From 15ff2e3db0f245143f9a8912cf8cef158f09f15e Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: May 15 2018 13:21:34 +0000
Subject: Ticket 49669 - Invalid cachemem size can crash the server during a restore


Bug Description:  If you manually set the dbcachememsize to something larger than
                  a uint64_t the server can crash from a NULL pointer being
                  dereferenced.

Fix Description:  Catch the NULL pointer before it is dereferenced, and abort the
                  restore.

https://pagure.io/389-ds-base/issue/49669

Reviewed by: firstyear & tbordaz (Thanks!!)

---

diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 5ab2211..18dd944 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -6566,6 +6566,16 @@ dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *bena
                         goto error_out;
                     }
 
+                    if (inst->inst_parent_dir_name == NULL) {
+                        slapi_log_err(SLAPI_LOG_ERR, "dblayer_restore",
+                                      "Parent directory is not set, aborting restore\n");
+                        if (task) {
+                            slapi_task_log_notice(task, "dblayer_restore - Parent directory is not set, aborting restore\n");
+                        }
+                        PR_CloseDir(dirhandle);
+                        return_value = LDAP_UNWILLING_TO_PERFORM;
+                        goto error_out;
+                    }
                     if (slapd_comp_path(src_dir, inst->inst_parent_dir_name) == 0) {
                         slapi_log_err(SLAPI_LOG_ERR,
                                       "dblayer_restore", "Backup dir %s and target dir %s "
diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index cb46efb..1be215b 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -1178,7 +1178,7 @@ slapd_chown_if_not_owner(const char *filename, uid_t uid, gid_t gid)
 }
 
 /*
- * Compare 2 pathes
+ * Compare 2 paths
  * Paths could contain ".", "..", "//" in the path, thus normalize them first.
  * One or two of the paths could be a relative path.
  */
@@ -1186,9 +1186,19 @@ int
 slapd_comp_path(char *p0, char *p1)
 {
     int rval = 0;
-    char *norm_p0 = rel2abspath(p0);
-    char *norm_p1 = rel2abspath(p1);
+    char *norm_p0;
+    char *norm_p1;
 
+    /*
+     * Neither path should be NULL, but it's possible when bad thing happen.
+     * Return 0 which triggers an error in the caller
+     */
+    if (p0 == NULL || p1 == NULL){
+        return 0;
+    }
+
+    norm_p0 = rel2abspath(p0);
+    norm_p1 = rel2abspath(p1);
     rval = strcmp(norm_p0, norm_p1);
     slapi_ch_free_string(&norm_p0);
     slapi_ch_free_string(&norm_p1);