389-ds-base

Clone
Source Code
GIT

#49471 heap-buffer-overflow in ss_unescape
Closed: wontfix 6 years ago Opened 6 years ago by firstyear.

Closed: wontfix
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1518069

Description of problem:
=================================================================
==21829== ERROR: AddressSanitizer: heap-buffer-overflow on address
0x6004009380b6 at pc 0x7f9979a37d62 bp 0x7f9929d5a610 sp 0x7f9929d5a600
READ of size 1 at 0x6004009380b6 thread T57
    #0 0x7f9979a37d61 in ss_unescape /usr/src/debug/389-ds-base-1.3.7.5/ldap/se
rvers/plugins/collation/orfilter.c:316
    #1 0x7f9979a37eed in ss_filter_value /usr/src/debug/389-ds-base-1.3.7.5/lda
p/servers/plugins/collation/orfilter.c:351
    #2 0x7f9979a3a164 in ss_filter_values /usr/src/debug/389-ds-base-1.3.7.5/ld
ap/servers/plugins/collation/orfilter.c:411
    #3 0x7f99809d963b in attempt_mr_filter_create
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/plugin_mr.c:590
    #4 0x7f99809da6fe in plugin_mr_filter_create
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/plugin_mr.c:616
    #5 0x7f998094706d in get_filter_internal
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/filter.c:310
    #6 0x7f998094a701 in get_filter
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/filter.c:56
    #7 0x55c62bcd5378 in do_search
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/search.c:184
    #8 0x55c62bcaf15a in connection_dispatch_operation
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/connection.c:648
    #9 0x7f997eab1c8a in PR_Select /usr/src/debug/nspr-4.17.0/pr/src/pthreads/.
./../../nspr/pr/src/pthreads/ptthread.c:216
    #10 0x7f9980fa6867 in _ZN6__asan10AsanThread11ThreadStartEv _asan_rtl_
    #11 0x7f997e451dd4 in start_thread
/usr/src/debug/glibc-2.17-c758a686/nptl/pthread_create.c:308
    #12 0x7f997daff9bc in __clone /usr/src/debug////////glibc-2.17-c758a686/mis
c/../sysdeps/unix/sysv/linux/x86_64/clone.S:113
0x6004009380b6 is located 0 bytes to the right of 6-byte region
[0x6004009380b0,0x6004009380b6)
allocated by thread T57 here:
    #0 0x7f9980fa2ef9 in malloc _asan_rtl_
    #1 0x7f9980910f07 in slapi_ch_malloc
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/ch_malloc.c:95
    #2 0x7f9979a3a069 in ss_filter_values /usr/src/debug/389-ds-base-1.3.7.5/ld
ap/servers/plugins/collation/orfilter.c:405
    #3 0x7f99809d963b in attempt_mr_filter_create
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/plugin_mr.c:590
    #4 0x7f99809da6fe in plugin_mr_filter_create
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/plugin_mr.c:616
    #5 0x7f998094706d in get_filter_internal
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/filter.c:310
    #6 0x7f998094a701 in get_filter
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/filter.c:56
    #7 0x55c62bcd5378 in do_search
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/search.c:184
    #8 0x55c62bcaf15a in connection_dispatch_operation
/usr/src/debug/389-ds-base-1.3.7.5/ldap/servers/slapd/connection.c:648
    #9 0x7f997eab1c8a in PR_Select /usr/src/debug/nspr-4.17.0/pr/src/pthreads/.
./../../nspr/pr/src/pthreads/ptthread.c:216
Thread T57 created by T0 here:
    #0 0x7f9980f97a0a in __interceptor_pthread_create _asan_rtl_
    #1 0x7f997eab195b in PR_Select /usr/src/debug/nspr-4.17.0/pr/src/pthreads/.
./../../nspr/pr/src/pthreads/ptthread.c:457
    #2 0x0
Shadow bytes around the buggy address:
  0x0c010011efc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c010011efd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c010011efe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c010011eff0: fa fa fa fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c010011f000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 01 fa
=>0x0c010011f010: fa fa 00 00 fa fa[06]fa fa fa 00 04 fa fa 03 fa
  0x0c010011f020: fa fa 03 fa fa fa 03 fa fa fa fd fd fa fa 00 01
  0x0c010011f030: fa fa 00 04 fa fa fd fd fa fa 07 fa fa fa fd fa
  0x0c010011f040: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c010011f050: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c010011f060: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==21829== ABORTING

Version-Release number of selected component (if applicable):
389-ds-base-1.3.7.5-10.el7.x86_64

Metadata Update from @firstyear:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1518069
6 years ago

Search with filter '(description:2.16.840.1.113730.3.3.2.1.1.6:=\*German\*)' generates this trace with ASAN build.

Metadata Update from @vashirov:
- Custom field component adjusted to None
- Custom field origin adjusted to None
- Custom field reviewstatus adjusted to None
- Custom field type adjusted to None
- Custom field version adjusted to None
6 years ago

Thanks mate! I'll add this to a test case and reproduce. Thanks!

Using the following test case

  • create an ASAN instance

  • provision

    dn: cn=user10,ou=People,dc=example,dc=com
    objectClass: top
    objectClass: person
    objectClass: inetuser
    objectClass: userSecurityInformation
    sn: _user10
    description: added on MUX
    cn: user10

Then run the command

 ldapsearch -LLL -o ldif-wrap=no -D "cn=directory manager" -W  -b "dc=example,dc=com"  '(description:2.16.840.1.113730.3.3.2.1.1.6:=\*on\*)'

ASAN build instance exits with

=======================================================                                                               
==32011==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200045fe12 at pc 0x7fa2eeea3aa6 bp 0x7fa29a1a18b0 sp 0x7fa29a1a1058
READ of size 3 at 0x60200045fe12 thread T71
    #0 0x7fa2eeea3aa5 in memcmp (/lib64/libasan.so.2+0x77aa5)
    #1 0x7fa2e6b8c657 in ss_unescape 389-ds-base/ldap/servers/plugins/collation/orfilter.c:316
    #2 0x7fa2e6b8ca15 in ss_filter_value 389-ds-base/ldap/servers/plugins/collation/orfilter.c:351
    #3 0x7fa2e6b8cf67 in ss_filter_values 389-ds-base/ldap/servers/plugins/collation/orfilter.c:411
    #4 0x7fa2e6b8de24 in or_filter_create 389-ds-base/ldap/servers/plugins/collation/orfilter.c:554
    #5 0x7fa2ee876824 in attempt_mr_filter_create 389-ds-base/ldap/servers/slapd/plugin_mr.c:590
    #6 0x7fa2ee8769b5 in plugin_mr_filter_create 389-ds-base/ldap/servers/slapd/plugin_mr.c:616
    #7 0x7fa2ee7c5c8a in get_filter_internal 389-ds-base/ldap/servers/slapd/filter.c:314
    #8 0x7fa2ee7c4a34 in get_filter 389-ds-base/ldap/servers/slapd/filter.c:55
    #9 0x457bf0 in do_search 389-ds-base/ldap/servers/slapd/search.c:184
    #10 0x41d1d1 in connection_dispatch_operation 389-ds-base/ldap/servers/slapd/connection.c:648
    #11 0x422053 in connection_threadmain 389-ds-base/ldap/servers/slapd/connection.c:1760
    #12 0x7fa2ec4dc68a  (/lib64/libnspr4.so+0x2968a)
    #13 0x7fa2ebe78619 in start_thread (/lib64/libpthread.so.0+0x7619)
    #14 0x7fa2eb9695fc in clone (/lib64/libc.so.6+0x1025fc)


=================================================================
==15540==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000461d4f at pc 0x7f3071276eec bp 0x7f302b75f420 sp 0x7f302b75f410
READ of size 1 at 0x602000461d4f thread T42
    #0 0x7f3071276eeb in ldap_utf8prev 389-ds-base/ldap/servers/slapd/utf8.c:110
    #1 0x7f30695880d6 in SetUnicodeStringFromUTF_8 389-ds-base/ldap/servers/plugins/collation/collate.c:260
    #2 0x7f30695887b9 in collation_index 389-ds-base/ldap/servers/plugins/collation/collate.c:313
    #3 0x7f306958d326 in ss_filter_key 389-ds-base/ldap/servers/plugins/collation/orfilter.c:437
    #4 0x7f306958d661 in ss_filter_keys 389-ds-base/ldap/servers/plugins/collation/orfilter.c:470
    #5 0x7f306958e0f4 in or_filter_create 389-ds-base/ldap/servers/plugins/collation/orfilter.c:570
    #6 0x7f3071203824 in attempt_mr_filter_create 389-ds-base/ldap/servers/slapd/plugin_mr.c:590
    #7 0x7f30712039b5 in plugin_mr_filter_create 389-ds-base/ldap/servers/slapd/plugin_mr.c:616
    #8 0x7f3071152c8a in get_filter_internal 389-ds-base/ldap/servers/slapd/filter.c:314
    #9 0x7f3071151a34 in get_filter 389-ds-base/ldap/servers/slapd/filter.c:55
    #10 0x457bf0 in do_search 389-ds-base/ldap/servers/slapd/search.c:184
    #11 0x41d1d1 in connection_dispatch_operation 389-ds-base/ldap/servers/slapd/connection.c:648
    #12 0x422053 in connection_threadmain 389-ds-base/ldap/servers/slapd/connection.c:1760
    #13 0x7f306ee6968a  (/lib64/libnspr4.so+0x2968a)
    #14 0x7f306e805619 in start_thread (/lib64/libpthread.so.0+0x7619)
    #15 0x7f306e2f65fc in clone (/lib64/libc.so.6+0x1025fc)

@tbordaz Can we get a lib389 test too in the filter suite for this? I think it would be realively easy to add :)

Can you please put braces:

64 +        if (p >= plimit)
65 +            break;

Because it's a bit nicer if we do for clarity,

Otherwise I think this is okay :)

Metadata Update from @tbordaz:
- Custom field reviewstatus adjusted to review (was: None)
6 years ago

Looks great! The test is python 2 only, but I'll help fix that later no pressure now :) ack from me.

Metadata Update from @firstyear:
- Custom field reviewstatus adjusted to ack (was: review)
6 years ago

@firstyear thanks for the review and the grace period for python2 stuff ;)

To ssh://git@pagure.io/389-ds-base.git
1418fc3..5991388 master -> master

Metadata Update from @tbordaz:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
6 years ago

9109af6..3fb1c40 389-ds-base-1.3.7 -> 389-ds-base-1.3.7

3e19256..40e9fa1 389-ds-base-1.3.6 -> 389-ds-base-1.3.6

Metadata Update from @vashirov:
- Issue set to the milestone: None (was: 0.0 NEEDS_TRIAGE)
4 years ago

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/2530

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: fixed)
3 years ago

Log in to comment on this ticket.

Metadata
None
None
None
None
None
None
ack
None
Attachments 2
0001-Ticket-49471-heap-buffer-overflow-in-ss_unesc...
Attached 6 years ago View Comment
0002-Ticket-49471-heap-buffer-overflow-in-ss_unesc...
Attached 6 years ago View Comment
Powered by Pagure 5.14.1
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.