|
 |
dc8c34 |
From 30f61a85451e9f84bb6914585f7b4e1148311911 Mon Sep 17 00:00:00 2001
|
|
|
dc8c34 |
From: Noriko Hosoi <nhosoi@redhat.com>
|
|
|
dc8c34 |
Date: Fri, 5 Jun 2015 10:13:17 -0700
|
|
|
dc8c34 |
Subject: [PATCH 333/333] Ticket #48192 - Individual abandoned simple paged
|
|
|
dc8c34 |
results request has no chance to be cleaned up
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Description: Checking the cookie value passed by the client was not
|
|
|
dc8c34 |
sufficient. The negative value check was missing, which lead to
|
|
|
dc8c34 |
the simple paged results array out of bounds. Plus, a minor memory
|
|
|
dc8c34 |
leak was fixed. Thanks to Thierry Bordaz for his reviews!
|
|
|
dc8c34 |
|
|
|
dc8c34 |
https://fedorahosted.org/389/ticket/48192
|
|
|
dc8c34 |
(cherry picked from commit 298371d372678cf553594ae73ae57a6ea35358bf)
|
|
|
dc8c34 |
(cherry picked from commit 7718eb6a6714d1a284c3c706e621a7eb0ca5655a)
|
|
|
dc8c34 |
(cherry picked from commit 7db5fdd5f1c5e1979784833173864e9c8c49c89d)
|
|
|
dc8c34 |
---
|
|
|
dc8c34 |
ldap/servers/slapd/pagedresults.c | 4 ++--
|
|
|
dc8c34 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
|
|
|
dc8c34 |
index 402dd10..2e70e19 100644
|
|
|
dc8c34 |
--- a/ldap/servers/slapd/pagedresults.c
|
|
|
dc8c34 |
+++ b/ldap/servers/slapd/pagedresults.c
|
|
|
dc8c34 |
@@ -177,14 +177,14 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
|
|
|
dc8c34 |
memcpy(ptr, cookie.bv_val, cookie.bv_len);
|
|
|
dc8c34 |
*(ptr+cookie.bv_len) = '\0';
|
|
|
dc8c34 |
*index = strtol(ptr, NULL, 10);
|
|
|
dc8c34 |
- if (conn->c_pagedresults.prl_maxlen <= *index) {
|
|
|
dc8c34 |
+ slapi_ch_free_string(&ptr);
|
|
|
dc8c34 |
+ if ((conn->c_pagedresults.prl_maxlen <= *index) || (*index < 0)){
|
|
|
dc8c34 |
rc = LDAP_PROTOCOL_ERROR;
|
|
|
dc8c34 |
LDAPDebug1Arg(LDAP_DEBUG_ANY,
|
|
|
dc8c34 |
"pagedresults_parse_control_value: invalid cookie: %d\n",
|
|
|
dc8c34 |
*index);
|
|
|
dc8c34 |
goto bail;
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
- slapi_ch_free_string(&ptr);
|
|
|
dc8c34 |
prp = conn->c_pagedresults.prl_list + *index;
|
|
|
dc8c34 |
if (!(prp->pr_search_result_set)) { /* freed and reused for the next backend. */
|
|
|
dc8c34 |
conn->c_pagedresults.prl_count++;
|
|
|
dc8c34 |
--
|
|
|
dc8c34 |
1.9.3
|
|
|
dc8c34 |
|