]> git.sur5r.net Git - openldap/blob - servers/slapd/back-sql/util.c
benign buffer overflow fix (ITS#1964)
[openldap] / servers / slapd / back-sql / util.c
1 /*
2  *       Copyright 1999, Dmitry Kovalev <mit@openldap.org>, All rights reserved.
3  *
4  *       Redistribution and use in source and binary forms are permitted only
5  *       as authorized by the OpenLDAP Public License.  A copy of this
6  *       license is available at http://www.OpenLDAP.org/license.html or
7  *       in file LICENSE in the top-level directory of the distribution.
8  */
9
10 #include "portable.h"
11
12 #ifdef SLAPD_SQL
13
14 #include <stdio.h>
15 #include <sys/types.h>
16 #include "ac/string.h"
17 #include "ac/ctype.h"
18 #include "ac/stdarg.h"
19 #include "slap.h"
20 #include "lber_pvt.h"
21 #include "ldap_pvt.h"
22 #include "back-sql.h"
23 #include "schema-map.h"
24 #include "util.h"
25
26 #define BACKSQL_MAX(a,b) ((a)>(b)?(a):(b))
27 #define BACKSQL_MIN(a,b) ((a)<(b)?(a):(b))
28
29 #define BACKSQL_STR_GROW 256
30
31 char backsql_def_oc_query[] = 
32         "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return "
33         "FROM ldap_oc_mappings";
34 char backsql_def_needs_select_oc_query[] = 
35         "SELECT id,name,keytbl,keycol,create_proc,create_keyval,delete_proc,"
36         "expect_return FROM ldap_oc_mappings";
37 char backsql_def_at_query[] = 
38         "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,"
39         "param_order,expect_return,sel_expr_u FROM ldap_attr_mappings "
40         "WHERE oc_map_id=?";
41 char backsql_def_delentry_query[] = "DELETE FROM ldap_entries WHERE id=?";
42 char backsql_def_insentry_query[] = 
43         "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) "
44         "VALUES (?,?,?,?)";
45 char backsql_def_subtree_cond[] = "ldap_entries.dn LIKE CONCAT('%',?)";
46 char backsql_def_upper_subtree_cond[] = "(ldap_entries.dn) LIKE CONCAT('%',?)";
47 char backsql_id_query[] = "SELECT id,keyval,oc_map_id FROM ldap_entries WHERE ";
48 /* better ?||? or cast(?||? as varchar) */ 
49 char backsql_def_concat_func[] = "CONCAT(?,?)";
50
51 /* TimesTen */
52 char backsql_check_dn_ru_query[] = "SELECT dn_ru from ldap_entries";
53
54 struct berval *
55 backsql_strcat( struct berval *dest, ber_len_t *buflen, ... )
56 {
57         va_list         strs;
58         ber_len_t       cdlen, cslen, grow;
59         char            *cstr;
60
61         assert( dest );
62         assert( dest->bv_val == NULL 
63                         || dest->bv_len == strlen( dest->bv_val ) );
64  
65 #ifdef BACKSQL_TRACE
66         Debug( LDAP_DEBUG_TRACE, "==>backsql_strcat()\n" );
67 #endif /* BACKSQL_TRACE */
68
69         va_start( strs, buflen );
70         if ( dest->bv_val == NULL || *buflen == 0 ) {
71                 dest->bv_val = (char *)ch_calloc( BACKSQL_STR_GROW, 
72                                 sizeof( char ) );
73                 dest->bv_len = 0;
74                 *buflen = BACKSQL_STR_GROW;
75         }
76         cdlen = dest->bv_len;
77         while ( ( cstr = va_arg( strs, char * ) ) != NULL ) {
78                 cslen = strlen( cstr );
79                 grow = BACKSQL_MAX( BACKSQL_STR_GROW, cslen );
80                 if ( *buflen - cdlen <= cslen ) {
81                         char    *tmp_dest;
82
83 #ifdef BACKSQL_TRACE
84                         Debug( LDAP_DEBUG_TRACE, "backsql_strcat(): "
85                                 "buflen=%d, cdlen=%d, cslen=%d "
86                                 "-- reallocating dest\n",
87                                 *buflen, cdlen + 1, cslen );
88 #endif /* BACKSQL_TRACE */
89
90                         tmp_dest = (char *)ch_realloc( dest->bv_val,
91                                         ( *buflen ) + grow * sizeof( char ) );
92                         if ( tmp_dest == NULL ) {
93                                 Debug( LDAP_DEBUG_ANY, "backsql_strcat(): "
94                                         "could not reallocate string buffer.\n",
95                                         0, 0, 0 );
96                                 return NULL;
97                         }
98                         dest->bv_val = tmp_dest;
99                         *buflen += grow;
100
101 #ifdef BACKSQL_TRACE
102                         Debug( LDAP_DEBUG_TRACE, "backsql_strcat(): "
103                                 "new buflen=%d, dest=%p\n", *buflen, dest, 0 );
104 #endif /* BACKSQL_TRACE */
105                 }
106                 AC_MEMCPY( dest->bv_val + cdlen, cstr, cslen + 1 );
107                 cdlen += cslen;
108         }
109         va_end( strs );
110
111 #ifdef BACKSQL_TRACE
112         Debug( LDAP_DEBUG_TRACE, "<==backsql_strcat() (dest='%s')\n", 
113                         dest, 0, 0 );
114 #endif /* BACKSQL_TRACE */
115
116         dest->bv_len = cdlen;
117
118         return dest;
119
120
121 struct berval *
122 backsql_strfcat( struct berval *dest, ber_len_t *buflen, const char *fmt, ... )
123 {
124         va_list         strs;
125         ber_len_t       cdlen;
126
127         assert( dest );
128         assert( buflen );
129         assert( fmt );
130         assert( *buflen == 0 || *buflen > dest->bv_len );
131         assert( dest->bv_val == NULL 
132                         || dest->bv_len == strlen( dest->bv_val ) );
133  
134 #ifdef BACKSQL_TRACE
135         Debug( LDAP_DEBUG_TRACE, "==>backsql_strfcat()\n" );
136 #endif /* BACKSQL_TRACE */
137
138         va_start( strs, fmt );
139         if ( dest->bv_val == NULL || *buflen == 0 ) {
140                 dest->bv_val = (char *)ch_calloc( BACKSQL_STR_GROW, 
141                                 sizeof( char ) );
142                 dest->bv_len = 0;
143                 *buflen = BACKSQL_STR_GROW;
144         }
145
146         cdlen = dest->bv_len;
147         for ( ; fmt[0]; fmt++ ) {
148                 ber_len_t       cslen, grow;
149                 char            *cstr, cc[ 2 ] = { '\0', '\0' };
150                 struct berval   *cbv;
151
152                 switch ( fmt[ 0 ] ) {
153
154                 /* berval */
155                 case 'b':
156                         cbv = va_arg( strs, struct berval * );
157                         cstr = cbv->bv_val;
158                         cslen = cbv->bv_len;
159                         break;
160
161                 /* length + string */
162                 case 'l':
163                         cslen = va_arg( strs, ber_len_t );
164                         cstr = va_arg( strs, char * );
165                         break;
166                         
167                 /* string */
168                 case 's':
169                         cstr = va_arg( strs, char * );
170                         cslen = strlen( cstr );
171                         break;
172
173                 /* char */
174                 case 'c':
175                         /* 
176                          * `char' is promoted to `int' when passed through `...'
177                          */
178                         cc[0] = va_arg( strs, int );
179                         cstr = cc;
180                         cslen = 1;
181                         break;
182
183                 default:
184                         assert( 0 );
185                 }
186
187                 grow = BACKSQL_MAX( BACKSQL_STR_GROW, cslen );
188                 if ( *buflen - cdlen <= cslen ) {
189                         char    *tmp_dest;
190
191 #ifdef BACKSQL_TRACE
192                         Debug( LDAP_DEBUG_TRACE, "backsql_strfcat(): "
193                                 "buflen=%d, cdlen=%d, cslen=%d "
194                                 "-- reallocating dest\n",
195                                 *buflen, cdlen + 1, cslen );
196 #endif /* BACKSQL_TRACE */
197
198                         tmp_dest = (char *)ch_realloc( dest->bv_val,
199                                         ( *buflen ) + grow * sizeof( char ) );
200                         if ( tmp_dest == NULL ) {
201                                 Debug( LDAP_DEBUG_ANY, "backsql_strfcat(): "
202                                         "could not reallocate string buffer.\n",
203                                         0, 0, 0 );
204                                 return NULL;
205                         }
206                         dest->bv_val = tmp_dest;
207                         *buflen += grow * sizeof( char );
208
209 #ifdef BACKSQL_TRACE
210                         Debug( LDAP_DEBUG_TRACE, "backsql_strfcat(): "
211                                 "new buflen=%d, dest=%p\n", *buflen, dest, 0 );
212 #endif /* BACKSQL_TRACE */
213                 }
214
215                 assert( cstr );
216                 
217                 AC_MEMCPY( dest->bv_val + cdlen, cstr, cslen + 1 );
218                 cdlen += cslen;
219         }
220
221         va_end( strs );
222
223 #ifdef BACKSQL_TRACE
224         Debug( LDAP_DEBUG_TRACE, "<==backsql_strfcat() (dest='%s')\n", 
225                         dest, 0, 0 );
226 #endif /* BACKSQL_TRACE */
227
228         dest->bv_len = cdlen;
229
230         return dest;
231
232
233 int
234 backsql_entry_addattr(
235         Entry           *e,
236         struct berval   *at_name,
237         struct berval   *at_val )
238 {
239         AttributeDescription    *ad;
240         int                     rc;
241         const char              *text;
242
243 #ifdef BACKSQL_TRACE
244         Debug( LDAP_DEBUG_TRACE, "backsql_entry_addattr(): "
245                 "at_name='%s', at_val='%s'\n", 
246                 at_name->bv_val, at_val->bv_val, 0 );
247 #endif /* BACKSQL_TRACE */
248
249         ad = NULL;
250         rc = slap_bv2ad( at_name, &ad, &text );
251         if ( rc != LDAP_SUCCESS ) {
252                 Debug( LDAP_DEBUG_TRACE, "backsql_entry_addattr(): "
253                         "failed to find AttributeDescription for '%s'\n",
254                         at_name->bv_val, 0, 0 );
255                 return 0;
256         }
257
258         rc = attr_merge_one( e, ad, at_val );
259
260         if ( rc != 0 ) {
261                 Debug( LDAP_DEBUG_TRACE, "backsql_entry_addattr(): "
262                         "failed to merge value '%s' for attribute '%s'\n",
263                         at_val->bv_val, at_name->bv_val, 0 );
264                 return 0;
265         }
266
267 #ifdef BACKSQL_TRACE
268         Debug( LDAP_DEBUG_TRACE, "<==backsql_query_addattr()\n", 0, 0, 0 );
269 #endif /* BACKSQL_TRACE */
270
271         return 1;
272 }
273
274 char *
275 backsql_get_table_spec( char **p )
276 {
277         char            *s, *q;
278         struct berval   res = BER_BVNULL;
279         ber_len_t       res_len = 0;
280
281         assert( p );
282         assert( *p );
283
284         s = *p;
285         while ( **p && **p != ',' ) {
286                 (*p)++;
287         }
288
289         if ( **p ) {
290                 *(*p)++ = '\0';
291         }
292         
293 #define BACKSQL_NEXT_WORD { \
294                 while ( *s && isspace( (unsigned char)*s ) ) s++; \
295                 if ( !*s ) return res.bv_val; \
296                 q = s; \
297                 while ( *q && !isspace( (unsigned char)*q ) ) q++; \
298                 if ( *q ) *q++='\0'; \
299         }
300
301         BACKSQL_NEXT_WORD;
302         /* table name */
303         backsql_strcat( &res, &res_len, s, NULL );
304         s = q;
305
306         BACKSQL_NEXT_WORD;
307         if ( !strcasecmp( s, "as" ) ) {
308                 s = q;
309                 BACKSQL_NEXT_WORD;
310         }
311
312 #if 0
313         backsql_strcat( &res, &res_len, " AS ", s, NULL );
314         /* oracle doesn't understand AS :( */
315 #endif
316
317         /* table alias */
318         backsql_strfcat( &res, &res_len, "cs", ' ', s );
319
320         return res.bv_val;
321 }
322
323 int
324 backsql_merge_from_clause( 
325         struct berval   *dest_from,
326         ber_len_t       *dest_len, 
327         struct berval   *src_from )
328 {
329         char            *s, *p, *srcc, *pos, e;
330         struct berval   res = { 0 , NULL };
331
332 #ifdef BACKSQL_TRACE
333         Debug( LDAP_DEBUG_TRACE, "==>backsql_merge_from_clause(): "
334                 "dest_from='%s',src_from='%s'\n",
335                 dest_from ? dest_from->bv_val : "<NULL>", src_from, 0 );
336 #endif /* BACKSQL_TRACE */
337
338         srcc = ch_strdup( src_from->bv_val );
339         p = srcc;
340
341         if ( dest_from != NULL ) {
342                 res = *dest_from;
343         }
344         
345         while ( *p ) {
346                 s = backsql_get_table_spec( &p );
347
348 #ifdef BACKSQL_TRACE
349                 Debug( LDAP_DEBUG_TRACE, "backsql_merge_from_clause(): "
350                         "p='%s' s='%s'\n", p, s, 0 );
351 #endif /* BACKSQL_TRACE */
352
353                 if ( res.bv_val == NULL ) {
354                         backsql_strcat( &res, dest_len, s, NULL );
355
356                 } else {
357                         pos = strstr( res.bv_val, s );
358                         if ( pos == NULL ) {
359                                 backsql_strfcat( &res, dest_len, "cs", ',', s );
360                         } else if ( ( e = pos[ strlen( s ) ] ) != '\0' && e != ',' ) {
361                                 backsql_strfcat( &res, dest_len, "cs", ',', s );
362                         }
363                 }
364                 
365                 if ( s ) {
366                         ch_free( s );
367                 }
368         }
369
370 #ifdef BACKSQL_TRACE
371         Debug( LDAP_DEBUG_TRACE, "<==backsql_merge_from_clause()\n", 0, 0, 0 );
372 #endif /* BACKSQL_TRACE */
373
374         free( srcc );
375         *dest_from = res;
376
377         return 1;
378 }
379
380 /*
381  * splits a pattern in components separated by '?'
382  * (double ?? are turned into single ? and left in the string)
383  * expected contains the number of expected occurrences of '?'
384  * (a negative value means parse as many as possible)
385  */
386
387 int
388 backsql_split_pattern(
389         const char      *_pattern,
390         BerVarray       *split_pattern,
391         int             expected )
392 {
393         char            *pattern, *start, *end;
394         struct berval   bv;
395         int             rc = 0;
396
397 #define SPLIT_CHAR      '?'
398         
399         assert( _pattern );
400         assert( split_pattern );
401
402         pattern = ch_strdup( _pattern );
403
404         start = pattern;
405         end = strchr( start, SPLIT_CHAR );
406         for ( ; start; expected-- ) {
407                 char            *real_end = end;
408                 ber_len_t       real_len;
409                 
410                 if ( real_end == NULL ) {
411                         real_end = start + strlen( start );
412
413                 } else if ( real_end[ 1 ] == SPLIT_CHAR ) {
414                         expected++;
415                         AC_MEMCPY( real_end, real_end + 1, strlen( real_end ) );
416                         end = strchr( real_end + 1, SPLIT_CHAR );
417                         continue;
418                 }
419
420                 real_len = real_end - start;
421                 if ( real_len == 0 ) {
422                         ber_str2bv( "", 0, 1, &bv );
423                 } else {
424                         ber_str2bv( start, real_len, 1, &bv );
425                 }
426
427                 ber_bvarray_add( split_pattern, &bv );
428
429                 if ( expected == 0 ) {
430                         if ( end != NULL ) {
431                                 rc = -1;
432                                 goto done;
433                         }
434                         break;
435                 }
436
437                 if ( end != NULL ) {
438                         start = end + 1;
439                         end = strchr( start, SPLIT_CHAR );
440                 }
441         }
442
443 done:;
444
445         ch_free( pattern );
446
447         return rc;
448 }
449
450 int
451 backsql_prepare_pattern(
452         BerVarray       split_pattern,
453         BerVarray       values,
454         struct berval   *res )
455 {
456         ber_len_t       len = 0;
457         int             i;
458
459         res->bv_val = NULL;
460         res->bv_len = 0;
461
462         for ( i = 0; values[i].bv_val; i++ ) {
463                 if ( split_pattern[i].bv_val == NULL ) {
464                         return -1;
465                 }
466                 backsql_strfcat( res, &len, "b", &split_pattern[ i ] );
467                 backsql_strfcat( res, &len, "b", &values[ i ] );
468         }
469
470         if ( split_pattern[ i ].bv_val == NULL ) {
471                 return -1;
472         }
473
474         backsql_strfcat( res, &len, "b", &split_pattern[ i ] );
475
476         return 0;
477 }
478
479 #endif /* SLAPD_SQL */
480