Print this page
1668 CVE 2011-3508 (ldap format string issues)


   5  * Common Development and Distribution License, Version 1.0 only
   6  * (the "License").  You may not use this file except in compliance
   7  * with the License.
   8  *
   9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  10  * or http://www.opensolaris.org/os/licensing.
  11  * See the License for the specific language governing permissions
  12  * and limitations under the License.
  13  *
  14  * When distributing Covered Code, include this CDDL HEADER in each
  15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  16  * If applicable, add the following below this CDDL HEADER, with the
  17  * fields enclosed by brackets "[]" replaced with your own identifying
  18  * information: Portions Copyright [yyyy] [name of copyright owner]
  19  *
  20  * CDDL HEADER END
  21  */
  22 /*
  23  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.

  25  */
  26 
  27 #pragma ident   "%Z%%M% %I%     %E% SMI"
  28 
  29 #include <sys/systeminfo.h>
  30 #include "ldap_common.h"
  31 
  32 
  33 #ifdef DEBUG
  34 /*
  35  * Debugging routine for printing the value of a result
  36  * structure
  37  */
  38 int
  39 printresult(ns_ldap_result_t *result)
  40 {
  41         int             i, j, k;
  42         ns_ldap_entry_t *curEntry;
  43 
  44         printf("--------------------------------------\n");
  45         printf("entries_count %d\n", result->entries_count);
  46         curEntry = result->entry;
  47         for (i = 0; i < result->entries_count; i++) {
  48                 printf("entry %d has attr_count = %d \n",


 198  * an existing search filter. This routine expects userdata
 199  * contain a format string with a single %s in it, and will
 200  * use the format string with sprintf() to insert the SSD filter.
 201  *
 202  * This routine is passed to the __ns_ldap_list() or
 203  * __ns_ldap_firstEntry() APIs as the filter call back
 204  * together with the userdata. For example,
 205  * the gethostbyname processing may call __ns_ldap_list() with
 206  * "(&(objectClass=ipHost)(cn=sys1))" as filter, this function
 207  * as the filter call back, and "(&(%s)(cn=sys1))" as the
 208  * userdata, this routine will in turn gets call to produce
 209  * "(&(department=sds)(cn=sys1))" as the real search
 210  * filter, if the input SSD contains a filter "department=sds".
 211  */
 212 int
 213 _merge_SSD_filter(const ns_ldap_search_desc_t *desc,
 214                         char **realfilter,
 215                         const void *userdata)
 216 {
 217         int     len;

 218 
 219 #ifdef DEBUG
 220         (void) fprintf(stdout, "\n[ldap_utils.c: _merge_SSD_filter]\n");
 221 #endif /* DEBUG */
 222 
 223         /* sanity check */
 224         if (realfilter == NULL)
 225                 return (NS_LDAP_INVALID_PARAM);
 226         *realfilter = NULL;
 227 
 228         if (desc == NULL || desc->filter == NULL ||
 229                         userdata == NULL)
 230                 return (NS_LDAP_INVALID_PARAM);
 231 














 232 #ifdef DEBUG
 233         (void) fprintf(stdout, "\n[userdata: %s]\n", (char *)userdata);
 234         (void) fprintf(stdout, "\n[SSD filter: %s]\n", desc->filter);
 235 #endif /* DEBUG */
 236 
 237         len = strlen(userdata) + strlen(desc->filter) + 1;
 238 
 239         *realfilter = (char *)malloc(len);
 240         if (*realfilter == NULL)
 241                 return (NS_LDAP_MEMORY);
 242 
 243         (void) sprintf(*realfilter, (char *)userdata,
 244                         desc->filter);
 245 
 246 #ifdef DEBUG
 247         (void) fprintf(stdout, "\n[new filter: %s]\n", *realfilter);
 248 #endif /* DEBUG */
 249 
 250         return (NS_LDAP_SUCCESS);
 251 }
 252 
 253 static char
 254 hex_char(int n)
 255 {
 256         return ("0123456789abcdef"[n & 0xf]);
 257 }
 258 
 259 int
 260 _ldap_filter_name(char *filter_name, const char *name, int filter_name_size)
 261 {
 262         char *end = filter_name + filter_name_size;
 263         char c;
 264 




   5  * Common Development and Distribution License, Version 1.0 only
   6  * (the "License").  You may not use this file except in compliance
   7  * with the License.
   8  *
   9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  10  * or http://www.opensolaris.org/os/licensing.
  11  * See the License for the specific language governing permissions
  12  * and limitations under the License.
  13  *
  14  * When distributing Covered Code, include this CDDL HEADER in each
  15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  16  * If applicable, add the following below this CDDL HEADER, with the
  17  * fields enclosed by brackets "[]" replaced with your own identifying
  18  * information: Portions Copyright [yyyy] [name of copyright owner]
  19  *
  20  * CDDL HEADER END
  21  */
  22 /*
  23  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  26  */
  27 


  28 #include <sys/systeminfo.h>
  29 #include "ldap_common.h"
  30 
  31 
  32 #ifdef DEBUG
  33 /*
  34  * Debugging routine for printing the value of a result
  35  * structure
  36  */
  37 int
  38 printresult(ns_ldap_result_t *result)
  39 {
  40         int             i, j, k;
  41         ns_ldap_entry_t *curEntry;
  42 
  43         printf("--------------------------------------\n");
  44         printf("entries_count %d\n", result->entries_count);
  45         curEntry = result->entry;
  46         for (i = 0; i < result->entries_count; i++) {
  47                 printf("entry %d has attr_count = %d \n",


 197  * an existing search filter. This routine expects userdata
 198  * contain a format string with a single %s in it, and will
 199  * use the format string with sprintf() to insert the SSD filter.
 200  *
 201  * This routine is passed to the __ns_ldap_list() or
 202  * __ns_ldap_firstEntry() APIs as the filter call back
 203  * together with the userdata. For example,
 204  * the gethostbyname processing may call __ns_ldap_list() with
 205  * "(&(objectClass=ipHost)(cn=sys1))" as filter, this function
 206  * as the filter call back, and "(&(%s)(cn=sys1))" as the
 207  * userdata, this routine will in turn gets call to produce
 208  * "(&(department=sds)(cn=sys1))" as the real search
 209  * filter, if the input SSD contains a filter "department=sds".
 210  */
 211 int
 212 _merge_SSD_filter(const ns_ldap_search_desc_t *desc,
 213                         char **realfilter,
 214                         const void *userdata)
 215 {
 216         int     len;
 217         char *checker;
 218 
 219 #ifdef DEBUG
 220         (void) fprintf(stdout, "\n[ldap_utils.c: _merge_SSD_filter]\n");
 221 #endif /* DEBUG */
 222 
 223         /* sanity check */
 224         if (realfilter == NULL)
 225                 return (NS_LDAP_INVALID_PARAM);
 226         *realfilter = NULL;
 227 
 228         if (desc == NULL || desc->filter == NULL || userdata == NULL)

 229                 return (NS_LDAP_INVALID_PARAM);
 230 
 231         /* Parameter check.  We only want one %s here, otherwise bail. */
 232         len = 0;        /* Reuse 'len' as "Number of %s hits"... */
 233         checker = (char *)userdata;
 234         do {
 235                 checker = strchr(checker, '%');
 236                 if (checker != NULL) {
 237                         if (len > 0 || *(checker + 1) != 's')
 238                                 return (NS_LDAP_INVALID_PARAM);
 239                         len++;  /* Got our %s. */
 240                         checker += 2;
 241                 } else if (len != 1)
 242                         return (NS_LDAP_INVALID_PARAM);
 243         } while (checker != NULL);
 244 
 245 #ifdef DEBUG
 246         (void) fprintf(stdout, "\n[userdata: %s]\n", (char *)userdata);
 247         (void) fprintf(stdout, "\n[SSD filter: %s]\n", desc->filter);
 248 #endif /* DEBUG */
 249 
 250         len = strlen(userdata) + strlen(desc->filter) + 1;
 251 
 252         *realfilter = (char *)malloc(len);
 253         if (*realfilter == NULL)
 254                 return (NS_LDAP_MEMORY);
 255 
 256         (void) sprintf(*realfilter, (char *)userdata, desc->filter);

 257 
 258 #ifdef DEBUG
 259         (void) fprintf(stdout, "\n[new filter: %s]\n", *realfilter);
 260 #endif /* DEBUG */
 261 
 262         return (NS_LDAP_SUCCESS);
 263 }
 264 
 265 static char
 266 hex_char(int n)
 267 {
 268         return ("0123456789abcdef"[n & 0xf]);
 269 }
 270 
 271 int
 272 _ldap_filter_name(char *filter_name, const char *name, int filter_name_size)
 273 {
 274         char *end = filter_name + filter_name_size;
 275         char c;
 276