|
 |
e52775 |
From 391130c60ccedb0f7650d4454141686d293dc39e Mon Sep 17 00:00:00 2001
|
|
|
e52775 |
From: Ludwig Krispenz <lkrispen@redhat.com>
|
|
|
e52775 |
Date: Tue, 20 Aug 2019 10:18:22 +0200
|
|
|
e52775 |
Subject: [PATCH] fix for 50542 crashes in filter tests
|
|
|
e52775 |
|
|
|
e52775 |
The crash is when a backentry is released, there is a call to CACHE_RETURN
|
|
|
e52775 |
and then check and free of a vlv entry.
|
|
|
e52775 |
But CACHE_RETURN, under some conditions, can free the backentry - the following check will
|
|
|
e52775 |
dereference a NULL entry and crashes
|
|
|
e52775 |
|
|
|
e52775 |
Fix: Reverse the order of freeing vlv entry and returning entry to cache
|
|
|
e52775 |
|
|
|
e52775 |
Note: Viktor did successfully runthe tests, thanks
|
|
|
e52775 |
|
|
|
e52775 |
Reviewed by: ?
|
|
|
e52775 |
---
|
|
|
e52775 |
ldap/servers/slapd/back-ldbm/ldbm_search.c | 4 ++--
|
|
|
e52775 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
e52775 |
|
|
|
e52775 |
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
|
|
|
e52775 |
index c8f5719e1..2ad8f743a 100644
|
|
|
e52775 |
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
|
|
|
e52775 |
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
|
|
|
e52775 |
@@ -1896,13 +1896,13 @@ ldbm_back_entry_release(Slapi_PBlock *pb, void *backend_info_ptr)
|
|
|
e52775 |
slapi_pblock_get(pb, SLAPI_BACKEND, &be);
|
|
|
e52775 |
inst = (ldbm_instance *)be->be_instance_info;
|
|
|
e52775 |
|
|
|
e52775 |
- CACHE_RETURN(&inst->inst_cache, (struct backentry **)&backend_info_ptr);
|
|
|
e52775 |
-
|
|
|
e52775 |
if (((struct backentry *)backend_info_ptr)->ep_vlventry != NULL) {
|
|
|
e52775 |
/* This entry was created during a vlv search whose acl check failed. It needs to be
|
|
|
e52775 |
* freed here */
|
|
|
e52775 |
slapi_entry_free(((struct backentry *)backend_info_ptr)->ep_vlventry);
|
|
|
e52775 |
((struct backentry *)backend_info_ptr)->ep_vlventry = NULL;
|
|
|
e52775 |
}
|
|
|
e52775 |
+ CACHE_RETURN(&inst->inst_cache, (struct backentry **)&backend_info_ptr);
|
|
|
e52775 |
+
|
|
|
e52775 |
return 0;
|
|
|
e52775 |
}
|
|
|
e52775 |
--
|
|
|
e52775 |
2.24.1
|
|
|
e52775 |
|