[
https://issues.apache.org/jira/browse/DIRAPI-436?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emmanuel Lécharny resolved DIRAPI-436.
--------------------------------------
Resolution: Fixed
Fixed with commit 6b4f6a1ee7cda903dd2c9583032f9d485c54be6a
> A not terminated ObjectClass element in a schema will loop and kill the JVM
> with a OOM
> --------------------------------------------------------------------------------------
>
> Key: DIRAPI-436
> URL: https://issues.apache.org/jira/browse/DIRAPI-436
> Project: Directory Client API
> Issue Type: Bug
> Affects Versions: 2.1.7
> Reporter: Emmanuel Lécharny
> Priority: Minor
> Fix For: 2.1.8
>
>
> Reported by [email protected]
> The hand-written *OpenLdapSchemaParser* (which backs every schema-description
> parser, e.g. *ObjectClassDescriptionSchemaParser*) parses an OID list with
> the loop :
> {code:java}
> while ( !startsWith( reader, pos, RPAREN ) )
> {
> oids.add(getOidStrict( pos ) ); ...
> }
> {code}
> When the value ends inside the list (noclosing ')'), *getOidStrict()* hits
> end-of-input and returns "" without advancing the position, and the following
> *skipWhites(reader, pos, false)*
> neither advances nor throws;
> the loop condition therefore stays true forever. The parser spins at 100% CPU
> and adds "" to the oids ArrayList on every iteration, so heap is exhausted as
> well.
> Because a client that calls *loadSchema()* parses the server's cn=subschema
> values with these parsers, a malicious or MITM LDAP server can hang and then
> OOM the client with a
> roughly 12-byte attribute value.
> This is a distinct string-parser defect from the BER-codec filter-depth and
> PDU-size limits added on the default branch — neither of those bounds this
> parser.
> An example of wrongly formatted schema element is :
> {code:java}
> "ObjectClass ( 1.2.3 MUST ("
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
