From a21ba4722268349b9c63000145e5d119e1fddd60 Mon Sep 17 00:00:00 2001

From: Mark Reynolds <mreynolds@redhat.com>

Date: Thu, 9 Aug 2018 15:27:59 -0400

Subject: [PATCH] Ticket 49890 : ldapsearch with server side sort crashes the 

 ldap server

Bug Description:

        Server side sort with a specified matching rule trigger a crash

Fix Description:

        Check if the we are able to index the provided value.

        If we are not then slapd_qsort returns an error (LDAP_OPERATION_ERROR)

https://pagure.io/389-ds-base/issue/49890

Reviewed by: mreynolds

Platforms tested: F27

Flag Day: no

Doc impact: no

(cherry picked from commit c989e18f7a3da060b16d39919b920b6b2a19a0ac)

---

 dirsrvtests/tests/suites/syntax/mr_test.py | 59 ++++++++++++++++++++++

 ldap/servers/slapd/back-ldbm/sort.c        | 14 +++++

 2 files changed, 73 insertions(+)

 create mode 100644 dirsrvtests/tests/suites/syntax/mr_test.py

diff --git a/dirsrvtests/tests/suites/syntax/mr_test.py b/dirsrvtests/tests/suites/syntax/mr_test.py

new file mode 100644

index 000000000..57061222a

--- /dev/null

+++ b/dirsrvtests/tests/suites/syntax/mr_test.py

@@ -0,0 +1,59 @@

+import logging

+import pytest

+import os

+import ldap

+from lib389.dbgen import dbgen

+from lib389._constants import *

+from lib389.topologies import topology_st as topo

+from lib389._controls import SSSRequestControl

+

+DEBUGGING = os.getenv("DEBUGGING", default=False)

+if DEBUGGING:

+    logging.getLogger(__name__).setLevel(logging.DEBUG)

+else:

+    logging.getLogger(__name__).setLevel(logging.INFO)

+log = logging.getLogger(__name__)

+

+

+def test_sss_mr(topo):

+    """Test matching rule/server side sort does not crash DS

+

+    :id: 48c73d76-1694-420f-ab55-187135f2d260

+    :setup: Standalone Instance

+    :steps:

+        1. Add sample entries to the database

+        2. Perform search using server side control (uid:2.5.13.3)

+    :expectedresults:

+        1. Success

+        2. Success

+    """

+

+    log.info("Creating LDIF...")

+    ldif_dir = topo.standalone.get_ldif_dir()

+    ldif_file = os.path.join(ldif_dir, 'mr-crash.ldif')

+    dbgen(topo.standalone, 5, ldif_file, DEFAULT_SUFFIX)

+

+    log.info("Importing LDIF...")

+    topo.standalone.stop()

+    assert topo.standalone.ldif2db(DEFAULT_BENAME, None, None, None, ldif_file)

+    topo.standalone.start()

+

+    log.info('Search using server side sorting using undefined mr in the attr...')

+    sort_ctrl = SSSRequestControl(True, ['uid:2.5.13.3'])

+    controls = [sort_ctrl]

+    msg_id = topo.standalone.search_ext(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE,

+                                        "objectclass=*", serverctrls=controls)

+    try:

+        rtype, rdata, rmsgid, response_ctrl = topo.standalone.result3(msg_id)

+    except ldap.OPERATIONS_ERROR:

+        pass

+

+    log.info("Test PASSED")

+

+

+if __name__ == '__main__':

+    # Run isolated

+    # -s for DEBUG mode

+    CURRENT_FILE = os.path.realpath(__file__)

+    pytest.main(["-s", CURRENT_FILE])

+

diff --git a/ldap/servers/slapd/back-ldbm/sort.c b/ldap/servers/slapd/back-ldbm/sort.c

index 5b84d87f3..70ac60803 100644

--- a/ldap/servers/slapd/back-ldbm/sort.c

+++ b/ldap/servers/slapd/back-ldbm/sort.c

@@ -546,6 +546,16 @@ compare_entries_sv(ID *id_a, ID *id_b, sort_spec *s, baggage_carrier *bc, int *e

             /* Now copy it, so the second call doesn't crap on it */

             value_a = slapi_ch_bvecdup(temp_value); /* Really, we'd prefer to not call the chXXX variant...*/

             matchrule_values_to_keys(this_one->mr_pb, actual_value_b, &value_b);

+

+            if ((actual_value_a && !value_a) ||

+                (actual_value_b && !value_b)) {

+                ber_bvecfree(actual_value_a);

+                ber_bvecfree(actual_value_b);

+                CACHE_RETURN(&inst->inst_cache, &a);

+                CACHE_RETURN(&inst->inst_cache, &b);

+                *error = 1;

+                return 0;

+            }

             if (actual_value_a)

                 ber_bvecfree(actual_value_a);

             if (actual_value_b)

@@ -717,6 +727,8 @@ recurse:

                A[i] >= A[lo] for higuy <= i <= hi */

             do {

+                if (error)

+                    return LDAP_OPERATIONS_ERROR;

                 loguy++;

             } while (loguy <= hi && compare_entries_sv(loguy, lo, s, bc, &error) <= 0);

@@ -724,6 +736,8 @@ recurse:

                either loguy > hi or A[loguy] > A[lo] */

             do {

+                if (error)

+                    return LDAP_OPERATIONS_ERROR;

                 higuy--;

             } while (higuy > lo && compare_entries_sv(higuy, lo, s, bc, &error) >= 0);

-- 

2.17.1