pagedresults.prl_maxlen <= *index) {
|
|
|
dc8c34 |
+ rc = LDAP_PROTOCOL_ERROR;
|
|
|
dc8c34 |
+ LDAPDebug1Arg(LDAP_DEBUG_ANY,
|
|
|
dc8c34 |
+ "pagedresults_parse_control_value: invalid cookie: %d\n",
|
|
|
dc8c34 |
+ *index);
|
|
|
dc8c34 |
+ goto bail;
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
slapi_ch_free_string(&ptr);
|
|
|
dc8c34 |
prp = conn->c_pagedresults.prl_list + *index;
|
|
|
dc8c34 |
if (!(prp->pr_search_result_set)) { /* freed and reused for the next backend. */
|
|
|
dc8c34 |
@@ -162,6 +169,7 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
|
|
|
dc8c34 |
"pagedresults_parse_control_value: invalid cookie: %d\n",
|
|
|
dc8c34 |
*index);
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
+bail:
|
|
|
dc8c34 |
PR_Unlock(conn->c_mutex);
|
|
|
dc8c34 |
|
|
|
dc8c34 |
LDAPDebug1Arg(LDAP_DEBUG_TRACE,
|
|
|
dc8c34 |
--
|
|
|
dc8c34 |
1.9.3
|
|
|
dc8c34 |
|