Print this page
1668 CVE 2011-3508 (ldap format string issues)

Split Close
Expand all
Collapse all
          --- old/usr/src/lib/libsldap/common/ns_getalias.c
          +++ new/usr/src/lib/libsldap/common/ns_getalias.c
↓ open down ↓ 14 lines elided ↑ open up ↑
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  
  22   22  /*
  23   23   * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  24   24   * Use is subject to license terms.
       25 + * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  25   26   */
  26   27  
  27      -#pragma ident   "%Z%%M% %I%     %E% SMI"
  28      -
  29   28  #include <stdlib.h>
  30   29  #include <libintl.h>
  31   30  #include <stdio.h>
  32   31  #include <errno.h>
  33   32  #include <strings.h>
  34   33  #include "ns_sldap.h"
  35   34  #include "ns_internal.h"
  36   35  
  37   36  /*
  38   37   * getldaplaliasbyname() retrieves the aliases information from the LDAP server.
↓ open down ↓ 26 lines elided ↑ open up ↑
  65   64   * This routine will then be called by __ns_ldap_list() to output
  66   65   * "(&(dept=sds)(|(cn=abc)(mail=abc)))" as the real search
  67   66   * filter, if the input SSD contains a filter "dpet=sds".
  68   67   */
  69   68  int
  70   69  __s_api_merge_SSD_filter(const ns_ldap_search_desc_t *desc,
  71   70                          char **realfilter,
  72   71                          const void *userdata)
  73   72  {
  74   73          int     len;
       74 +        char *checker;
  75   75  
  76   76          /* sanity check */
  77   77          if (realfilter == NULL)
  78   78                  return (NS_LDAP_INVALID_PARAM);
  79   79          *realfilter = NULL;
  80   80  
  81      -        if (desc == NULL || desc->filter == NULL ||
  82      -                        userdata == NULL)
       81 +        if (desc == NULL || desc->filter == NULL || userdata == NULL)
  83   82                  return (NS_LDAP_INVALID_PARAM);
  84   83  
       84 +        /* Parameter check.  We only want one %s here, otherwise bail. */
       85 +        len = 0;        /* Reuse 'len' as "Number of %s hits"... */
       86 +        checker = (char *)userdata;
       87 +        do {
       88 +                checker = strchr(checker, '%');
       89 +                if (checker != NULL) {
       90 +                        if (len > 0 || *(checker + 1) != 's')
       91 +                                return (NS_LDAP_INVALID_PARAM);
       92 +                        len++;  /* Got our %s. */
       93 +                        checker += 2;
       94 +                } else if (len != 1)
       95 +                        return (NS_LDAP_INVALID_PARAM);
       96 +        } while (checker != NULL);
       97 +
  85   98          len = strlen(userdata) + strlen(desc->filter) + 1;
  86   99  
  87  100          *realfilter = (char *)malloc(len);
  88  101          if (*realfilter == NULL)
  89  102                  return (NS_LDAP_MEMORY);
  90  103  
  91      -        (void) sprintf(*realfilter, (char *)userdata,
  92      -                        desc->filter);
      104 +        (void) sprintf(*realfilter, (char *)userdata, desc->filter);
  93  105  
  94  106          return (NS_LDAP_SUCCESS);
  95  107  }
  96  108  char *
  97  109  __getldapaliasbyname(char *alias, int *retval)
  98  110  {
  99  111          char            *service = "aliases";
 100  112          char            filter[BUFSIZE];
 101  113          char            userdata[BUFSIZE];
 102  114          char            *attribute[2];
↓ open down ↓ 32 lines elided ↑ open up ↑
 135  147                  errno = EINVAL;
 136  148                  *retval = -1;
 137  149                  return (NULL);
 138  150          }
 139  151  
 140  152          attribute[0] = MAIL_MEMBER;
 141  153          attribute[1] = NULL;
 142  154  
 143  155          /* should we do hardlookup */
 144  156          rc = __ns_ldap_list(service, (const char *)filter,
 145      -                __s_api_merge_SSD_filter,
 146      -                (const char **)attribute, NULL, 0, &result,
 147      -                &errorp, NULL, userdata);
      157 +            __s_api_merge_SSD_filter,
      158 +            (const char **)attribute, NULL, 0, &result,
      159 +            &errorp, NULL, userdata);
 148  160  
 149  161          if (rc == NS_LDAP_NOTFOUND) {
 150  162                  errno = ENOENT;
 151  163                  *retval = 1;
 152  164                  return (NULL);
 153  165          } else if (rc != NS_LDAP_SUCCESS) {
 154  166  #ifdef DEBUG
 155  167                  char *p;
 156  168                  (void) __ns_ldap_err2str(rc, &p);
 157  169                  if (errorp) {
 158  170                          if (errorp->message)
 159  171                                  (void) fprintf(stderr, "%s (%s)\n", p,
 160      -                                        errorp->message);
      172 +                                    errorp->message);
 161  173                  } else
 162  174                          (void) fprintf(stderr, "%s\n", p);
 163  175  #endif /* DEBUG */
 164  176                  (void) __ns_ldap_freeError(&errorp);
 165  177                  *retval = -1;
 166  178                  return (NULL);
 167  179          }
 168  180  
 169  181          /* build the return value */
 170  182          answer[0] = '\0';
↓ open down ↓ 48 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX