From 896091407c244ed151f2fad39a82881a6e991d26 Mon Sep 17 00:00:00 2001

From: Rich Megginson <rmeggins@redhat.com>

Date: Tue, 29 Oct 2013 13:47:35 -0600

Subject: [PATCH] Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches

https://fedorahosted.org/389/ticket/47605

Reviewed by: nhosoi (Thanks!)

Branch: 389-ds-base-1.3.1

Fix Description: The traversal of the attr list looking for GER objectclasses

was modifying the same attribute twice, removing the "@" from it.  The second

time, since there was no "@" in the string, the strchr would return NULL, and

the code would not check for it.

The code was simplified and rewritten to use charray_merge_nodup

to build the gerattrs list with unique objectclass values, which I believe was

the intention of the original code.  I also added some error checking to look

for invalid attributes like "@name" "name@" and "name@name@name".

Platforms tested: RHEL6 x86_64

Flag Day: no

Doc impact: no

(cherry picked from commit 7e03702932546e74f0044d11832e7e7e395cbb36)

(cherry picked from commit 12e54af6982ab5406f4bba6a02dd0724a0415501)

(cherry picked from commit 8c5e74b291d08c66e0afbf766f77f955725b9bf4)

---

 ldap/servers/slapd/search.c |   79 +++++++++----------------------------------

 1 files changed, 16 insertions(+), 63 deletions(-)

diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c

index da1772f..59c4afb 100644

--- a/ldap/servers/slapd/search.c

+++ b/ldap/servers/slapd/search.c

@@ -246,8 +246,6 @@ do_search( Slapi_PBlock *pb )

 	}

 	if ( attrs != NULL ) {

-		int gerattrsiz = 1;

-		int gerattridx = 0;

 		int aciin = 0;

 		/* 

 		 * . store gerattrs if any

@@ -257,66 +255,25 @@ do_search( Slapi_PBlock *pb )

 		{

 			char *p = NULL;

 			/* check if @<objectclass> is included */

-			p =  strchr(attrs[i], '@');

-			if ( p && '\0' != *(p+1) )	/* don't store "*@", e.g. */

+			p = strchr(attrs[i], '@');

+			if ( p )

 			{

-				int j = 0;

-				if (gerattridx + 1 >= gerattrsiz)

+				char *dummyary[2]; /* need a char ** for charray_merge_nodup */

+				if ((*(p + 1) == '\0') || (p == attrs[i]) || (strchr(p+1, '@'))) /* e.g. "foo@" or "@objectclassname" or "foo@bar@baz" */

 				{

-					char **tmpgerattrs;

-					gerattrsiz *= 2;

-					tmpgerattrs = 

-						(char **)slapi_ch_calloc(1, gerattrsiz*sizeof(char *));

-					if (NULL != gerattrs)

-					{

-						memcpy(tmpgerattrs, gerattrs, gerattrsiz*sizeof(char *));

-						slapi_ch_free((void **)&gerattrs);

-					}

-					gerattrs = tmpgerattrs;

-				}

-				for ( j = 0; gerattrs; j++ )

-				{

-					char *attri = NULL;

-					if ( NULL == gerattrs[j] )

-					{

-						if (0 == j)

-						{

-							/* first time */

-							gerattrs[gerattridx++] = attrs[i];

-							/* get rid of "@<objectclass>" part from the attr

-							   list, which is needed only in gerattr list */

-							*p = '\0';

-							attri = slapi_ch_strdup(attrs[i]);

-							attrs[i] = attri;

-							*p = '@';

-						}

-						else

-						{

-							break; /* done */

-						}

-					}

-					else if ( 0 == strcasecmp( attrs[i], gerattrs[j] ))

-					{

-						/* skip if attrs[i] is already in gerattrs */

-						continue;

-					}

-					else

-					{

-						char *q = strchr(gerattrs[j], '@'); /* q never be 0 */

-						if ( 0 != strcasecmp( p+1, q+1 ))

-						{

-							/* you don't want to display the same template

-							   entry multiple times */

-							gerattrs[gerattridx++] = attrs[i];

-						}

-						/* get rid of "@<objectclass>" part from the attr 

-						   list, which is needed only in gerattr list */

-						*p = '\0';

-						attri = slapi_ch_strdup(attrs[i]);

-						attrs[i] = attri;

-						*p = '@';

-					}

+					slapi_log_error( SLAPI_LOG_ARGS, "do_search",

+					                 "invalid attribute [%s] in list - must be of the form "

+					                 "attributename@objectclassname where attributename is the "

+					                 "name of an attribute or \"*\" or \"+\" and objectclassname "

+					                 "is the name of an objectclass\n", attrs[i] );

+					continue;

 				}

+				dummyary[0] = p; /* p = @objectclassname */

+				dummyary[1] = NULL;

+				/* copy string to gerattrs with leading @ - disallow dups */

+				charray_merge_nodup(&gerattrs, dummyary, 1);

+				/* null terminate the attribute name at the @ after it has been copied */

+				*p = '\0';

 			}

 			else if ( !aciin && strcasecmp(attrs[i], LDAP_ALL_USER_ATTRS) == 0 )

 			{

@@ -324,10 +281,6 @@ do_search( Slapi_PBlock *pb )

 				aciin = 1;

 			}

 		}

-		if (NULL != gerattrs)

-		{

-			gerattrs[gerattridx] = NULL;

-		}

 		if (config_get_return_orig_type_switch()) {

 			/* return the original type, e.g., "sn (surname)" */

-- 

1.7.1