Emmanuel Lécharny created DIRAPI-436:
----------------------------------------
Summary: A not terminated ObjectClass element in a schema will
loop and kill the JVM with a OOM
Key: DIRAPI-436
URL: https://issues.apache.org/jira/browse/DIRAPI-436
Project: Directory Client API
Issue Type: Bug
Affects Versions: 2.1.7
Reporter: Emmanuel Lécharny
Fix For: 2.1.8
Reported by [email protected]
The hand-written *OpenLdapSchemaParser* (which backs every schema-description
parser, e.g. *ObjectClassDescriptionSchemaParser*) parses an OID list with
the loop :
{code:java}
while ( !startsWith( reader, pos, RPAREN ) )
{
oids.add(getOidStrict( pos ) ); ...
}
{code}
When the value ends inside the list (noclosing ')'), *getOidStrict()* hits
end-of-input and returns "" without advancing the position, and the following
*skipWhites(reader, pos, false)*
neither advances nor throws;
the loop condition therefore stays true forever. The parser spins at 100% CPU
and adds "" to the oids ArrayList on every iteration, so heap is exhausted as
well.
Because a client that calls *loadSchema()* parses the server's cn=subschema
values with these parsers, a malicious or MITM LDAP server can hang and then
OOM the client with a
roughly 12-byte attribute value.
This is a distinct string-parser defect from the BER-codec filter-depth and
PDU-size limits added on the default branch — neither of those bounds this
parser.
An example of wrongly formatted schema element is :
{code:java}
"ObjectClass ( 1.2.3 MUST ("
{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
