Another minor filter fix (unescaped *)

[openldap] / libraries / libldap / cyrus.c

diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c
index 3b35dd2fbedeead8de5fa82c2690054afde121d7..8f3c5282da234ba942f481752cc161b44bcff066 100644 (file)
--- a/libraries/libldap/cyrus.c
+++ b/libraries/libldap/cyrus.c
@@ -6,30 +6,29 @@
 
 #include "portable.h"
 
-#include <stdlib.h>
 #include <stdio.h>
 
 #include <ac/socket.h>
+#include <ac/stdlib.h>
 #include <ac/string.h>
 #include <ac/time.h>
 #include <ac/errno.h>
 #include <ac/ctype.h>
 
 #include "ldap-int.h"
+
+#ifdef HAVE_CYRUS_SASL
+
 #ifdef LDAP_R_COMPILE
-#include "ldap_pvt_thread.h"
+ldap_pvt_thread_mutex_t ldap_int_sasl_mutex;
 #endif
 
-#ifdef HAVE_CYRUS_SASL
 #include <sasl.h>
 
 /*
 * Various Cyrus SASL related stuff.
 */
 
-#define SASL_MAX_BUFF_SIZE     65536
-#define SASL_MIN_BUFF_SIZE     4096
-
 int ldap_int_sasl_init( void )
 {
        /* XXX not threadsafe */
@@ -65,6 +64,8 @@ int ldap_int_sasl_init( void )
                ldap_pvt_sasl_mutex_lock,
                ldap_pvt_sasl_mutex_unlock,    
                ldap_pvt_sasl_mutex_dispose );    
+
+       ldap_pvt_thread_mutex_init( &ldap_int_sasl_mutex );
 #endif
 
        if ( sasl_client_init( client_callbacks ) == SASL_OK ) {
@@ -127,23 +128,27 @@ sb_sasl_remove( Sockbuf_IO_Desc *sbiod )
 }
 
 static ber_len_t
-sb_sasl_pkt_length( const char *buf, int debuglevel )
+sb_sasl_pkt_length( const unsigned char *buf, int debuglevel )
 {
        ber_len_t               size;
-       long                    tmp;
 
        assert( buf != NULL );
 
-       tmp = *((long *)buf);
-       size = ntohl( tmp );
+       size = buf[0] << 24
+               | buf[1] << 16
+               | buf[2] << 8
+               | buf[3];
    
+       /* we really should check against actual buffer size set
+        * in the secopts.
+        */
        if ( size > SASL_MAX_BUFF_SIZE ) {
                /* somebody is trying to mess me up. */
                ber_log_printf( LDAP_DEBUG_ANY, debuglevel,
                        "sb_sasl_pkt_length: received illegal packet length "
                        "of %lu bytes\n", (unsigned long)size );      
                size = 16; /* this should lead to an error. */
-}
+       }
 
        return size + 4; /* include the size !!! */
 }
@@ -156,7 +161,7 @@ sb_sasl_drop_packet ( Sockbuf_Buf *sec_buf_in, int debuglevel )
 
        len = sec_buf_in->buf_ptr - sec_buf_in->buf_end;
        if ( len > 0 )
-               memmove( sec_buf_in->buf_base, sec_buf_in->buf_base +
+               AC_MEMCPY( sec_buf_in->buf_base, sec_buf_in->buf_base +
                        sec_buf_in->buf_end, len );
    
        if ( len >= 4 ) {
@@ -209,7 +214,7 @@ sb_sasl_read( Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
                sbiod->sbiod_sb->sb_debug );
 
        /* Grow the packet buffer if neccessary */
-       if ( ( p->sec_buf_in.buf_size < ret ) && 
+       if ( ( p->sec_buf_in.buf_size < (ber_len_t) ret ) && 
                ber_pvt_sb_grow_buffer( &p->sec_buf_in, ret ) < 0 )
        {
                errno = ENOMEM;
@@ -414,13 +419,14 @@ ldap_int_sasl_open(
 
        rc = sasl_client_new( "ldap", host, session_callbacks,
                SASL_SECURITY_LAYER, &ctx );
+       ber_memfree( session_callbacks );
 
        if ( rc != SASL_OK ) {
                ld->ld_errno = sasl_err2ldap( rc );
                return ld->ld_errno;
        }
 
-       Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_open: %s\n",
+       Debug( LDAP_DEBUG_TRACE, "ldap_int_sasl_open: host=%s\n",
                host, 0, 0 );
 
        lc->lconn_sasl_ctx = ctx;
@@ -564,7 +570,7 @@ ldap_int_sasl_bind(
                }
 
                if ( rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS ) {
-                       if( scred ) {
+                       if( scred && scred->bv_len ) {
                                /* and server provided us with data? */
                                Debug( LDAP_DEBUG_TRACE,
                                        "ldap_int_sasl_bind: rc=%d sasl=%d len=%ld\n",
@@ -576,7 +582,7 @@ ldap_int_sasl_bind(
 
                if( rc == LDAP_SUCCESS && saslrc == SASL_OK ) {
                        /* we're done, no need to step */
-                       if( scred ) {
+                       if( scred && scred->bv_len ) {
                                /* but server provided us with data! */
                                Debug( LDAP_DEBUG_TRACE,
                                        "ldap_int_sasl_bind: rc=%d sasl=%d len=%ld\n",
@@ -648,7 +654,7 @@ ldap_int_sasl_bind(
                        if( flags != LDAP_SASL_QUIET ) {
                                fprintf( stderr, "SASL installing layers\n" );
                        }
-                       ldap_pvt_sasl_install( ld->ld_sb, ctx );
+                       ldap_pvt_sasl_install( ld->ld_conns->lconn_sb, ctx );
                }
        }
 
@@ -658,6 +664,7 @@ ldap_int_sasl_bind(
 int
 ldap_int_sasl_external(
        LDAP *ld,
+       LDAPConn *conn,
        const char * authid,
        ber_len_t ssf )
 {
@@ -665,11 +672,7 @@ ldap_int_sasl_external(
        sasl_conn_t *ctx;
        sasl_external_properties_t extprops;
 
-       if( ld->ld_defconn == NULL ) {
-               return LDAP_LOCAL_ERROR;
-       }
-
-       ctx = ld->ld_defconn->lconn_sasl_ctx;
+       ctx = conn->lconn_sasl_ctx;
 
        if ( ctx == NULL ) {
                return LDAP_LOCAL_ERROR;
@@ -767,6 +770,13 @@ int ldap_pvt_sasl_secprops(
                                return LDAP_NOT_SUPPORTED;
                        }
 
+                       if( maxbufsize && (( maxbufsize < SASL_MIN_BUFF_SIZE )
+                               || (maxbufsize > SASL_MAX_BUFF_SIZE )))
+                       {
+                               /* bad maxbufsize */
+                               return LDAP_PARAM_ERROR;
+                       }
+
                } else {
                        return LDAP_NOT_SUPPORTED;
                }
@@ -993,6 +1003,7 @@ ldap_int_sasl_bind(
 int
 ldap_int_sasl_external(
        LDAP *ld,
+       LDAPConn *conn,
        const char * authid,
        ber_len_t ssf )
 { return LDAP_SUCCESS; }