46 lines
1.3 KiB
Diff
46 lines
1.3 KiB
Diff
From c7f4542fade3d06c8725d0c2976d81f5206719c4 Mon Sep 17 00:00:00 2001
|
|
From: tbordaz <tbordaz@redhat.com>
|
|
Date: Wed, 30 Mar 2022 18:07:23 +0200
|
|
Subject: [PATCH 2/2] Issue 5242- Craft message may crash the server (#5243)
|
|
|
|
Bug description:
|
|
A craft request can result in DoS
|
|
|
|
Fix description:
|
|
If the server fails to decode the ber value
|
|
then return an Error
|
|
|
|
relates: 5242
|
|
|
|
Reviewed by: Pierre Rogier, Mark Reynolds (thanks !)
|
|
|
|
Platforms tested: F34
|
|
---
|
|
ldap/servers/slapd/filter.c | 10 ++++++++--
|
|
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/ldap/servers/slapd/filter.c b/ldap/servers/slapd/filter.c
|
|
index d671c87ff..52fd95750 100644
|
|
--- a/ldap/servers/slapd/filter.c
|
|
+++ b/ldap/servers/slapd/filter.c
|
|
@@ -647,8 +647,14 @@ get_extensible_filter(BerElement *ber, mr_filter_t *mrf)
|
|
}
|
|
}
|
|
|
|
- if ((tag != LBER_ERROR) && (len != -1)) {
|
|
- goto parsing_error;
|
|
+ if (tag == LBER_ERROR) {
|
|
+ if (len == -1) {
|
|
+ /* means that the ber sequence ended without LBER_END_OF_SEQORSET tag
|
|
+ * and it is considered as valid to ensure compatibility with open ldap.
|
|
+ */
|
|
+ } else {
|
|
+ goto parsing_error;
|
|
+ }
|
|
}
|
|
|
|
slapi_log_err(SLAPI_LOG_FILTER, "get_extensible_filter", "<= %i\n", rc);
|
|
--
|
|
2.31.1
|
|
|