ITS#4954 c_sasl_dn fix from HEAD

[openldap] / servers / slapd / ldapsync.c

diff --git a/servers/slapd/ldapsync.c b/servers/slapd/ldapsync.c
index 72022c24fa1c8612f34887caf5f47804ccf11577..abf8df4cf57873196e30cb10c26c3cd9de42ca3e 100644 (file)
--- a/servers/slapd/ldapsync.c
+++ b/servers/slapd/ldapsync.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2005 The OpenLDAP Foundation.
+ * Copyright 2003-2007 The OpenLDAP Foundation.
  * Portions Copyright 2003 IBM Corporation.
  * All rights reserved.
  *
@@ -38,24 +38,29 @@ slap_compose_sync_cookie(
        int rid )
 {
        char cookiestr[ LDAP_LUTIL_CSNSTR_BUFSIZE + 20 ];
+       int len;
 
        if ( BER_BVISNULL( csn )) {
                if ( rid == -1 ) {
                        cookiestr[0] = '\0';
+                       len = 0;
                } else {
-                       snprintf( cookiestr, LDAP_LUTIL_CSNSTR_BUFSIZE + 20,
+                       len = snprintf( cookiestr, LDAP_LUTIL_CSNSTR_BUFSIZE + 20,
                                        "rid=%03d", rid );
                }
        } else {
-               if ( rid == -1 ) {
-                       snprintf( cookiestr, LDAP_LUTIL_CSNSTR_BUFSIZE + 20,
-                                       "csn=%s", csn->bv_val );
-               } else {
-                       snprintf( cookiestr, LDAP_LUTIL_CSNSTR_BUFSIZE + 20,
-                                       "csn=%s,rid=%03d", csn->bv_val, rid );
+               char *end = cookiestr + sizeof(cookiestr);
+               char *ptr = lutil_strcopy( cookiestr, "csn=" );
+               len = csn->bv_len;
+               if ( ptr + len >= end )
+                       len = end - ptr;
+               ptr = lutil_strncopy( ptr, csn->bv_val, len );
+               if ( rid != -1 && ptr < end - STRLENOF(",rid=xxx") ) {
+                       ptr += sprintf( ptr, ",rid=%03d", rid );
                }
+               len = ptr - cookiestr;
        }
-       ber_str2bv_x( cookiestr, strlen(cookiestr), 1, cookie, 
+       ber_str2bv_x( cookiestr, len, 1, cookie,
                op ? op->o_tmpmemctx : NULL );
 }
 
@@ -97,20 +102,29 @@ slap_parse_sync_cookie(
        int valid = 0;
        char *rid_ptr;
        char *cval;
+       char *next;
 
        if ( cookie == NULL )
                return -1;
 
+       if ( cookie->octet_str.bv_len <= STRLENOF( "rid=" ) )
+               return -1;
+
        cookie->rid = -1;
-       if (( rid_ptr = strstr( cookie->octet_str.bv_val, "rid=" )) != NULL ) {
-               if ( (cval = strchr( rid_ptr, ',' )) != NULL ) {
-                       *cval = '\0';
-               }
-               cookie->rid = atoi( rid_ptr + sizeof("rid=") - 1 );
-               if ( cval != NULL ) {
-                       *cval = ',';
-               }
-       } else {
+       /* FIXME: may read past end of cookie->octet_str.bv_val */
+       rid_ptr = strstr( cookie->octet_str.bv_val, "rid=" );
+       if ( rid_ptr == NULL 
+               || rid_ptr > &cookie->octet_str.bv_val[ cookie->octet_str.bv_len - STRLENOF( "rid=" ) ] )
+       {
+               return -1;
+       }
+
+       if ( rid_ptr[ STRLENOF( "rid=" ) ] == '-' ) {
+               return -1;
+       }
+
+       cookie->rid = strtoul( &rid_ptr[ STRLENOF( "rid=" ) ], &next, 10 );
+       if ( next == &rid_ptr[ STRLENOF( "rid=" ) ] || ( next[ 0 ] != ',' && next[ 0 ] != '\0' ) ) {
                return -1;
        }
 
@@ -123,16 +137,20 @@ slap_parse_sync_cookie(
                if ( ad == NULL )
                        break;
 
+               if ( csn_ptr >= &cookie->octet_str.bv_val[ cookie->octet_str.bv_len - STRLENOF( "csn=" ) ] ) {
+                       return -1;
+               }
+
                csn_str = csn_ptr + STRLENOF("csn=");
                cval = strchr( csn_str, ',' );
-               if ( cval )
+               if ( cval && cval < &cookie->octet_str.bv_val[ cookie->octet_str.bv_len ] )
                        csn_str_len = cval - csn_str;
                else
                        csn_str_len = 0;
 
                /* FIXME use csnValidate when it gets implemented */
                csn_ptr = strchr( csn_str, '#' );
-               if ( !csn_ptr ) break;
+               if ( !csn_ptr || csn_str >= &cookie->octet_str.bv_val[ cookie->octet_str.bv_len ] ) break;
 
                stamp.bv_val = csn_str;
                stamp.bv_len = csn_ptr - csn_str;