Commit adb2b2fe authored by Bradley Nicholes's avatar Bradley Nicholes
Browse files

mod_ldap: Fix PR 36563. Keep track of the number of attributes retrieved from... 

mod_ldap: Fix PR 36563. Keep track of the number of attributes retrieved from LDAP so that all of the values can be properly cached even if the value is NULL.

Reviewed by: bnicholes, minfrin, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@291123 13f79535-47bb-0310-9956-ffa450edef68
parent fbb2c1aa

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.55









  *) mod_ldap: Fix PR 36563. Keep track of the number of attributes









     retrieved from LDAP so that all of the values can be properly 









     cached even if the value is NULL. 









     [Brad Nicholes, Ondrej Sury <ondrej sury.org>]









       









  *) SECURITY: CAN-2005-2491 (cve.mitre.org): 









     Fix integer overflows in PCRE in quantifier parsing which could









     be triggered by a local user through use of a carefully-crafted 


































STATUS



+0
−8



























Changes for STATUS: 0 added lines, 8 removed lines.



Original line number
Diff line number
Diff line







@@ -266,14 +266,6 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:







                 algorithims can be pretty "interesting", probably more









                 2.2. 



















    *) mod_ldap: Fix PR 36563. Keep track of the number of attributes









       retrieved from LDAP so that all of the values can be properly 









       cached even if the value is NULL.









         http://issues.apache.org/bugzilla/attachment.cgi?id=16429









	 or 









	 http://svn.apache.org/viewcvs.cgi?rev=156587&view=rev









       +1: bnicholes, minfrin, jim



















PATCHES TO BACKPORT THAT ARE ON HOLD OR NOT GOING ANYWHERE SOON:



















    *) Replace some of the mutex locking in the worker MPM with


































modules/experimental/util_ldap.c



+6
−0



























Changes for modules/experimental/util_ldap.c: 6 added lines, 0 removed lines.



Original line number
Diff line number
Diff line







@@ -769,6 +769,7 @@ LDAP_DECLARE(int) util_ldap_cache_checkuserid(request_rec *r, util_ldap_connecti







                              const char ***retvals)









{









    const char **vals = NULL;









    int numvals = 0;









    int result = 0;









    LDAPMessage *res, *entry;









    char *dn;










@@ -932,6 +933,7 @@ start_over:







        int i = 0;









        while (attrs[k++]);









        vals = apr_pcalloc(r->pool, sizeof(char *) * (k+1));









        numvals = k;









        while (attrs[i]) {









            char **values;









            int j = 0;










@@ -959,6 +961,7 @@ start_over:







        the_search_node.bindpw = bindpw;









        the_search_node.lastbind = apr_time_now();









        the_search_node.vals = vals;









        the_search_node.numvals = numvals;



















        /* Search again to make sure that another thread didn't ready insert this node









           into the cache before we got here. If it does exist then update the lastbind */










@@ -1001,6 +1004,7 @@ LDAP_DECLARE(int) util_ldap_cache_getuserdn(request_rec *r, util_ldap_connection







                              const char ***retvals)









{









    const char **vals = NULL;









    int numvals = 0;









    int result = 0;









    LDAPMessage *res, *entry;









    char *dn;










@@ -1115,6 +1119,7 @@ start_over:







        int i = 0;









        while (attrs[k++]);









        vals = apr_pcalloc(r->pool, sizeof(char *) * (k+1));









        numvals = k;









        while (attrs[i]) {









            char **values;









            int j = 0;










@@ -1142,6 +1147,7 @@ start_over:







        the_search_node.bindpw = NULL;









        the_search_node.lastbind = apr_time_now();









        the_search_node.vals = vals;









        the_search_node.numvals = numvals;



















        /* Search again to make sure that another thread didn't ready insert this node









           into the cache before we got here. If it does exist then update the lastbind */


































modules/experimental/util_ldap_cache.c



+13
−5



























Changes for modules/experimental/util_ldap_cache.c: 13 added lines, 5 removed lines.



Original line number
Diff line number
Diff line







@@ -158,18 +158,22 @@ void *util_ldap_search_node_copy(util_ald_cache_t *cache, void *c)

















        /* copy vals */









        if (node->vals) {









            int k = 0;









            int k = node->numvals;









            int i = 0;









            while (node->vals[k++]);









            if (!(newnode->vals = util_ald_alloc(cache, sizeof(char *) * (k+1)))) {









                util_ldap_search_node_free(cache, newnode);









                return NULL;









            }









            while (node->vals[i]) {









            newnode->numvals = node->numvals;









            for (;k;k--) {









                if (node->vals[i]) {









                    if (!(newnode->vals[i] = util_ald_strdup(cache, node->vals[i]))) {









                        util_ldap_search_node_free(cache, newnode);









                        return NULL;









                    }









                }









                else









                    newnode->vals[i] = NULL;









                i++;









            }









        }










@@ -199,9 +203,13 @@ void util_ldap_search_node_free(util_ald_cache_t *cache, void *n)







{









    int i = 0;









    util_search_node_t *node = (util_search_node_t *)n;









    int k = node->numvals;



















    if (node->vals) {









        while (node->vals[i]) {









            util_ald_free(cache, node->vals[i++]);









        for (;k;k--,i++) {









            if (node->vals[i]) {









                util_ald_free(cache, node->vals[i]);









            }









        }









        util_ald_free(cache, node->vals);









    }


































modules/experimental/util_ldap_cache.h



+1
−0



























Changes for modules/experimental/util_ldap_cache.h: 1 added line, 0 removed lines.



Original line number
Diff line number
Diff line







@@ -110,6 +110,7 @@ typedef struct util_search_node_t {







					   NULL if the bind failed */









    apr_time_t lastbind;		/* Time of last successful bind */









    const char **vals;			/* Values of queried attributes */









    int        numvals;			/* Number of queried attributes */









} util_search_node_t;



















/*