From a7a0db402b32dcec7fc93bcbef42174163ae9c12 Mon Sep 17 00:00:00 2001

From: Ludwig Krispenz <lkrispen@redhat.com>

Date: Tue, 12 Dec 2017 12:46:37 +0100

Subject: [PATCH] Ticket 49493 - heap use after free in csn_as_string

Bug: If write_changlog_and_ruv failed teh csn pending list was not properly

     cleand and references to the prim csn were kept, but the prim csn was reset

Fix: check the return code for the mmr postop plugin and aset error codes properly

     that will triger cancel_opcsn

Reviewed by: Thierry, thanks

Tested by: Viktor, thanks

---

 ldap/servers/slapd/back-ldbm/ldbm_add.c        | 22 +---------------------

 ldap/servers/slapd/back-ldbm/ldbm_delete.c     |  4 ++++

 ldap/servers/slapd/back-ldbm/ldbm_modify.c     |  4 ++++

 ldap/servers/slapd/back-ldbm/ldbm_modrdn.c     |  4 ++++

 ldap/servers/slapd/back-ldbm/misc.c            | 18 ++++++++++++++++++

 ldap/servers/slapd/back-ldbm/proto-back-ldbm.h |  1 +

 6 files changed, 32 insertions(+), 21 deletions(-)

diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c

index b7e17ad50..f29945a7e 100644

--- a/ldap/servers/slapd/back-ldbm/ldbm_add.c

+++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c

@@ -22,7 +22,6 @@ extern char *hassubordinates;

 static void delete_update_entrydn_operational_attributes(struct backentry *ep);

-static int set_error(Slapi_PBlock *pb, int retval, int ldap_result_code, char **ldap_result_message);

 #define ADD_SET_ERROR(rc, error, count)                                            \

     {                                                                              \

         (rc) = (error);                                                            \

@@ -1201,7 +1200,7 @@ ldbm_back_add(Slapi_PBlock *pb)

     retval = plugin_call_mmr_plugin_postop(pb, NULL,SLAPI_PLUGIN_BE_TXN_POST_ADD_FN);

     if (retval) {

-        set_error(pb, retval, ldap_result_code, &ldap_result_message);

+        ldbm_set_error(pb, retval, &ldap_result_code, &ldap_result_message);

         goto error_return;

     }

@@ -1471,22 +1470,3 @@ delete_update_entrydn_operational_attributes(struct backentry *ep)

     slapi_entry_attr_delete(ep->ep_entry, LDBM_ENTRYDN_STR);

 }

-static int

-set_error(Slapi_PBlock *pb, int retval, int ldap_result_code, char **ldap_result_message)

-{

-    int opreturn = 0;

-    if (!ldap_result_code) {

-        slapi_pblock_get(pb, SLAPI_RESULT_CODE, &ldap_result_code);

-    }

-    if (!ldap_result_code) {

-        ldap_result_code = LDAP_OPERATIONS_ERROR;

-        slapi_pblock_set(pb, SLAPI_RESULT_CODE, &ldap_result_code);

-    }

-    slapi_pblock_get(pb, SLAPI_PLUGIN_OPRETURN, &opreturn);

-    if (!opreturn) {

-        slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, ldap_result_code ? &ldap_result_code : &retval);

-    }

-    slapi_pblock_get(pb, SLAPI_PB_RESULT_TEXT, &ldap_result_message);

-

-    return opreturn;

-}

diff --git a/ldap/servers/slapd/back-ldbm/ldbm_delete.c b/ldap/servers/slapd/back-ldbm/ldbm_delete.c

index db463c18c..be0db1bd0 100644

--- a/ldap/servers/slapd/back-ldbm/ldbm_delete.c

+++ b/ldap/servers/slapd/back-ldbm/ldbm_delete.c

@@ -1276,6 +1276,10 @@ replace_entry:

     }

     retval = plugin_call_mmr_plugin_postop(pb, NULL,SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN);

+    if (retval) {

+        ldbm_set_error(pb, retval, &ldap_result_code, &ldap_result_message);

+        goto error_return;

+    }

 commit_return:

     /* Release SERIAL LOCK */

diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modify.c b/ldap/servers/slapd/back-ldbm/ldbm_modify.c

index 7ee796fd2..cc4319e5f 100644

--- a/ldap/servers/slapd/back-ldbm/ldbm_modify.c

+++ b/ldap/servers/slapd/back-ldbm/ldbm_modify.c

@@ -867,6 +867,10 @@ ldbm_back_modify(Slapi_PBlock *pb)

         goto error_return;

     }

     retval = plugin_call_mmr_plugin_postop(pb, NULL,SLAPI_PLUGIN_BE_TXN_POST_MODIFY_FN);

+    if (retval) {

+        ldbm_set_error(pb, retval, &ldap_result_code, &ldap_result_message);

+        goto error_return;

+    }

     /* Release SERIAL LOCK */

     retval = dblayer_txn_commit(be, &txn);

diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c

index 2c0cb074e..93fb77dc9 100644

--- a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c

+++ b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c

@@ -1211,6 +1211,10 @@ ldbm_back_modrdn(Slapi_PBlock *pb)

         goto error_return;

     }

 	retval = plugin_call_mmr_plugin_postop(pb, NULL,SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN);

+    if (retval) {

+        ldbm_set_error(pb, retval, &ldap_result_code, &ldap_result_message);

+        goto error_return;

+    }

     /* Release SERIAL LOCK */

     retval = dblayer_txn_commit(be, &txn);

diff --git a/ldap/servers/slapd/back-ldbm/misc.c b/ldap/servers/slapd/back-ldbm/misc.c

index df1afdfb1..c52e58a4a 100644

--- a/ldap/servers/slapd/back-ldbm/misc.c

+++ b/ldap/servers/slapd/back-ldbm/misc.c

@@ -16,6 +16,24 @@

 #include "back-ldbm.h"

+void

+ldbm_set_error(Slapi_PBlock *pb, int retval, int *ldap_result_code, char **ldap_result_message)

+{

+    int opreturn = 0;

+    if (!(*ldap_result_code)) {

+        slapi_pblock_get(pb, SLAPI_RESULT_CODE, ldap_result_code);

+    }

+    if (!(*ldap_result_code)) {

+        *ldap_result_code = LDAP_OPERATIONS_ERROR;

+        slapi_pblock_set(pb, SLAPI_RESULT_CODE, ldap_result_code);

+    }

+    slapi_pblock_get(pb, SLAPI_PLUGIN_OPRETURN, &opreturn);

+    if (!opreturn) {

+        slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, *ldap_result_code ? ldap_result_code : &retval);

+    }

+    slapi_pblock_get(pb, SLAPI_PB_RESULT_TEXT, ldap_result_message);

+}

+

 /* Takes a return code supposed to be errno or from lidb

    which we don't expect to see and prints a handy log message */

 void

diff --git a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h

index 0cee3df62..da3eef18b 100644

--- a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h

+++ b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h

@@ -379,6 +379,7 @@ int ldbm_txn_ruv_modify_context(Slapi_PBlock *pb, modify_context *mc);

 int get_value_from_string(const char *string, char *type, char **value);

 int get_values_from_string(const char *string, char *type, char ***valuearray);

 void normalize_dir(char *dir);

+void ldbm_set_error(Slapi_PBlock *pb, int retval, int *ldap_result_code, char **ldap_result_message);

 /*

  * nextid.c

-- 

2.13.6