~ubuntu-branches/ubuntu/quantal/openldap/quantal

Origin: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=e75c8720191c12db55ab2342fc8f560011c591b8

Description: fix for CVE-2011-4079. Also includes the following fix detected

 by valgrind: d0dd8616f1c68a868afeb8c2c5c09969e366e2c0 (required for this

 patch).

Bug: http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7059;selectid=7059

Bug-Ubuntu: https://launchpad.net/bugs/884163

 

Index: openldap-2.4.25/servers/slapd/schema_init.c

===================================================================

--- openldap-2.4.25.orig/servers/slapd/schema_init.c    2011-11-14 13:17:10.000000000 -0600

+++ openldap-2.4.25/servers/slapd/schema_init.c 2011-11-14 13:18:58.000000000 -0600

@@ -1852,12 +1852,12 @@

                }

                nvalue.bv_val[nvalue.bv_len] = '\0';

 

-       } else {

+       } else if ( tmp.bv_len )  {

                /* string of all spaces is treated as one space */

                nvalue.bv_val[0] = ' ';

                nvalue.bv_val[1] = '\0';

                nvalue.bv_len = 1;

-       }

+       }       /* should never be entered with 0-length val */

 

        *normalized = nvalue;

        return LDAP_SUCCESS;

@@ -2331,13 +2331,18 @@

        }

        lines[l].bv_len = &val->bv_val[c] - lines[l].bv_val;

 

-       normalized->bv_len = l;

+       normalized->bv_len = c = l;

 

-       for ( l = 0; !BER_BVISNULL( &lines[l] ); l++ ) {

+       for ( l = 0; l <= c; l++ ) {

                /* NOTE: we directly normalize each line,

                 * without unescaping the values, since the special

                 * values '\24' ('$') and '\5C' ('\') are not affected

                 * by normalization */

+               if ( !lines[l].bv_len ) {

+                       nlines[l].bv_len = 0;

+                       nlines[l].bv_val = NULL;

+                       continue;

+               }

                rc = UTF8StringNormalize( usage, NULL, xmr, &lines[l], &nlines[l], ctx );

                if ( rc != LDAP_SUCCESS ) {

                        rc = LDAP_INVALID_SYNTAX;

@@ -2350,7 +2355,7 @@

        normalized->bv_val = slap_sl_malloc( normalized->bv_len + 1, ctx );

 

        p = normalized->bv_val;

-       for ( l = 0; !BER_BVISNULL( &nlines[l] ); l++ ) {

+       for ( l = 0; l <= c ; l++ ) {

                p = lutil_strbvcopy( p, &nlines[l] );

                *p++ = '$';

        }