← Back to branch summary

~ubuntu-branches/ubuntu/hardy/openldap2.3/hardy-updates

« back to all changes in this revision

Viewing changes to servers/slapd/overlays/accesslog.c

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2008-07-31 16:06:53 UTC
  • mfrom: (16.1.3 hardy-proposed)
  • Revision ID: james.westby@ubuntu.com-20080731160653-np1dr19qfutmqb0v
Tags: 2.4.9-0ubuntu0.8.04.1
* SECURITY UPDATE: denial of service via broken BER decoding.
* Added debian/patches/security-ber-decoding.patch: upstream fixes.
* References
  CVE-2008-2952

Show diffs side-by-side

added added

removed removed

Lines of Context:
servers/slapd/overlays/accesslog.c
1
1
/* accesslog.c - log operations for audit/history purposes */
2
 
/* $OpenLDAP: pkg/ldap/servers/slapd/overlays/accesslog.c,v 1.37.2.13 2007/12/10 18:03:30 quanah Exp $ */
 
2
/* $OpenLDAP: pkg/ldap/servers/slapd/overlays/accesslog.c,v 1.37.2.17 2008/05/01 20:37:48 quanah Exp $ */
3
3
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4
4
 *
5
 
 * Copyright 2005-2007 The OpenLDAP Foundation.
 
5
 * Copyright 2005-2008 The OpenLDAP Foundation.
6
6
 * Portions copyright 2004-2005 Symas Corporation.
7
7
 * All rights reserved.
8
8
 *
67
67
        Entry *li_old;
68
68
        log_attr *li_oldattrs;
69
69
        int li_success;
70
 
        int li_unlock;
71
70
        ldap_pvt_thread_rmutex_t li_op_rmutex;
72
71
        ldap_pvt_thread_mutex_t li_log_mutex;
73
72
} log_info;
770
769
                        if ( li->li_task ) {
771
770
                                struct re_s *re = li->li_task;
772
771
                                li->li_task = NULL;
 
772
                                ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
773
773
                                if ( ldap_pvt_runqueue_isrunning( &slapd_rq, re ))
774
774
                                        ldap_pvt_runqueue_stoptask( &slapd_rq, re );
775
775
                                ldap_pvt_runqueue_remove( &slapd_rq, re );
 
776
                                ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
776
777
                        }
777
778
                        li->li_age = 0;
778
779
                        li->li_cycle = 0;
844
845
                                        struct re_s *re = li->li_task;
845
846
                                        if ( re )
846
847
                                                re->interval.tv_sec = li->li_cycle;
847
 
                                        else
 
848
                                        else {
 
849
                                                ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
848
850
                                                li->li_task = ldap_pvt_runqueue_insert( &slapd_rq,
849
851
                                                        li->li_cycle, accesslog_purge, li,
850
852
                                                        "accesslog_purge", li->li_db ?
851
853
                                                                li->li_db->be_suffix[0].bv_val :
852
854
                                                                c->be->be_suffix[0].bv_val );
 
855
                                                ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
 
856
                                        }
853
857
                                }
854
858
                        }
855
859
                        break;
1339
1343
                return SLAP_CB_CONTINUE;
1340
1344
 
1341
1345
        if ( lo->mask & LOG_OP_WRITES ) {
 
1346
                slap_callback *cb;
1342
1347
                ldap_pvt_thread_mutex_lock( &li->li_log_mutex );
1343
1348
                old = li->li_old;
1344
1349
                li->li_old = NULL;
1345
 
                li->li_unlock = 0;
 
1350
                /* Disarm mod_cleanup */
 
1351
                for ( cb = op->o_callback; cb; cb = cb->sc_next ) {
 
1352
                        if ( cb->sc_private == (void *)on ) {
 
1353
                                cb->sc_private = NULL;
 
1354
                                break;
 
1355
                        }
 
1356
                }
1346
1357
                ldap_pvt_thread_rmutex_unlock( &li->li_op_rmutex, op->o_tid );
1347
1358
        }
1348
1359
 
1693
1704
{
1694
1705
        slap_callback *sc = op->o_callback;
1695
1706
        slap_overinst *on = sc->sc_private;
1696
 
        log_info *li = on->on_bi.bi_private;
1697
1707
        op->o_callback = sc->sc_next;
1698
1708
 
1699
1709
        op->o_tmpfree( sc, op->o_tmpmemctx );
1700
1710
 
1701
 
        if ( li->li_unlock ) {
 
1711
        if ( on ) {
1702
1712
                BackendInfo *bi = op->o_bd->bd_info;
1703
1713
                op->o_bd->bd_info = (BackendInfo *)on;
1704
1714
                accesslog_response( op, rs );
1714
1724
        log_info *li = on->on_bi.bi_private;
1715
1725
 
1716
1726
        if ( li->li_ops & LOG_OP_WRITES ) {
1717
 
                slap_callback *cb = op->o_tmpalloc( sizeof( slap_callback ), op->o_tmpmemctx );
 
1727
                slap_callback *cb = op->o_tmpalloc( sizeof( slap_callback ), op->o_tmpmemctx ), *cb2;
1718
1728
                cb->sc_cleanup = accesslog_mod_cleanup;
1719
1729
                cb->sc_response = NULL;
1720
1730
                cb->sc_private = on;
1721
 
                cb->sc_next = op->o_callback;
1722
 
                op->o_callback = cb;
 
1731
                cb->sc_next = NULL;
 
1732
                for ( cb2 = op->o_callback; cb2->sc_next; cb2 = cb2->sc_next );
 
1733
                cb2->sc_next = cb;
1723
1734
 
1724
1735
                ldap_pvt_thread_rmutex_lock( &li->li_op_rmutex, op->o_tid );
1725
 
                li->li_unlock = 1;
1726
1736
                if ( li->li_oldf && ( op->o_tag == LDAP_REQ_DELETE ||
1727
1737
                        op->o_tag == LDAP_REQ_MODIFY ||
1728
1738
                        ( op->o_tag == LDAP_REQ_MODRDN && li->li_oldattrs ))) {
2017
2027
                ber_dupbv( &li->li_db->be_rootndn, li->li_db->be_nsuffix );
2018
2028
        }
2019
2029
 
 
2030
        ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
2020
2031
        ldap_pvt_runqueue_insert( &slapd_rq, 3600, accesslog_db_root, on,
2021
2032
                "accesslog_db_root", li->li_db->be_suffix[0].bv_val );
 
2033
        ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
2022
2034
 
2023
2035
        return 0;
2024
2036
}