[389-ds-base] branch master updated (677a502 -> 6aa2acd)

[git repository hosting]

This is an automated email from the git hooks/post-receive script.

lkrispen pushed a change to branch master
in repository 389-ds-base.

      from  677a502   Ticket 49554 - update readme
       new  6aa2acd   CVE-2017-15134 389-ds-base: Remote DoS via search filters in 
slapi_filter_sprintf

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "adds" were already present in the repository and have only
been added to this reference.


Summary of changes:
 ldap/servers/slapd/util.c | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.

[389-ds-base] 01/01: CVE-2017-15134 389-ds-base: Remote DoS via search filters in slapi_filter_sprintf

[git repository hosting]

This is an automated email from the git hooks/post-receive script.

lkrispen pushed a commit to branch master
in repository 389-ds-base.

commit 6aa2acdc3cad97ebec2a6d59d479a15e89bbb3a0
Author: Ludwig Krispenz <lkrispen(a)redhat.com&gt;
Date:   Mon Jan 15 10:24:41 2018 +0100

    CVE-2017-15134 389-ds-base: Remote DoS via search filters in
     slapi_filter_sprintf
    
    Description: Improper handling of a search filter in slapi_filter_sprintf
                 in slapd/util.c can lead to remote server crash and denial
                 of service.
---
 ldap/servers/slapd/util.c | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index a72de9b..ddb2cc8 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -238,9 +238,10 @@ escape_string_for_filename(const char *str, char buf[BUFSIZ])
 struct filter_ctx
 {
     char *buf;
-    char attr[ATTRSIZE];
+    char *attr;
     int attr_position;
     int attr_found;
+    size_t attr_size;
     int buf_size;
     int buf_len;
     int next_arg_needs_esc_norm;
@@ -279,7 +280,7 @@ filter_stuff_func(void *arg, const char *val, PRUint32 slen)
      *  Start collecting the attribute name so we can use the correct
      *  syntax normalization func.
      */
-    if (ctx->attr_found == 0 && ctx->attr_position < (ATTRSIZE - 1)) {
+    if (ctx->attr_found == 0 && ctx->attr_position < (ctx->attr_size
- 1)) {
         if (ctx->attr[0] == '\0') {
             if (strstr(val, "=")) {
                 /* we have an attr we need to record */
@@ -293,6 +294,14 @@ filter_stuff_func(void *arg, const char *val, PRUint32 slen)
                  *  attr with val.  The next pass should be '=', otherwise we
will
                  *  reset it.
                  */
+                if (slen > ctx->attr_size) {
+                    if (ctx->attr_size == ATTRSIZE) {
+                        ctx->attr = slapi_ch_calloc(sizeof(char), slen+1);
+                    } else {
+                        ctx->attr = slapi_ch_realloc(ctx->attr, sizeof(char) *
(slen+1));
+                    }
+                    ctx->attr_size = slen+1;
+                }
                 memcpy(ctx->attr, val, slen);
                 ctx->attr_position = slen;
             }
@@ -302,9 +311,20 @@ filter_stuff_func(void *arg, const char *val, PRUint32 slen)
             } else {
                 if (special_attr_char(val[0])) {
                     /* this is not an attribute, we should not be collecting this, reset
everything */
-                    memset(ctx->attr, '\0', ATTRSIZE);
+                    memset(ctx->attr, '\0', ctx->attr_size);
                     ctx->attr_position = 0;
                 } else {
+                    /* we can be adding char by char and overrun allocated size */
+                    if (ctx->attr_position >= ctx->attr_size) {
+                        if (ctx->attr_size == ATTRSIZE) {
+                            char *ctxattr = slapi_ch_calloc(sizeof(char),
ctx->attr_size + ATTRSIZE);
+                            memcpy(ctxattr, ctx->attr, ctx->attr_size);
+                            ctx->attr = ctxattr;
+                        } else {
+                            ctx->attr = slapi_ch_realloc(ctx->attr, sizeof(char) *
(ctx->attr_size + ATTRSIZE));
+                        }
+                        ctx->attr_size = ctx->attr_size + ATTRSIZE;
+                    }
                     memcpy(ctx->attr + ctx->attr_position, val, 1);
                     ctx->attr_position++;
                 }
@@ -377,7 +397,7 @@ filter_stuff_func(void *arg, const char *val, PRUint32 slen)
         ctx->next_arg_needs_esc_norm = 0;
         ctx->attr_found = 0;
         ctx->attr_position = 0;
-        memset(ctx->attr, '\0', ATTRSIZE);
+        memset(ctx->attr, '\0', ctx->attr_size);
         slapi_ch_free_string(&buf);
 
         return filter_len;
@@ -416,12 +436,14 @@ slapi_filter_sprintf(const char *fmt, ...)
 {
     struct filter_ctx ctx = {0};
     va_list args;
+    char attr_static[ATTRSIZE] = {0};
     char *buf;
     int rc;
 
     buf = slapi_ch_calloc(sizeof(char), FILTER_BUF + 1);
     ctx.buf = buf;
-    memset(ctx.attr, '\0', ATTRSIZE);
+    ctx.attr = attr_static;
+    ctx.attr_size = ATTRSIZE;
     ctx.attr_position = 0;
     ctx.attr_found = 0;
     ctx.buf_len = FILTER_BUF;
@@ -438,6 +460,10 @@ slapi_filter_sprintf(const char *fmt, ...)
     }
     va_end(args);
 
+    if (ctx.attr_size > ATTRSIZE) {
+        slapi_ch_free_string(&ctx.attr);
+    }
+
     return ctx.buf;
 }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.