Full_Name: Ryan Tandy
Version: RE24
OS: Debian
URL: 
Submission from: (NULL) (70.66.128.207)
Submitted by: ryan


Reported in IRC #openldap by user Dragnell, reproduced by me on current RE24.

Configure slapd like so:

-- 

include servers/slapd/schema/core.schema
include servers/slapd/schema/cosine.schema
include servers/slapd/schema/inetorgperson.schema

database config
rootpw secret

database ldap

-- 

Now try to add the following LDIF:

./clients/tools/ldapmodify -H ldap://:9000 -x -D cn=config -w secret

dn: olcOverlay=pcache,olcDatabase={1}ldap,cn=config
changetype: add
objectClass: olcPcacheConfig
olcPcache: mdb 100000 1 1000 100
olcPcacheAttrset: 0 mail
olcPcacheTemplate: "(&(objectClass=inetOrgPerson)(mail=))" 0 3600

On the first attempt, the config is rejected:

adding new entry "olcOverlay=pcache,olcDatabase={1}ldap,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
        additional info: unable to parse template: AttributeDescription contains
inappropriate characters

If you try a second time to add the same LDIF, slapd crashes:

adding new entry "olcOverlay=pcache,olcDatabase={1}ldap,cn=config"
ldap_result: Can't contact LDAP server (-1)

Thread 4 "slapd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff6cf2700 (LWP 21122)]
0x000055555559cc78 in backend_stopdown_one (bd=0x7fffec102d10) at backend.c:429
429                             LDAP_TAILQ_REMOVE( bd->be_pending_csn_list, 
csne, ce_csn_link );
(gdb) bt
#0  0x000055555559cc78 in backend_stopdown_one (bd=0x7fffec102d10) at
backend.c:429
#1  0x000055555568ea00 in pcache_db_destroy (be=0x5555558484f0, cr=0x0) at
pcache.c:4899
#2  0x000055555561ddad in overlay_destroy_one (be=0x5555558484f0,
on=0x7fffec102b30) at backover.c:1150
#3  0x0000555555574b48 in config_add_internal (cfb=0x555555765060 <cfBackInfo>,
e=0x555555873598, ca=0x7ffff6cf04f0,
    rs=0x7ffff6cf1a80, renum=0x7ffff6cf16c0, op=0x7fffec000bb0) at
bconfig.c:5318
#4  0x0000555555575131 in config_back_add (op=0x7fffec000bb0, rs=0x7ffff6cf1a80)
at bconfig.c:5457
#5  0x00005555555951c7 in fe_op_add (op=0x7fffec000bb0, rs=0x7ffff6cf1a80) at
add.c:334
#6  0x0000555555594ac6 in do_add (op=0x7fffec000bb0, rs=0x7ffff6cf1a80) at
add.c:194
#7  0x000055555558b879 in connection_operation (ctx=0x7ffff6cf1bb0,
arg_v=0x7fffec000bb0) at connection.c:1175
#8  0x000055555558bdf1 in connection_read_thread (ctx=0x7ffff6cf1bb0, argv=0x9)
at connection.c:1311
#9  0x00005555556a569d in ldap_int_thread_pool_wrapper (xpool=0x5555557fbec0) at
tpool.c:696
#10 0x00007ffff7f86fa3 in start_thread (arg=<optimized out>) at
pthread_create.c:486
#11 0x00007ffff7eb74cf in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:95

The config in the example is invalid (due to containing a value for objectClass)
and it's correct to reject it. However, slapd should not crash.

Reply via email to