[389-ds-base] branch 389-ds-base-1.3.7 updated (9109af6 -> 3fb1c40)

[git repository hosting]

This is an automated email from the git hooks/post-receive script.

mreynolds pushed a change to branch 389-ds-base-1.3.7
in repository 389-ds-base.

      from  9109af6   Ticket 49449 - Load sysctl values on rpm upgrade.
       new  3fb1c40   Ticket 49471 - heap-buffer-overflow in ss_unescape

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "adds" were already present in the repository and have only
been added to this reference.


Summary of changes:
 dirsrvtests/tests/tickets/ticket49471_test.py | 79 +++++++++++++++++++++++++++
 ldap/servers/plugins/collation/orfilter.c     | 14 +++--
 2 files changed, 87 insertions(+), 6 deletions(-)
 create mode 100644 dirsrvtests/tests/tickets/ticket49471_test.py

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.

[389-ds-base] 01/01: Ticket 49471 - heap-buffer-overflow in ss_unescape

[git repository hosting]

This is an automated email from the git hooks/post-receive script.

mreynolds pushed a commit to branch 389-ds-base-1.3.7
in repository 389-ds-base.

commit 3fb1c408cb4065de8d9c0c1de050d08969d51bb0
Author: Thierry Bordaz <tbordaz(a)redhat.com&gt;
Date:   Wed Dec 6 15:14:57 2017 +0100

    Ticket 49471 - heap-buffer-overflow in ss_unescape
    
    Bug Description:
    	Two problems here
    		- when searching for wildcard and escape char, ss_unescape assumes the string
    		  is at least 3 chars longs. So memcmp can overflow a shorter string
    		- while splitting a string into substring pattern, it loops over
    		  wildcard and can overpass the string end
    
    Fix Description:
    	For the first problem, it checks the string size is long enough to memcmp
            a wildcard or an escape
    	For the second it exits from the loop  as soon as the end of the string is reached
    
    https://pagure.io/389-ds-base/issue/49471
    
    Reviewed by: William Brown
    
    Platforms tested: F23
    
    Flag Day: no
    
    Doc impact: no
    
    (cherry picked from commit 5991388ce75fba8885579b769711d57acfd43cd3)
---
 dirsrvtests/tests/tickets/ticket49471_test.py | 79 +++++++++++++++++++++++++++
 ldap/servers/plugins/collation/orfilter.c     | 14 +++--
 2 files changed, 87 insertions(+), 6 deletions(-)

diff --git a/dirsrvtests/tests/tickets/ticket49471_test.py
b/dirsrvtests/tests/tickets/ticket49471_test.py
new file mode 100644
index 0000000..0456a51
--- /dev/null
+++ b/dirsrvtests/tests/tickets/ticket49471_test.py
@@ -0,0 +1,79 @@
+import logging
+import pytest
+import os
+import time
+import ldap
+from lib389._constants import *
+from lib389.topologies import topology_st as topo
+from lib389 import Entry
+
+DEBUGGING = os.getenv("DEBUGGING", default=False)
+if DEBUGGING:
+    logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+    logging.getLogger(__name__).setLevel(logging.INFO)
+log = logging.getLogger(__name__)
+
+
+USER_CN='user_'
+def _user_get_dn(no):
+    cn = '%s%d' % (USER_CN, no)
+    dn = 'cn=%s,ou=people,%s' % (cn, SUFFIX)
+    return (cn, dn)
+
+def add_user(server, no, desc='dummy', sleep=True):
+    (cn, dn) = _user_get_dn(no)
+    log.fatal('Adding user (%s): ' % dn)
+    server.add_s(Entry((dn, {'objectclass': ['top', 'person',
'inetuser', 'userSecurityInformation'],
+                             'cn': [cn],
+                             'description': [desc],
+                             'sn': [cn],
+                             'description': ['add on that host']})))
+    if sleep:
+        time.sleep(2)
+
+def test_ticket49471(topo):
+    """Specify a test case purpose or name here
+
+    :id: 457ab172-9455-4eb2-89a0-150e3de5993f
+    :setup: Fill in set up configuration here
+    :steps:
+        1. Fill in test case steps here
+        2. And indent them like this (RST format requirement)
+    :expectedresults:
+        1. Fill in the result that is expected
+        2. For each test step
+    """
+
+    # If you need any test suite initialization,
+    # please, write additional fixture for that (including finalizer).
+    # Topology for suites are predefined in lib389/topologies.py.
+
+    # If you need host, port or any other data about instance,
+    # Please, use the instance object attributes for that (for example,
topo.ms["master1"].serverid)
+
+    S1 = topo.standalone
+    add_user(S1, 1)
+
+    Filter = "(description:2.16.840.1.113730.3.3.2.1.1.6:=\*on\*)"
+    ents = S1.search_s(SUFFIX, ldap.SCOPE_SUBTREE, Filter)
+    assert len(ents) == 1
+
+    #
+    # The following is for the test 49491
+    # skipped here else it crashes in ASAN
+    #Filter = "(description:2.16.840.1.113730.3.3.2.1.1.6:=\*host)"
+    #ents = S1.search_s(SUFFIX, ldap.SCOPE_SUBTREE, Filter)
+    #assert len(ents) == 1
+
+    if DEBUGGING:
+        # Add debugging steps(if any)...
+        pass
+
+
+if __name__ == '__main__':
+    # Run isolated
+    # -s for DEBUG mode
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main("-s %s" % CURRENT_FILE)
+
diff --git a/ldap/servers/plugins/collation/orfilter.c
b/ldap/servers/plugins/collation/orfilter.c
index 5a2d8a0..a98d902 100644
--- a/ldap/servers/plugins/collation/orfilter.c
+++ b/ldap/servers/plugins/collation/orfilter.c
@@ -313,12 +313,12 @@ ss_unescape(struct berval *val)
     char *t = s;
     char *limit = s + val->bv_len;
     while (s < limit) {
-        if (!memcmp(s, "\\2a", 3) ||
-            !memcmp(s, "\\2A", 3)) {
+        if (((limit - s) >= 3) &&
+                (!memcmp(s, "\\2a", 3) || !memcmp(s, "\\2A", 3))) {
             *t++ = WILDCARD;
             s += 3;
-        } else if (!memcmp(s, "\\5c", 3) ||
-                   !memcmp(s, "\\5C", 3)) {
+        } else if ((limit - s) >= 3 &&
+                (!memcmp(s, "\\5c", 3) || !memcmp(s, "\\5C", 3))) {
             *t++ = '\\';
             s += 3;
         } else {
@@ -409,13 +409,15 @@ ss_filter_values(struct berval *pattern, int *query_op)
         switch (*p) {
         case WILDCARD:
             result[n++] = ss_filter_value(s, p - s, &val);
-            while (++p != plimit && *p == WILDCARD)
-                ;
+            while (p != plimit && *p == WILDCARD) p++;
             s = p;
             break;
         default:
             break;
         }
+        if (p >= plimit) {
+            break;
+        }
     }
     if (p != s || s == plimit) {
         result[n++] = ss_filter_value(s, p - s, &val);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.