Print this page
1668 CVE 2011-3508 (ldap format string issues)


   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.

  25  */
  26 
  27 #pragma ident   "%Z%%M% %I%     %E% SMI"
  28 
  29 #include <stdlib.h>
  30 #include <libintl.h>
  31 #include <stdio.h>
  32 #include <errno.h>
  33 #include <strings.h>
  34 #include "ns_sldap.h"
  35 #include "ns_internal.h"
  36 
  37 /*
  38  * getldaplaliasbyname() retrieves the aliases information from the LDAP server.
  39  * This is requires that the LDAP naming information (ie. LDAP_CLIENT_CACHE
  40  * file) is configured properly on the client machine.
  41  *
  42  * Return value:
  43  *      0 = success;
  44  *      1 = alias not found;
  45  *      -1 = other failure.  Contents in answer are undefined.
  46  */
  47 
  48 #define ALIAS_FILTER     "(&(objectclass=mailgroup)(|(cn=%s)(mail=%s)))"


  55  * This is a generic filter call back function for
  56  * merging the filter from service search descriptor with
  57  * an existing search filter. This routine expects userdata
  58  * contain a format string with a single %s in it, and will
  59  * use the format string with sprintf() to insert the SSD filter.
  60  *
  61  * This routine is passed to the __ns_ldap_list() API as the
  62  * filter call back together with filter and userdata. For example,
  63  * "(&(objectclass=mailgroup)(|(cn=abc)(mail=abc)))" as filter
  64  * and "(&(%s)(|(cn=abc)(mail=abc)))" as userdata.
  65  * This routine will then be called by __ns_ldap_list() to output
  66  * "(&(dept=sds)(|(cn=abc)(mail=abc)))" as the real search
  67  * filter, if the input SSD contains a filter "dpet=sds".
  68  */
  69 int
  70 __s_api_merge_SSD_filter(const ns_ldap_search_desc_t *desc,
  71                         char **realfilter,
  72                         const void *userdata)
  73 {
  74         int     len;

  75 
  76         /* sanity check */
  77         if (realfilter == NULL)
  78                 return (NS_LDAP_INVALID_PARAM);
  79         *realfilter = NULL;
  80 
  81         if (desc == NULL || desc->filter == NULL ||
  82                         userdata == NULL)
  83                 return (NS_LDAP_INVALID_PARAM);
  84 














  85         len = strlen(userdata) + strlen(desc->filter) + 1;
  86 
  87         *realfilter = (char *)malloc(len);
  88         if (*realfilter == NULL)
  89                 return (NS_LDAP_MEMORY);
  90 
  91         (void) sprintf(*realfilter, (char *)userdata,
  92                         desc->filter);
  93 
  94         return (NS_LDAP_SUCCESS);
  95 }
  96 char *
  97 __getldapaliasbyname(char *alias, int *retval)
  98 {
  99         char            *service = "aliases";
 100         char            filter[BUFSIZE];
 101         char            userdata[BUFSIZE];
 102         char            *attribute[2];
 103         ns_ldap_result_t        *result = NULL;
 104         ns_ldap_error_t *errorp = NULL;
 105         int             rc, i, j, len, comma;
 106         ns_ldap_entry_t *entry = NULL;
 107         char            **attr_value = NULL;
 108         char            *answer, *new_answer;
 109         size_t          ans_size = BUFSIZE;
 110 
 111         if (!alias || !*alias) {
 112                 errno = EINVAL;




   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  26  */
  27 


  28 #include <stdlib.h>
  29 #include <libintl.h>
  30 #include <stdio.h>
  31 #include <errno.h>
  32 #include <strings.h>
  33 #include "ns_sldap.h"
  34 #include "ns_internal.h"
  35 
  36 /*
  37  * getldaplaliasbyname() retrieves the aliases information from the LDAP server.
  38  * This is requires that the LDAP naming information (ie. LDAP_CLIENT_CACHE
  39  * file) is configured properly on the client machine.
  40  *
  41  * Return value:
  42  *      0 = success;
  43  *      1 = alias not found;
  44  *      -1 = other failure.  Contents in answer are undefined.
  45  */
  46 
  47 #define ALIAS_FILTER     "(&(objectclass=mailgroup)(|(cn=%s)(mail=%s)))"


  54  * This is a generic filter call back function for
  55  * merging the filter from service search descriptor with
  56  * an existing search filter. This routine expects userdata
  57  * contain a format string with a single %s in it, and will
  58  * use the format string with sprintf() to insert the SSD filter.
  59  *
  60  * This routine is passed to the __ns_ldap_list() API as the
  61  * filter call back together with filter and userdata. For example,
  62  * "(&(objectclass=mailgroup)(|(cn=abc)(mail=abc)))" as filter
  63  * and "(&(%s)(|(cn=abc)(mail=abc)))" as userdata.
  64  * This routine will then be called by __ns_ldap_list() to output
  65  * "(&(dept=sds)(|(cn=abc)(mail=abc)))" as the real search
  66  * filter, if the input SSD contains a filter "dpet=sds".
  67  */
  68 int
  69 __s_api_merge_SSD_filter(const ns_ldap_search_desc_t *desc,
  70                         char **realfilter,
  71                         const void *userdata)
  72 {
  73         int     len;
  74         char *checker;
  75 
  76         /* sanity check */
  77         if (realfilter == NULL)
  78                 return (NS_LDAP_INVALID_PARAM);
  79         *realfilter = NULL;
  80 
  81         if (desc == NULL || desc->filter == NULL || userdata == NULL)

  82                 return (NS_LDAP_INVALID_PARAM);
  83 
  84         /* Parameter check.  We only want one %s here, otherwise bail. */
  85         len = 0;        /* Reuse 'len' as "Number of %s hits"... */
  86         checker = (char *)userdata;
  87         do {
  88                 checker = strchr(checker, '%');
  89                 if (checker != NULL) {
  90                         if (len > 0 || *(checker + 1) != 's')
  91                                 return (NS_LDAP_INVALID_PARAM);
  92                         len++;  /* Got our %s. */
  93                         checker += 2;
  94                 } else if (len != 1)
  95                         return (NS_LDAP_INVALID_PARAM);
  96         } while (checker != NULL);
  97 
  98         len = strlen(userdata) + strlen(desc->filter) + 1;
  99 
 100         *realfilter = (char *)malloc(len);
 101         if (*realfilter == NULL)
 102                 return (NS_LDAP_MEMORY);
 103 
 104         (void) sprintf(*realfilter, (char *)userdata, desc->filter);

 105 
 106         return (NS_LDAP_SUCCESS);
 107 }
 108 char *
 109 __getldapaliasbyname(char *alias, int *retval)
 110 {
 111         char            *service = "aliases";
 112         char            filter[BUFSIZE];
 113         char            userdata[BUFSIZE];
 114         char            *attribute[2];
 115         ns_ldap_result_t        *result = NULL;
 116         ns_ldap_error_t *errorp = NULL;
 117         int             rc, i, j, len, comma;
 118         ns_ldap_entry_t *entry = NULL;
 119         char            **attr_value = NULL;
 120         char            *answer, *new_answer;
 121         size_t          ans_size = BUFSIZE;
 122 
 123         if (!alias || !*alias) {
 124                 errno = EINVAL;