Attachment 15327 Details for Bug 14049 – a patch that stops the crash

[patch] a patch that stops the crash

0001-ldb-don-t-try-to-save-a-value-that-isn-t-there.patch (text/plain), 2.24 KB, created by Douglas Bagnall on 2019-07-25 21:52:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Douglas Bagnall

Created: 2019-07-25 21:52:40 UTC

Size: 2.24 KB

patch

obsolete

>From bc33de4b6c20569b657e06fc4805566bf93e4cdb Mon Sep 17 00:00:00 2001
>From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
>Date: Fri, 26 Jul 2019 09:49:13 +1200
>Subject: [PATCH] ldb: don't try to save a value that isn't there
>
>Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
>---
> lib/ldb/common/ldb_dn.c | 49 +++++++++++++++++++++--------------------
> 1 file changed, 25 insertions(+), 24 deletions(-)
>
>diff --git a/lib/ldb/common/ldb_dn.c b/lib/ldb/common/ldb_dn.c
>index eccb4a0ce4b..626c407e15d 100644
>--- a/lib/ldb/common/ldb_dn.c
>+++ b/lib/ldb/common/ldb_dn.c
>@@ -132,7 +132,7 @@ struct ldb_dn *ldb_dn_from_ldb_val(TALLOC_CTX *mem_ctx,
> 				}
> 			} while (p);
> 
>-			if (p_save == dn->ext_linearized) {
>+			if (p_save == dn->ext_linearized) {/* XXX "<><>" does what? */
> 				dn->linearized = talloc_strdup(dn, "");
> 			} else {
> 				dn->linearized = talloc_strdup(dn, p_save);
>@@ -692,31 +692,32 @@ static bool ldb_dn_explode(struct ldb_dn *dn)
> 		goto failed;
> 	}
> 
>-	/* save last element */
>-	if ( t ) {
>-		/* trim back */
>-		d -= (p - t);
>-		l -= (p - t);
>-	}
>+	if (in_value) {
>+		/* save last element */
>+		if ( t ) {
>+			/* trim back */
>+			d -= (p - t);
>+			l -= (p - t);
>+		}
>+
>+		*d++ = '\0';
>+		/*
>+		 * This talloc_memdup() is OK with the
>+		 * +1 because *d has been set to '\0'
>+		 * just above.
>+		 */
>+		dn->components[dn->comp_num].value.length = l;
>+		dn->components[dn->comp_num].value.data =
>+			(uint8_t *)talloc_memdup(dn->components, dt, l + 1);
>+		if ( ! dn->components[dn->comp_num].value.data) {
>+			/* ouch */
>+			goto failed;
>+		}
>+		talloc_set_name_const(dn->components[dn->comp_num].value.data,
>+			(const char *)dn->components[dn->comp_num].value.data);
> 
>-	*d++ = '\0';
>-	/*
>-	 * This talloc_memdup() is OK with the
>-	 * +1 because *d has been set to '\0'
>-	 * just above.
>-	 */
>-	dn->components[dn->comp_num].value.length = l;
>-	dn->components[dn->comp_num].value.data =
>-		(uint8_t *)talloc_memdup(dn->components, dt, l + 1);
>-	if ( ! dn->components[dn->comp_num].value.data) {
>-		/* ouch */
>-		goto failed;
>+		dn->comp_num++;
> 	}
>-	talloc_set_name_const(dn->components[dn->comp_num].value.data,
>-			      (const char *)dn->components[dn->comp_num].value.data);
>-
>-	dn->comp_num++;
>-
> 	talloc_free(data);
> 	return true;
> 
>-- 
>2.20.1
>

Actions: View

Attachments on bug 14049: 15323 | 15327 | 15328 | 15330 | 15378 | 15403