ITS#5322 don't try to free a NULL locker

[openldap] / servers / slapd / passwd.c

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 1d69910baee7f5bca058e6ea06801a4f706ccc2b..8b1c299e3c69c7704b60d1d4d66db5c5d3208b39 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2008 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -53,7 +53,7 @@ int passwd_extop(
        Modifications *ml;
        slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
        int i, nhash;
-       char **hashes;
+       char **hashes, idNul;
        int rc;
        BackendDB *op_be;
        int freenewpw = 0;
@@ -77,6 +77,10 @@ int passwd_extop(
        rs->sr_err = slap_passwd_parse( op->ore_reqdata, &id,
                &qpw->rs_old, &qpw->rs_new, &rs->sr_text );
 
+       if ( !BER_BVISNULL( &id )) {
+               idNul = id.bv_val[id.bv_len];
+               id.bv_val[id.bv_len] = '\0';
+       }
        if ( rs->sr_err == LDAP_SUCCESS && !BER_BVISEMPTY( &id ) ) {
                Statslog( LDAP_DEBUG_STATS, "%s PASSMOD id=\"%s\"%s%s\n",
                        op->o_log_prefix, id.bv_val,
@@ -90,18 +94,21 @@ int passwd_extop(
        }
 
        if ( rs->sr_err != LDAP_SUCCESS ) {
+               if ( !BER_BVISNULL( &id ))
+                       id.bv_val[id.bv_len] = idNul;
                return rs->sr_err;
        }
 
        if ( !BER_BVISEMPTY( &id ) ) {
                rs->sr_err = dnPrettyNormal( NULL, &id, &op->o_req_dn,
                                &op->o_req_ndn, op->o_tmpmemctx );
+               id.bv_val[id.bv_len] = idNul;
                if ( rs->sr_err != LDAP_SUCCESS ) {
                        rs->sr_text = "Invalid DN";
                        rc = rs->sr_err;
                        goto error_return;
                }
-               op->o_bd = select_backend( &op->o_req_ndn, 0, 1 );
+               op->o_bd = select_backend( &op->o_req_ndn, 1 );
 
        } else {
                ber_dupbv_x( &op->o_req_dn, &op->o_dn, op->o_tmpmemctx );
@@ -136,7 +143,7 @@ int passwd_extop(
        /* If we've got a glued backend, check the real backend */
        op_be = op->o_bd;
        if ( SLAP_GLUE_INSTANCE( op->o_bd )) {
-               op->o_bd = select_backend( &op->o_req_ndn, 0, 0 );
+               op->o_bd = select_backend( &op->o_req_ndn, 0 );
        }
 
        if (backend_check_restrictions( op, rs,
@@ -245,6 +252,7 @@ old_good:
                nhash = 1;
                hashes = (char **)defhash;
        }
+       ml->sml_numvals = nhash;
        ml->sml_values = ch_malloc( (nhash+1)*sizeof(struct berval) );
        for ( i=0; hashes[i]; i++ ) {
                slap_passwd_hash_type( &qpw->rs_new, &hash, hashes[i], &rs->sr_text );
@@ -317,6 +325,10 @@ error_return:;
        return rc;
 }
 
+/* NOTE: The DN in *id is NOT NUL-terminated here. dnNormalize will
+ * reject it in this condition, the caller must NUL-terminate it.
+ * FIXME: should dnNormalize still be complaining about that?
+ */
 int slap_passwd_parse( struct berval *reqdata,
        struct berval *id,
        struct berval *oldpass,
@@ -341,9 +353,9 @@ int slap_passwd_parse( struct berval *reqdata,
        /* ber_init2 uses reqdata directly, doesn't allocate new buffers */
        ber_init2( ber, reqdata, 0 );
 
-       tag = ber_scanf( ber, "{" /*}*/ );
+       tag = ber_skip_tag( ber, &len );
 
-       if( tag == LBER_ERROR ) {
+       if( tag != LBER_SEQUENCE ) {
                Debug( LDAP_DEBUG_TRACE,
                        "slap_passwd_parse: decoding error\n", 0, 0, 0 );
                rc = LDAP_PROTOCOL_ERROR;
@@ -361,7 +373,7 @@ int slap_passwd_parse( struct berval *reqdata,
                        goto done;
                }
 
-               tag = ber_scanf( ber, "m", id );
+               tag = ber_get_stringbv( ber, id, LBER_BV_NOTERM );
 
                if( tag == LBER_ERROR ) {
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
@@ -383,7 +395,7 @@ int slap_passwd_parse( struct berval *reqdata,
                        goto done;
                }
 
-               tag = ber_scanf( ber, "m", oldpass );
+               tag = ber_get_stringbv( ber, oldpass, LBER_BV_NOTERM );
 
                if( tag == LBER_ERROR ) {
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n",
@@ -414,7 +426,7 @@ int slap_passwd_parse( struct berval *reqdata,
                        goto done;
                }
 
-               tag = ber_scanf( ber, "m", newpass );
+               tag = ber_get_stringbv( ber, newpass, LBER_BV_NOTERM );
 
                if( tag == LBER_ERROR ) {
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW parse failed.\n",
@@ -493,8 +505,10 @@ slap_passwd_check(
        AccessControlState      acl_state = ACL_STATE_INIT;
 
 #ifdef SLAPD_SPASSWD
+       void            *old_authctx = NULL;
+
        ldap_pvt_thread_pool_setkey( op->o_threadctx, slap_sasl_bind,
-               op->o_conn->c_sasl_authctx, NULL );
+               op->o_conn->c_sasl_authctx, NULL, &old_authctx, NULL );
 #endif
 
        for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
@@ -513,7 +527,7 @@ slap_passwd_check(
 
 #ifdef SLAPD_SPASSWD
        ldap_pvt_thread_pool_setkey( op->o_threadctx, slap_sasl_bind,
-               NULL, NULL );
+               old_authctx, NULL, NULL, NULL );
 #endif
 
        return result;