From c7f51115cdb11bf0a0c0e2398a080dd38701e199 Mon Sep 17 00:00:00 2001 From: William Brown Date: Wed, 9 Mar 2016 14:00:42 +1000 Subject: [PATCH 415/425] Ticket 48665 - Prevent sefault in ldbm_instance_modify_config_entry Bug Description: python ldap sends a mod_delete then a mod_add to the server. This causes a segfault in ldbm_instance_modify_config_entry which expects the value of the delete operation to exist. Fix Description: If there is no attribute in the delete operation, this now passes a NULL to ldbm_config_set, which then rejects the op as NO_SUCH_ATTRIBUTE There is an attached test case, which also checks that mod_replace is still functional. https://fedorahosted.org/389/ticket/48665 Author: wibrown Review by: nhosoi (Thanks!) (cherry picked from commit 9134b006948d7d8eeb926655640b7f068fc6724d) (cherry picked from commit fa54d0ce631d29343d04b8dcea8ef8d9c235feb3) --- dirsrvtests/tests/tickets/ticket48665_test.py | 101 +++++++++++++++++++++ .../servers/slapd/back-ldbm/ldbm_instance_config.c | 16 +++- 2 files changed, 114 insertions(+), 3 deletions(-) create mode 100644 dirsrvtests/tests/tickets/ticket48665_test.py diff --git a/dirsrvtests/tests/tickets/ticket48665_test.py b/dirsrvtests/tests/tickets/ticket48665_test.py new file mode 100644 index 0000000..702319c --- /dev/null +++ b/dirsrvtests/tests/tickets/ticket48665_test.py @@ -0,0 +1,101 @@ +import os +import sys +import time +import ldap +import logging +import pytest +from lib389 import DirSrv, Entry, tools, tasks +from lib389.tools import DirSrvTools +from lib389._constants import * +from lib389.properties import * +from lib389.tasks import * +from lib389.utils import * + +logging.getLogger(__name__).setLevel(logging.DEBUG) +log = logging.getLogger(__name__) + +class TopologyStandalone(object): + def __init__(self, standalone): + standalone.open() + self.standalone = standalone + + +@pytest.fixture(scope="module") +def topology(request): + # Creating standalone instance ... + standalone = DirSrv(verbose=False) + args_instance[SER_HOST] = HOST_STANDALONE + args_instance[SER_PORT] = PORT_STANDALONE + args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE + args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX + args_standalone = args_instance.copy() + standalone.allocate(args_standalone) + instance_standalone = standalone.exists() + if instance_standalone: + standalone.delete() + standalone.create() + standalone.open() + + # Delete each instance in the end + def fin(): + # This is useful for analysing the test env. + #standalone.db2ldif(bename=DEFAULT_BENAME, suffixes=[DEFAULT_SUFFIX], excludeSuffixes=[], encrypt=False, \ + # repl_data=True, outputfile='%s/ldif/%s.ldif' % (standalone.dbdir,SERVERID_STANDALONE )) + #standalone.clearBackupFS() + #standalone.backupFS() + standalone.delete() + request.addfinalizer(fin) + + # Clear out the tmp dir + standalone.clearTmpDir(__file__) + + return TopologyStandalone(standalone) + + +def test_ticket48665(topology): + """ + This tests deletion of certain cn=config values. + + First, it should be able to delete, and not crash the server. + + Second, we might be able to delete then add to replace values. + + We should also still be able to mod replace the values and keep the server alive. + """ + #topology.standalone.config.enable_log('audit') + #topology.standalone.config.enable_log('auditfail') + # This will trigger a mod delete then add. + try: + modlist = [(ldap.MOD_DELETE, 'nsslapd-cachememsize', None), (ldap.MOD_ADD, 'nsslapd-cachememsize', '1')] + topology.standalone.modify_s("cn=%s,cn=ldbm database,cn=plugins,cn=config" % DEFAULT_BENAME, + modlist) + except: + pass + # Check the server has not commited seppuku. + result = topology.standalone.whoami_s() + assert(DN_DM.lower() in result.lower()) + + # This has a magic hack to determine if we are in cn=config. + topology.standalone.backend.setProperties(bename=DEFAULT_BENAME, + prop='nsslapd-cachememsize', values='1') + # Check the server has not commited seppuku. + result = topology.standalone.whoami_s() + assert(DN_DM.lower() in result.lower()) + + # Now try with mod_replace. This should be okay. + + modlist = [(ldap.MOD_REPLACE, 'nsslapd-cachememsize', '1')] + topology.standalone.modify_s("cn=%s,cn=ldbm database,cn=plugins,cn=config" % DEFAULT_BENAME, + modlist) + # Check the server has not commited seppuku. + result = topology.standalone.whoami_s() + assert(DN_DM.lower() in result.lower()) + + log.info('Test complete') + + +if __name__ == '__main__': + # Run isolated + # -s for DEBUG mode + CURRENT_FILE = os.path.realpath(__file__) + pytest.main("-s %s" % CURRENT_FILE) diff --git a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c index 2037618..c269ab3 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_instance_config.c @@ -789,9 +789,19 @@ ldbm_instance_modify_config_entry_callback(Slapi_PBlock *pb, Slapi_Entry* entryB } /* This assumes there is only one bval for this mod. */ - rc = ldbm_config_set((void *) inst, attr_name, - ldbm_instance_config, mods[i]->mod_bvalues[0], returntext, - CONFIG_PHASE_RUNNING, apply_mod, mods[i]->mod_op); + if (mods[i]->mod_bvalues == NULL) { + /* This avoids the null pointer deref. + * In ldbm_config.c ldbm_config_set, it checks for the NULL. + * If it's a NULL, we get NO_SUCH_ATTRIBUTE error. + */ + rc = ldbm_config_set((void *) inst, attr_name, + ldbm_instance_config, NULL, returntext, + CONFIG_PHASE_RUNNING, apply_mod, mods[i]->mod_op); + } else { + rc = ldbm_config_set((void *) inst, attr_name, + ldbm_instance_config, mods[i]->mod_bvalues[0], returntext, + CONFIG_PHASE_RUNNING, apply_mod, mods[i]->mod_op); + } } } -- 2.9.3