浏览代码

Ticket 48395 - ASAN - Use after free in uiduniq 7bit.c

Bug Description:   Asan detected a use after free in 7bit.c during a modrdn
operation. This may cause the directory to crash if a specially crafted modrdn
request is made, or may be exploitable in some other way.

Fix Description:  We move the issue_error directive before the slapi_entry is
freed, which means that we are using before the free instead.

https://fedorahosted.org/389/ticket/48395

Author: wibrown

Review by: nhosoi (Thank you!)
William Brown 10 年之前
父节点
当前提交
d07d1b5d63
共有 2 个文件被更改,包括 8 次插入5 次删除
  1. 0 0
      dirsrvtests/tmp/__init__.py
  2. 8 5
      ldap/servers/plugins/uiduniq/7bit.c

+ 0 - 0
dirsrvtests/tmp/__init__.py


+ 8 - 5
ldap/servers/plugins/uiduniq/7bit.c

@@ -650,17 +650,20 @@ preop_modrdn(Slapi_PBlock *pb)
         }
       }
       /* don't have to go on if there is a value not 7-bit clean */
-      if (result) break;
+      if (result) {
+        /* WB we need to issue the error before we free slapi_entry, else we
+         * are triggering a use after free because we free violated.
+         */
+        issue_error(pb, result, "MODRDN", violated);
+        break;
+      }
+
     }
   END
 
   /* Clean-up */
   if (e) slapi_entry_free(e);
 
-  if (result) {
-    issue_error(pb, result, "MODRDN", violated);
-  }
-
   return (result==LDAP_SUCCESS)?0:-1;
 }