ldap/servers

[Noriko Hosoi]

ldap/servers/plugins/acl/aclparse.c |   26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

New commits:
commit b65b3c97847edefe8e9242e5bac294dd13e73234
Author: Noriko Hosoi 
Date:   Tue Apr 27 10:31:49 2010 -0700

585905 - ACL with targattrfilters error crashes the server

https://bugzilla.redhat.com/show_bug.cgi?id=585905

Bug Description:
    targattrfilters takes this format of value:
     (targattrfilters="add=attr1:F1 && attr2:F2... &&
      attrn:Fn,del=attr1:F1 && attr2:F2 ... && attrn:Fn")
    The ACL plugin code had blindly expected the value contains
    the operator "add" or "del" and '=' to concatenate the
    attribute and filter pair.  The plugin should have checked
    the possibility that the value does not follow the format.

Fix Description:
    If '=' is not included in the targattrfilters value, the
    ACL parser returns ACL_SYNTAX_ERR.  Also, adding a check
    code for the returned pointer from strchr and strstr.

diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index 0c8d0fa..80fcfa0 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -291,6 +291,9 @@ __aclp__parse_aci (char 	*str, aci_t  *aci_item)
    		}

tmpstr = strchr(str, '=');
+			if (NULL == tmpstr) {
+				return ACL_SYNTAX_ERR;
+			}
    		tmpstr++;
    		__acl_strip_leading_space(&tmpstr);

@@ -777,6 +780,9 @@ normalize_nextACERule:
    		}
    	} else if ( 0 == strncmp ( s, DS_LAS_USERDN, 6)) {
    		p = strstr ( s, "=");
+			if (NULL == p) {
+				goto error;
+			}
    		p--;
    		if ( strncmp (p, "!=", 2) == 0)
    			aci_item->aci_type |= ACI_CONTAIN_NOT_USERDN;
@@ -840,6 +846,9 @@ normalize_nextACERule:
    	} else if ( 0 == strncmp ( s, DS_LAS_GROUPDN, 7)) {

p = strstr ( s, "=");
+			if (NULL == p) {
+				goto error;
+			}
    		p--;
    		if ( strncmp (p, "!=", 2) == 0)
    			aci_item->aci_type |= ACI_CONTAIN_NOT_GROUPDN;
@@ -860,6 +869,9 @@ normalize_nextACERule:
    	} else if ( 0 == strncmp ( s, DS_LAS_ROLEDN, 6)) {

p = strstr ( s, "=");
+			if (NULL == p) {
+				goto error;
+			}
    		p--;
    		if ( strncmp (p, "!=", 2) == 0)
    			aci_item->aci_type |= ACI_CONTAIN_NOT_ROLEDN;
@@ -1270,6 +1282,9 @@ __aclp__init_targetattr (aci_t *aci, char *attr_val)
    Targetattr	*attr = NULL;

s = strchr (attr_val, '=');
+	if (NULL == s) {
+		return ACL_SYNTAX_ERR;
+	}
    s++;
    __acl_strip_leading_space(&s);
    __acl_strip_trailing_space(s);
@@ -1695,6 +1710,9 @@ static int __acl__init_targetattrfilters( aci_t *aci, char *input_str) {
     /* First, skip the "targetattrfilters"  */

s = strchr (input_str, '=');
+    if (NULL == s) {
+        return ACL_SYNTAX_ERR;
+    }
     s++;							/* skip the = */
     __acl_strip_leading_space(&s);	/* skip to next significant character */
     __acl_strip_trailing_space(s);
@@ -1720,6 +1738,9 @@ static int __acl__init_targetattrfilters( aci_t *aci, char *input_str) {
     */

s = strchr (str, '=');
+    if (NULL == s) {
+        return ACL_SYNTAX_ERR;
+    }
     *s = '\0';
     s++;							/* skip the = */
     __acl_strip_leading_space(&s);	/* start of the first filter list */
@@ -1769,7 +1790,10 @@ static int __acl__init_targetattrfilters( aci_t *aci, char *input_str) {
    if (str != NULL ){

__acl_strip_leading_space(&str);
-    	s = strchr (str, '=');
+		s = strchr (str, '=');
+		if (NULL == s) {
+			return ACL_SYNTAX_ERR;
+		}
    	*s = '\0';
    	s++;
    	__acl_strip_trailing_space(str);