(ITS#5432) syncrepl seg. faults if received a sync cookie with an empty csn= value

[rein]

Full_Name: Rein Tollevik
Version: 2.4.8
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (84.215.2.34)


The attached patch fixes a seg. fault in compare_csns() in syncrepl.c if it
receives a sync cookie with an empty "csn=" value.

syncprov_playlog() in syncprov.c generates such invalid cookies when replaying a
sessionlog where no entries has been deleted.  The patch also fixes this bug.

Rein Tollevik
Basefarm AS

Index: OpenLDAP/servers/slapd/syncrepl.c
diff -u OpenLDAP/servers/slapd/syncrepl.c:1.6
OpenLDAP/servers/slapd/syncrepl.c:1.7
--- OpenLDAP/servers/slapd/syncrepl.c:1.6       Fri Mar 14 16:27:41 2008
+++ OpenLDAP/servers/slapd/syncrepl.c   Tue Mar 18 17:15:30 2008
@@ -669,8 +669,8 @@
                return -1;
        }
 
-       for (i=0; !BER_BVISNULL( &sc1->ctxcsn[i] ); i++) {
-               for (j=0; !BER_BVISNULL( &sc2->ctxcsn[j] ); j++) {
+       for (i=0; !BER_BVISEMPTY( &sc1->ctxcsn[i] ); i++) {
+               for (j=0; !BER_BVISEMPTY( &sc2->ctxcsn[j] ); j++) {
                        if ( sc1->sids[i] != sc2->sids[j] )
                                continue;
                        value_match( &match, slap_schema.si_ad_entryCSN,
Index: OpenLDAP/servers/slapd/overlays/syncprov.c
diff -u OpenLDAP/servers/slapd/overlays/syncprov.c:1.5
OpenLDAP/servers/slapd/overlays/syncprov.c:1.6
--- OpenLDAP/servers/slapd/overlays/syncprov.c:1.5      Fri Mar 14 16:23:48 2008
+++ OpenLDAP/servers/slapd/overlays/syncprov.c  Tue Mar 18 17:22:41 2008
@@ -1413,8 +1413,7 @@
                num * UUID_LEN, op->o_tmpmemctx );
        uuids[0].bv_val = (char *)(uuids + num + 1);
 
-       delcsn[0].bv_len = 0;
-       delcsn[0].bv_val = cbuf;
+       BER_BVZERO(&delcsn[0]);
        BER_BVZERO(&delcsn[1]);
 
        /* Make a copy of the relevant UUIDs. Put the Deletes up front
@@ -1453,6 +1452,7 @@
                        i++;
                        AC_MEMCPY( cbuf, se->se_csn.bv_val, se->se_csn.bv_len );
                        delcsn[0].bv_len = se->se_csn.bv_len;
+                       delcsn[0].bv_val = cbuf;
                        delcsn[0].bv_val[delcsn[0].bv_len] = '\0';
                } else {
                        nmods++;