mayorga / 389-ds-base

Forked from 389-ds-base 7 years ago
Clone

d627203 Bug 690526 - (cov#10734) Double free in dse_add()

1 file Authored by nkinder 13 years ago, Committed by rmeggins 13 years ago,
    Bug 690526 - (cov#10734) Double free in dse_add()
    
    It's possible to encounter a double free of a Slapi_Entry in an
    error condition in dse_add().  This function makes a copy of the
    entry being added for use by postop plug-ins, but it can be free'd
    twice in the following code:
    
      e_copy = slapi_entry_dup(e);
      if ( dse_add_entry_pb(pdse, e_copy, pb) != 0)
      {
          slapi_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, NULL,
                                  0, NULL );
          slapi_sdn_done(&sdn;;
          return dse_add_return(error, e_copy);
      }
    
    The dse_add_entry_pb() function frees the passed in entry in all
    conditions, but dse_add_return() also free's the passed in entry.
    This double free could trigger a crash.
    
    The way dse_add works is that entry in SLAPI_ADD_ENTRY in the
    pblock should be consumed upon success, but will be left for
    the caller to deal with upon failure.  We should be passing NULL
    for the second argument to dse_add_return() to avoid the double
    free.
    (cherry picked from commit 753c55017477fe3201d4d156cd90707d0ea5be13)
    
        
file modified
+2 -4