ITS#6951 Fix two buffersize issue in "pcacheBind" config processing

[openldap] / servers / slapd / overlays / pcache.c

diff --git a/servers/slapd/overlays/pcache.c b/servers/slapd/overlays/pcache.c
index 64de6a43dddd39c177d7ba3cf53b6810a29aa6bf..62477513bdbbaacf56813b9af044b2d0c68554b9 100644 (file)
--- a/servers/slapd/overlays/pcache.c
+++ b/servers/slapd/overlays/pcache.c
@@ -445,7 +445,7 @@ ftemp_attrs( struct berval *ftemp, struct berval *template,
        AttributeDescription **descs = NULL;
        char *temp2;
 
-       temp2 = ch_malloc( ftemp->bv_len );
+       temp2 = ch_malloc( ftemp->bv_len + 1 );
        p1 = ftemp->bv_val;
        t1 = temp2;
 
@@ -1601,6 +1601,8 @@ add_query(
                templ->no_of_queries++;
        } else {
                ldap_pvt_thread_mutex_destroy(&new_cached_query->answerable_cnt_mutex);
+               if (wlock)
+                       ldap_pvt_thread_rdwr_wunlock(&new_cached_query->rwlock);
                ldap_pvt_thread_rdwr_destroy( &new_cached_query->rwlock );
                ch_free( new_cached_query );
                new_cached_query = find_filter( op, qbase->scopes[query->scope],
@@ -3763,13 +3765,23 @@ pc_cf_gen( ConfigArgs *c )
                                /* count the attr length */
                                for ( attr_name = qm->attr_sets[i].attrs;
                                        attr_name->an_name.bv_val; attr_name++ )
+                               {
                                        bv.bv_len += attr_name->an_name.bv_len + 1;
+                                       if ( attr_name->an_desc &&
+                                                       ( attr_name->an_desc->ad_flags & SLAP_DESC_TEMPORARY ) ) {
+                                               bv.bv_len += STRLENOF("undef:");
+                                       }
+                               }
 
                                bv.bv_val = ch_malloc( bv.bv_len+1 );
                                ptr = lutil_strcopy( bv.bv_val, c->cr_msg );
                                for ( attr_name = qm->attr_sets[i].attrs;
                                        attr_name->an_name.bv_val; attr_name++ ) {
                                        *ptr++ = ' ';
+                                       if ( attr_name->an_desc &&
+                                                       ( attr_name->an_desc->ad_flags & SLAP_DESC_TEMPORARY ) ) {
+                                               ptr = lutil_strcopy( ptr, "undef:" );
+                                       }
                                        ptr = lutil_strcopy( ptr, attr_name->an_name.bv_val );
                                }
                                ber_bvarray_add( &c->rvalue_vals, &bv );
@@ -4025,7 +4037,12 @@ pc_cf_gen( ConfigArgs *c )
                                        all_op = 1;
                                        BER_BVSTR( &attr_name->an_name, LDAP_ALL_OPERATIONAL_ATTRIBUTES );
                                } else {
-                                       if ( slap_str2ad( c->argv[i], &attr_name->an_desc, &text ) ) {
+                                       if ( strncasecmp( c->argv[i], "undef:", STRLENOF("undef:") ) == 0 ) {
+                                               struct berval bv;
+                                               ber_str2bv( c->argv[i] + STRLENOF("undef:"), 0, 0, &bv );
+                                               attr_name->an_desc = slap_bv2tmp_ad( &bv, NULL );
+
+                                       } else if ( slap_str2ad( c->argv[i], &attr_name->an_desc, &text ) ) {
                                                strcpy( c->cr_msg, text );
                                                Debug( LDAP_DEBUG_CONFIG, "%s: %s.\n", c->log, c->cr_msg, 0 );
                                                ch_free( qm->attr_sets[num].attrs );
@@ -4246,7 +4263,7 @@ pc_bind_fail:
                        i = 0;
                        while ((eq = strchr(eq, '=' ))) {
                                eq++;
-                               if ( eq[1] == ')' )
+                               if ( eq[0] == ')' )
                                        i++;
                        }
                        bv.bv_len = temp->bindftemp.bv_len + i;
@@ -4793,7 +4810,19 @@ pcache_db_close(
                free( tm );
        }
 
-       for ( i=0; i<cm->numattrsets; i++ ) {
+       for ( i = 0; i < cm->numattrsets; i++ ) {
+               int j;
+
+               /* Account of LDAP_NO_ATTRS */
+               if ( !qm->attr_sets[i].count ) continue;
+
+               for ( j = 0; !BER_BVISNULL( &qm->attr_sets[i].attrs[j].an_name ); j++ ) {
+                       if ( qm->attr_sets[i].attrs[j].an_desc &&
+                                       ( qm->attr_sets[i].attrs[j].an_desc->ad_flags &
+                                         SLAP_DESC_TEMPORARY ) ) {
+                               slap_sl_mfuncs.bmf_free( qm->attr_sets[i].attrs[j].an_desc, NULL );
+                       }
+               }
                free( qm->attr_sets[i].attrs );
        }
        free( qm->attr_sets );