Please review: [389 Project] #47939: Malformed cookie for LDAP Sync makes DS crash
by Noriko Hosoi
https://fedorahosted.org/389/ticket/47939
https://fedorahosted.org/389/attachment/ticket/47939/0001-Ticket-47939-Ma...
Note: I added additional check for the cookie_change_info value. If
non-digit is given, it is now releasing Sync_Cookie and return NULL.
* Format of cookie: server_signature#client_signature#change_info_number
--- a/ldap/servers/plugins/sync/sync_util.c
+++ b/ldap/servers/plugins/sync/sync_util.c
@@ -574,21 +574,32 @@ sync_cookie_parse (char *cookie)
*p = '\0';
sc->cookie_client_signature = slapi_ch_strdup(q);
sc->cookie_change_info = sync_number2int(p+1);
+ if (sc->cookie_change_info < 0) {
+ goto error_return;
+ }
9 years, 5 months
- 1
- 0