32 lines
1.1 KiB
Plaintext
32 lines
1.1 KiB
Plaintext
$OpenBSD: patch-servers_slapd_modrdn_c,v 1.1.1.1 2011/01/07 10:17:04 pea Exp $
|
|
|
|
SECURITY FIX
|
|
|
|
Resolves CVE-2010-0211 and CVE-2010-0212 (ITS#6570)
|
|
from upstream
|
|
|
|
|
|
--- servers/slapd/modrdn.c.orig Mon Feb 11 18:24:16 2008
|
|
+++ servers/slapd/modrdn.c Tue Aug 3 10:26:21 2010
|
|
@@ -481,12 +481,19 @@ slap_modrdn2mods(
|
|
mod_tmp->sml_values[1].bv_val = NULL;
|
|
if( desc->ad_type->sat_equality->smr_normalize) {
|
|
mod_tmp->sml_nvalues = &mod_tmp->sml_values[2];
|
|
- (void) (*desc->ad_type->sat_equality->smr_normalize)(
|
|
+ rs->sr_err = desc->ad_type->sat_equality->smr_normalize(
|
|
SLAP_MR_EQUALITY|SLAP_MR_VALUE_OF_ASSERTION_SYNTAX,
|
|
desc->ad_type->sat_syntax,
|
|
desc->ad_type->sat_equality,
|
|
&mod_tmp->sml_values[0],
|
|
&mod_tmp->sml_nvalues[0], op->o_tmpmemctx );
|
|
+ if (rs->sr_err != LDAP_SUCCESS) {
|
|
+ ch_free(mod_tmp->sml_nvalues);
|
|
+ ch_free(mod_tmp->sml_values[0].bv_val);
|
|
+ ch_free(mod_tmp->sml_values);
|
|
+ ch_free(mod_tmp);
|
|
+ goto done;
|
|
+ }
|
|
mod_tmp->sml_nvalues[1].bv_val = NULL;
|
|
} else {
|
|
mod_tmp->sml_nvalues = NULL;
|