[Fedora-directory-commits] adminutil/lib/libadminutil admutil.c, 1.2, 1.3 errRpt.c, 1.1.1.1, 1.2 form_post.c, 1.1.1.1, 1.2 uginfo.c, 1.1.1.1, 1.2
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/adminutil/lib/libadminutil
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11998/adminutil/lib/libadminutil
Modified Files:
admutil.c errRpt.c form_post.c uginfo.c
Log Message:
Bug(s) fixed: 186280
Bug Description: Close potential security vulnerabilities in CGI code
Reviewed by: Noriko (Thanks!)
Fix Description: The code was already pretty clean in terms of buffer
access. I added some malloc return checking, used some nspr functions
where applicable, removed some dead code, and fixed a couple of small
memory leaks.
Platforms tested: Fedora Core 5
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: admutil.c
===================================================================
RCS file: /cvs/dirsec/adminutil/lib/libadminutil/admutil.c,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- admutil.c 6 Dec 2005 18:38:37 -0000 1.2
+++ admutil.c 22 Mar 2006 23:47:14 -0000 1.3
@@ -986,10 +986,21 @@
LDAPMod *newMod;
newMod = (LDAPMod*)PR_Malloc(sizeof(LDAPMod));
+ if (!newMod) {
+ return newMod;
+ }
newMod->mod_op = mode;
newMod->mod_type = PL_strdup(namep);
+ if (namep && !newMod->mod_type) {
+ deleteMod(newMod);
+ return NULL;
+ }
if (values) {
newMod->mod_values = admutil_strsdup(values);
+ if (!newMod->mod_values) {
+ deleteMod(newMod);
+ return NULL;
+ }
}
else if (mode != LDAP_MOD_ADD) {
newMod->mod_values = NULL;
@@ -997,7 +1008,15 @@
else {
/* For LDAP_MOD_ADD attribute value must be specified */
newMod->mod_values = (char**)PR_Malloc(2*sizeof(char*));
+ if (!newMod->mod_values) {
+ deleteMod(newMod);
+ return NULL;
+ }
newMod->mod_values[0] = PL_strdup("");
+ if (!newMod->mod_values[0]) {
+ deleteMod(newMod);
+ return NULL;
+ }
newMod->mod_values[1] = NULL;
}
@@ -1036,7 +1055,11 @@
admUriUnescape(char *s)
{
char *t, *u;
-
+
+ if (!s) {
+ return;
+ }
+
for(t = s, u = s; *t; ++t, ++u) {
if((*t == '%') && t[1] && t[2]) {
*u = ((t[1] >= 'A' ? ((t[1] & 0xdf) - 'A')+10 : (t[1] - '0'))*16) +
@@ -1106,6 +1129,12 @@
memset(admInfo, '\0', sizeof(AdmldapHdnl));
admInfo->configFilePath = PL_strdup(path);
+ if (!admInfo->configFilePath) {
+ PR_Free(admInfo);
+ *errorcode = ADMUTIL_SYSTEM_ERR;
+ return NULL;
+ }
+
admInfo->configInfo = configInfo;
@@ -1137,6 +1166,12 @@
}
admInfo->serverDirectoryURL = PL_strdup(ldapurl);
+ if (!admInfo->serverDirectoryURL) {
+ /* Error open file */
+ *errorcode = ADMUTIL_SYSTEM_ERR;
+ destroyAdmldap((AdmldapInfo)admInfo);
+ return NULL;
+ }
if (ldap_url_parse(ldapurl, &ldapInfo)) {
*errorcode = ADMUTIL_SYSTEM_ERR;
Index: errRpt.c
===================================================================
RCS file: /cvs/dirsec/adminutil/lib/libadminutil/errRpt.c,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- errRpt.c 20 Jul 2005 22:51:32 -0000 1.1.1.1
+++ errRpt.c 22 Mar 2006 23:47:14 -0000 1.2
@@ -126,12 +126,22 @@
char *verbose_err()
{
/* Convert to use NSPR */
- char errMsg[1024];
- int errMsgLen = 0;
-
- errMsgLen = PR_GetErrorText(errMsg);
- if (errMsgLen) return alert_wrd_wrap(errMsg, WORD_WRAP_WIDTH, "\\n");
- else return NULL;
+ char *retval = NULL;
+ char *errMsg = NULL;
+ PRInt32 errMsgLen = 0;
+
+ errMsgLen = PR_GetErrorTextLength();
+ if (errMsgLen > 0) {
+ errMsg = PR_Malloc(errMsgLen+1);
+ if (errMsg) {
+ errMsgLen = PR_GetErrorText(errMsg);
+ if (errMsgLen) {
+ retval = alert_wrd_wrap(errMsg, WORD_WRAP_WIDTH, "\\n");
+ }
+ PR_Free(errMsg);
+ }
+ }
+ return retval;
}
#endif /* XP_WIN32 */
Index: form_post.c
===================================================================
RCS file: /cvs/dirsec/adminutil/lib/libadminutil/form_post.c,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- form_post.c 20 Jul 2005 22:51:32 -0000 1.1.1.1
+++ form_post.c 22 Mar 2006 23:47:14 -0000 1.2
@@ -36,10 +36,6 @@
#define BIG_LINE 1024
#endif
-#if 0
-#define SUCCESS_HTML "success.html"
-#endif
-
static char **input;
#ifdef XP_WIN32
@@ -97,27 +93,42 @@
int cl;
if(!(tmp = getenv("CONTENT_LENGTH"))) {
- if (admutil_i18nResource) {
- rpt_err(INCORRECT_USAGE,
- (char*)res_getstring(admutil_i18nResource,
- DBT_formPost_Browser_err,
- admutil_acceptLang),
- (char*)res_getstring(admutil_i18nResource,
- DBT_formPost_Browser_errDetail,
- admutil_acceptLang),
- NULL);
- }
- else {
- rpt_err(INCORRECT_USAGE,
- "Browser Error",
- "Your browser sent no content length with a POST command. Please be sure to use a fully compliant browser.",
- NULL);
- }
+ if (admutil_i18nResource) {
+ rpt_err(INCORRECT_USAGE,
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_Browser_err,
+ admutil_acceptLang),
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_Browser_errDetail,
+ admutil_acceptLang),
+ NULL);
+ }
+ else {
+ rpt_err(INCORRECT_USAGE,
+ "Browser Error",
+ "Your browser sent no content length with a POST command. Please be sure to use a fully compliant browser.",
+ NULL);
+ }
}
cl = atoi(tmp);
- vars = (char *)PR_Malloc(cl+1);
+ if (!(vars = (char *)PR_Malloc(cl+1))) {
+ if (admutil_i18nResource) {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_PostStdinErr,
+ admutil_acceptLang),
+ NULL);
+ }
+ else {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ "Could not allocate enough memory to read in the POST parameters.",
+ NULL);
+ }
+ }
if( !(fread(vars, 1, cl, in)) ) {
if (admutil_i18nResource) {
@@ -150,12 +161,28 @@
PR_IMPLEMENT(char **)
string_to_vec(char *in)
{
- char **ans;
+ char **ans = NULL;
int vars = 0;
register int x = 0;
char *tmp;
- in = PL_strdup(in);
+ if (!(in = PL_strdup(in))) {
+ if (admutil_i18nResource) {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_PostStdinErr,
+ admutil_acceptLang),
+ NULL);
+ }
+ else {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ "Could not allocate enough memory to read in the POST parameters.",
+ NULL);
+ }
+ return ans;
+ }
while(in[x])
if(in[x++]=='=')
@@ -169,11 +196,45 @@
PR_Free(in);
return(ans);
}
- ans[x]=PL_strdup(tmp);
+
+ if (!(ans[x]=PL_strdup(tmp))) {
+ if (admutil_i18nResource) {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_PostStdinErr,
+ admutil_acceptLang),
+ NULL);
+ }
+ else {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ "Could not allocate enough memory to read in the POST parameters.",
+ NULL);
+ }
+ return ans;
+ }
+
form_unescape(ans[x++]);
while((tmp = strtok(NULL, "&"))) {
- ans[x] = PL_strdup(tmp);
+ if (!(ans[x] = PL_strdup(tmp))) {
+ if (admutil_i18nResource) {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_PostStdinErr,
+ admutil_acceptLang),
+ NULL);
+ }
+ else {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ "Could not allocate enough memory to read in the POST parameters.",
+ NULL);
+ }
+ return ans;
+ }
form_unescape(ans[x++]);
}
@@ -192,7 +253,24 @@
while(input[x]) {
/* We want to get rid of the =, so len, len+1 */
if((!strncmp(input[x], varname, len)) && (*(input[x]+len) == '=')) {
- ans = PL_strdup(input[x] + len + 1);
+ if (!(ans = PL_strdup(input[x] + len + 1))) {
+ if (admutil_i18nResource) {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_PostStdinErr,
+ admutil_acceptLang),
+ NULL);
+ }
+ else {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ "Could not allocate enough memory to get the parameter.",
+ NULL);
+ }
+ return ans;
+ }
+
if(!strcmp(ans, ""))
ans = NULL;
break;
@@ -247,7 +325,23 @@
if ((!strncmp(input[x], varname, len)) &&
(*(input[x]+len) == '=') &&
(*(input[x]+len+1))) {
- ans[n] = PL_strdup(input[x] + len + 1);
+ if (!(ans[n] = PL_strdup(input[x] + len + 1))) {
+ if (admutil_i18nResource) {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ (char*)res_getstring(admutil_i18nResource,
+ DBT_formPost_PostStdinErr,
+ admutil_acceptLang),
+ NULL);
+ }
+ else {
+ rpt_err(MEMORY_ERROR,
+ NULL,
+ "Could not allocate enough memory to get the parameter.",
+ NULL);
+ }
+ return ans;
+ }
n++;
}
}
@@ -267,54 +361,6 @@
return NULL;
}
-#if 0
-/* Removed since front end is JAVA, no need to send html page back! */
-PR_IMPLEMENT(void)
-return_success(char *description)
-{
- char **config=get_adm_config();
- WSACleanup();
-
- fprintf(stdout, "\n<SCRIPT language=%s>", MOCHA_NAME);
-#ifdef MCC_HTTPD /* template->style usability */
- /* If we're working with styles, jump directly back to the edit style
- * page. */
- if(!strcmp(get_current_typestr(config), TEMPLATE) ||
- ((get_current_restype(config)==PB_NAME) &&
- (strcmp(get_current_resource(config), "default")))) {
- fprintf(stdout, "top.%s.%s.location='%s';",
- BOTTOM_NAME, CONTENT_NAME, "index/tmpled");
- fprintf(stdout, "</SCRIPT>\n");
- } else
-#endif
- fprintf(stdout, "alert('Success!\\n%s');",
- alert_word_wrap(description, WORD_WRAP_WIDTH, "\\n"));
- fprintf(stdout, "</SCRIPT>\n");
- js_open_referer();
-#ifdef NS_MAIL
- char line[BIG_LINE];
- char **config = get_adm_config();
- FILE *html=open_html_file(SUCCESS_HTML);
-
- WSACleanup();
-
- /* Be sure headers are terminated. */
- fputs("\n", stdout);
-
- while(next_html_line(html, line)) {
- if(parse_line(line, config)) {
- if(directive_is(line, "SUCCESS_DESCRIPTION")) {
- fprintf(stdout, "<dl><dt><FONT size=+1>Success!</FONT>\n");
- fprintf(stdout, "<dd>%s\n</dl>", description);
- }
- }
- }
-#endif /* NS_MAIL */
- exit(0);
-}
-#endif /* 0 */
-
-
PR_IMPLEMENT(void)
rm_trail_slash(char *target)
Index: uginfo.c
===================================================================
RCS file: /cvs/dirsec/adminutil/lib/libadminutil/uginfo.c,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- uginfo.c 20 Jul 2005 22:51:32 -0000 1.1.1.1
+++ uginfo.c 22 Mar 2006 23:47:14 -0000 1.2
@@ -299,7 +299,15 @@
return 0;
}
- mods = (LDAPMod**)PR_Malloc(6*sizeof(LDAPMod*));
+ if (!(mods = (LDAPMod**)PR_Malloc(6*sizeof(LDAPMod*)))) {
+ *error_code = UG_LDAP_SYSTEM_ERR;
+ if (oldDirectoryURL) PR_Free(oldDirectoryURL);
+ if (oldBindDN) PR_Free(oldBindDN);
+ if (oldBindPassword) PR_Free(oldBindPassword);
+ if (oldDirectoryInfoRef) PR_Free(oldDirectoryInfoRef);
+ return 0;
+ }
+
i = 0;
if (directoryInfoRef) {
if (oldDirectoryURL) {
18 years, 1 month
[Fedora-directory-commits] adminserver/admserv pkgadmin.mk, 1.43, 1.44
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/adminserver/admserv
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv9510/admserv
Modified Files:
pkgadmin.mk
Log Message:
[186105] Admin Server Makefile updates for Internal build
Should package symlinks of libadminutil.so.1.0 and libadmsslutil.so.1.0.
Index: pkgadmin.mk
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/pkgadmin.mk,v
retrieving revision 1.43
retrieving revision 1.44
diff -u -r1.43 -r1.44
--- pkgadmin.mk 21 Mar 2006 18:33:43 -0000 1.43
+++ pkgadmin.mk 22 Mar 2006 22:53:48 -0000 1.44
@@ -244,7 +244,13 @@
if [ `expr $$file : ".*\.$(DLL_SUFFIX)\.[0-9]*$$"` -ne 0 ]; then \
mytmpfile=`echo $$file | sed -e "s/\(.*\)\.$(DLL_SUFFIX)\.[0-9]*$$/\1.$(DLL_SUFFIX)/"`; \
(cd $(ADMIN_DIR)/bin/admin/lib; rm -rf $$mytmpfile; ln -s $$file $$mytmpfile); \
- fi ; \
+ fi ; \
+ if [ `expr $$file : ".*\.$(DLL_SUFFIX)\.[0-9]*\.[0-9]*$$"` -ne 0 ]; then \
+ mytmpfile=`echo $$file | sed -e "s/\(.*\)\.$(DLL_SUFFIX)\.[0-9]*\.[0-9]*$$/\1.$(DLL_SUFFIX)/"`; \
+ (cd $(ADMIN_DIR)/bin/admin/lib; rm -rf $$mytmpfile; ln -s $$file $$mytmpfile); \
+ mytmpfile=`echo $$file | sed -e "s/\(.*\)\.$(DLL_SUFFIX)\.\([0-9]*\)\.[0-9]*$$/\1.$(DLL_SUFFIX).\2/"`; \
+ (cd $(ADMIN_DIR)/bin/admin/lib; rm -rf $$mytmpfile; ln -s $$file $$mytmpfile); \
+ fi ; \
done
if [ -d $(ADMINUTIL_LIBPATH)/property ] ; then \
$(MKDIR) $(ADMIN_DIR)/bin/admin/lib/property ; \
18 years, 1 month
[Fedora-directory-commits] directoryconsole build.xml,1.5,1.6
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/directoryconsole
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv456
Modified Files:
build.xml
Log Message:
Modified ant move syntax to support ant 1.6.2
Index: build.xml
===================================================================
RCS file: /cvs/dirsec/directoryconsole/build.xml,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- build.xml 22 Mar 2006 17:46:10 -0000 1.5
+++ build.xml 22 Mar 2006 19:09:02 -0000 1.6
@@ -70,8 +70,9 @@
<untar src="${imports.dir}/console/${console.import}"
dest="${imports.dir}/console"
compression="gzip"/>
- <move file="${imports.dir}/console/${brand}-console-${ldapconsole.version}"
- todir="${imports.dir}/console/unzipped"/>
+ <move todir="${imports.dir}/console/unzipped">
+ <fileset dir="${imports.dir}/console/${brand}-console-${ldapconsole.version}"/>
+ </move>
<!-- Set console.location -->
<property name="console.location" value="${imports.dir}/console/unzipped"/>
</target>
18 years, 1 month
[Fedora-directory-commits] ldapserver component_versions.mk, 1.35.2.5, 1.35.2.6
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/ldapserver
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30892
Modified Files:
Tag: Directory71RtmBranch
component_versions.mk
Log Message:
Pick up new ADSYNC component for bug 186171
Index: component_versions.mk
===================================================================
RCS file: /cvs/dirsec/ldapserver/component_versions.mk,v
retrieving revision 1.35.2.5
retrieving revision 1.35.2.6
diff -u -r1.35.2.5 -r1.35.2.6
--- component_versions.mk 18 Mar 2006 18:05:15 -0000 1.35.2.5
+++ component_versions.mk 22 Mar 2006 18:55:06 -0000 1.35.2.6
@@ -250,7 +250,7 @@
endif
ifndef ADSYNC_VERSION
- ADSYNC_VERSION=20060318
+ ADSYNC_VERSION=20060322
endif
ifndef NT4SYNC_VERSION
18 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/synctools/passwordsync/passsync syncserv.cpp, 1.7.2.5, 1.7.2.6
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/synctools/passwordsync/passsync
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30812/passsync
Modified Files:
Tag: Directory71RtmBranch
syncserv.cpp
Log Message:
186171 - Fixed memory leaks in passhook.dll
Index: syncserv.cpp
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/synctools/passwordsync/passsync/syncserv.cpp,v
retrieving revision 1.7.2.5
retrieving revision 1.7.2.6
diff -u -r1.7.2.5 -r1.7.2.6
--- syncserv.cpp 18 Mar 2006 00:32:01 -0000 1.7.2.5
+++ syncserv.cpp 22 Mar 2006 18:53:37 -0000 1.7.2.6
@@ -375,6 +375,9 @@
ldap_memfree(dn);
dn = NULL;
+ // zero out memory used for password
+ SecureZeroMemory(tempPassInfo->password, strlen(tempPassInfo->password));
+
// free the username and password
free(tempPassInfo->username);
free(tempPassInfo->password);
@@ -658,6 +661,9 @@
tempPassInfo = currentPassInfo;
currentPassInfo++;
+ // zero out memory used for password
+ SecureZeroMemory(tempPassInfo->password, strlen(tempPassInfo->password));
+
// free the username and password
free(tempPassInfo->username);
free(tempPassInfo->password);
18 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/synctools/passwordsync/passhook passhook.cpp, 1.7, 1.7.2.1
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/synctools/passwordsync/passhook
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30812/passhook
Modified Files:
Tag: Directory71RtmBranch
passhook.cpp
Log Message:
186171 - Fixed memory leaks in passhook.dll
Index: passhook.cpp
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/synctools/passwordsync/passhook/passhook.cpp,v
retrieving revision 1.7
retrieving revision 1.7.2.1
diff -u -r1.7 -r1.7.2.1
--- passhook.cpp 19 Apr 2005 22:07:43 -0000 1.7
+++ passhook.cpp 22 Mar 2006 18:53:32 -0000 1.7.2.1
@@ -50,8 +50,6 @@
NTSTATUS NTAPI PasswordChangeNotify(PUNICODE_STRING UserName, ULONG RelativeId, PUNICODE_STRING Password)
{
- char singleByteUsername[PASSHAND_BUF_SIZE];
- char singleBytePassword[PASSHAND_BUF_SIZE];
HANDLE passhookEventHandle = OpenEvent(EVENT_MODIFY_STATE, FALSE, PASSHAND_EVENT_NAME);
PASS_INFO newPassInfo;
PASS_INFO_LIST passInfoList;
@@ -78,18 +76,34 @@
}
RegCloseKey(regKey);
- _snprintf(singleByteUsername, PASSHAND_BUF_SIZE, "%S", UserName->Buffer);
- singleByteUsername[UserName->Length / 2] = '\0';
- _snprintf(singleBytePassword, PASSHAND_BUF_SIZE, "%S", Password->Buffer);
- singleBytePassword[Password->Length / 2] = '\0';
+ // This memory will be free'd by calling clearSet below
+ newPassInfo.username = (char*)malloc((UserName->Length / 2) + 1);
+ newPassInfo.password = (char*)malloc((Password->Length / 2) + 1);
+
+ if (newPassInfo.username && newPassInfo.password) {
+ _snprintf(newPassInfo.username, (UserName->Length / 2), "%S", UserName->Buffer);
+ _snprintf(newPassInfo.password, (Password->Length / 2), "%S", Password->Buffer);
+ newPassInfo.username[UserName->Length / 2] = '\0';
+ newPassInfo.password[Password->Length / 2] = '\0';
+ } else {
+ if(outLog.is_open()) {
+ timeStamp(&outLog);
+ outLog << "failed to allocate memory for username and password" << endl;
+ }
+ free(newPassInfo.username);
+ free(newPassInfo.password);
+ goto exit;
+ }
if(outLog.is_open())
{
timeStamp(&outLog);
- outLog << "user " << singleByteUsername << " password changed" << endl;
- //outLog << "user " << singleByteUsername << " password changed to " << singleBytePassword << endl;
+ outLog << "user " << newPassInfo.username << " password changed" << endl;
+ //outLog << "user " << newPassInfo.username << " password changed to " << newPassInfo.password << endl;
}
+ // loadSet allocates memory for the usernames and password. We need to be
+ // sure to free it by calling clearSet.
if(loadSet(&passInfoList, "passhook.dat") == 0)
{
if(outLog.is_open())
@@ -107,10 +121,10 @@
}
}
- newPassInfo.username = singleByteUsername;
- newPassInfo.password = singleBytePassword;
+ // Add the new change to the list
passInfoList.push_back(newPassInfo);
+ // Save the list to disk
if(saveSet(&passInfoList, "passhook.dat") == 0)
{
if(outLog.is_open())
@@ -128,6 +142,10 @@
}
}
+ // We need to call clearSet so memory gets free'd
+ clearSet(&passInfoList);
+
+exit:
if(passhookEventHandle == NULL)
{
if(outLog.is_open())
@@ -140,6 +158,7 @@
else
{
SetEvent(passhookEventHandle);
+ CloseHandle(passhookEventHandle);
}
outLog.close();
18 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/synctools/passwordsync passhand.cpp, 1.7.2.1, 1.7.2.2
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/synctools/passwordsync
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30812
Modified Files:
Tag: Directory71RtmBranch
passhand.cpp
Log Message:
186171 - Fixed memory leaks in passhook.dll
Index: passhand.cpp
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/synctools/passwordsync/passhand.cpp,v
retrieving revision 1.7.2.1
retrieving revision 1.7.2.2
diff -u -r1.7.2.1 -r1.7.2.2
--- passhand.cpp 18 Mar 2006 00:31:54 -0000 1.7.2.1
+++ passhand.cpp 22 Mar 2006 18:53:26 -0000 1.7.2.2
@@ -200,11 +200,17 @@
int clearSet(PASS_INFO_LIST* passInfoList)
{
- // ToDo: zero out memory
+ while (!passInfoList->empty()) {
+ PASS_INFO& pi = passInfoList->back();
+ SecureZeroMemory(pi.password, strlen(pi.password));
+ free(pi.password);
+ free(pi.username);
+ passInfoList->pop_back();
+ }
passInfoList->clear();
- return -1;
+ return 0;
}
int encrypt(char* plainTextBuf, int plainTextLen, char* cipherTextBuf, int cipherTextLen, int* resultTextLen)
18 years, 1 month
[Fedora-directory-commits] winsync/passwordsync/passsync syncserv.cpp, 1.12, 1.13
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/winsync/passwordsync/passsync
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30744/passsync
Modified Files:
syncserv.cpp
Log Message:
186171 - Fixed memory leaks in passhook.dll
Index: syncserv.cpp
===================================================================
RCS file: /cvs/dirsec/winsync/passwordsync/passsync/syncserv.cpp,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- syncserv.cpp 18 Mar 2006 00:36:39 -0000 1.12
+++ syncserv.cpp 22 Mar 2006 18:51:16 -0000 1.13
@@ -375,6 +375,9 @@
ldap_memfree(dn);
dn = NULL;
+ // zero out memory used for password
+ SecureZeroMemory(tempPassInfo->password, strlen(tempPassInfo->password));
+
// free the username and password
free(tempPassInfo->username);
free(tempPassInfo->password);
@@ -658,6 +661,9 @@
tempPassInfo = currentPassInfo;
currentPassInfo++;
+ // zero out memory used for password
+ SecureZeroMemory(tempPassInfo->password, strlen(tempPassInfo->password));
+
// free the username and password
free(tempPassInfo->username);
free(tempPassInfo->password);
18 years, 1 month
[Fedora-directory-commits] winsync/passwordsync/passhook passhook.cpp, 1.7, 1.8
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/winsync/passwordsync/passhook
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30744/passhook
Modified Files:
passhook.cpp
Log Message:
186171 - Fixed memory leaks in passhook.dll
Index: passhook.cpp
===================================================================
RCS file: /cvs/dirsec/winsync/passwordsync/passhook/passhook.cpp,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- passhook.cpp 19 Apr 2005 22:07:43 -0000 1.7
+++ passhook.cpp 22 Mar 2006 18:51:11 -0000 1.8
@@ -50,8 +50,6 @@
NTSTATUS NTAPI PasswordChangeNotify(PUNICODE_STRING UserName, ULONG RelativeId, PUNICODE_STRING Password)
{
- char singleByteUsername[PASSHAND_BUF_SIZE];
- char singleBytePassword[PASSHAND_BUF_SIZE];
HANDLE passhookEventHandle = OpenEvent(EVENT_MODIFY_STATE, FALSE, PASSHAND_EVENT_NAME);
PASS_INFO newPassInfo;
PASS_INFO_LIST passInfoList;
@@ -78,18 +76,34 @@
}
RegCloseKey(regKey);
- _snprintf(singleByteUsername, PASSHAND_BUF_SIZE, "%S", UserName->Buffer);
- singleByteUsername[UserName->Length / 2] = '\0';
- _snprintf(singleBytePassword, PASSHAND_BUF_SIZE, "%S", Password->Buffer);
- singleBytePassword[Password->Length / 2] = '\0';
+ // This memory will be free'd by calling clearSet below
+ newPassInfo.username = (char*)malloc((UserName->Length / 2) + 1);
+ newPassInfo.password = (char*)malloc((Password->Length / 2) + 1);
+
+ if (newPassInfo.username && newPassInfo.password) {
+ _snprintf(newPassInfo.username, (UserName->Length / 2), "%S", UserName->Buffer);
+ _snprintf(newPassInfo.password, (Password->Length / 2), "%S", Password->Buffer);
+ newPassInfo.username[UserName->Length / 2] = '\0';
+ newPassInfo.password[Password->Length / 2] = '\0';
+ } else {
+ if(outLog.is_open()) {
+ timeStamp(&outLog);
+ outLog << "failed to allocate memory for username and password" << endl;
+ }
+ free(newPassInfo.username);
+ free(newPassInfo.password);
+ goto exit;
+ }
if(outLog.is_open())
{
timeStamp(&outLog);
- outLog << "user " << singleByteUsername << " password changed" << endl;
- //outLog << "user " << singleByteUsername << " password changed to " << singleBytePassword << endl;
+ outLog << "user " << newPassInfo.username << " password changed" << endl;
+ //outLog << "user " << newPassInfo.username << " password changed to " << newPassInfo.password << endl;
}
+ // loadSet allocates memory for the usernames and password. We need to be
+ // sure to free it by calling clearSet.
if(loadSet(&passInfoList, "passhook.dat") == 0)
{
if(outLog.is_open())
@@ -107,10 +121,10 @@
}
}
- newPassInfo.username = singleByteUsername;
- newPassInfo.password = singleBytePassword;
+ // Add the new change to the list
passInfoList.push_back(newPassInfo);
+ // Save the list to disk
if(saveSet(&passInfoList, "passhook.dat") == 0)
{
if(outLog.is_open())
@@ -128,6 +142,10 @@
}
}
+ // We need to call clearSet so memory gets free'd
+ clearSet(&passInfoList);
+
+exit:
if(passhookEventHandle == NULL)
{
if(outLog.is_open())
@@ -140,6 +158,7 @@
else
{
SetEvent(passhookEventHandle);
+ CloseHandle(passhookEventHandle);
}
outLog.close();
18 years, 1 month
[Fedora-directory-commits] winsync/passwordsync passhand.cpp, 1.8, 1.9
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/winsync/passwordsync
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv30744
Modified Files:
passhand.cpp
Log Message:
186171 - Fixed memory leaks in passhook.dll
Index: passhand.cpp
===================================================================
RCS file: /cvs/dirsec/winsync/passwordsync/passhand.cpp,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- passhand.cpp 18 Mar 2006 00:36:33 -0000 1.8
+++ passhand.cpp 22 Mar 2006 18:51:04 -0000 1.9
@@ -200,11 +200,17 @@
int clearSet(PASS_INFO_LIST* passInfoList)
{
- // ToDo: zero out memory
+ while (!passInfoList->empty()) {
+ PASS_INFO& pi = passInfoList->back();
+ SecureZeroMemory(pi.password, strlen(pi.password));
+ free(pi.password);
+ free(pi.username);
+ passInfoList->pop_back();
+ }
passInfoList->clear();
- return -1;
+ return 0;
}
int encrypt(char* plainTextBuf, int plainTextLen, char* cipherTextBuf, int cipherTextLen, int* resultTextLen)
18 years, 1 month