Bug#474218: nss-ldapd: Crashes when looking up many groups

[Arthur de Jong]

On Mon, 2008-04-07 at 01:07 +0200, Petter Reinholdtsen wrote: 
> [Arthur de Jong]
> > I noticed from the valgrind output you're using etch's Glibc. Are
> > you also using OpenLDAP from etch?
> 
> This is still against an AD LDAP server.

I was refering to the version of libldap2-dev, sorry I should've been
clearer.

> > How do you produce the binary (compiler, compiler flags, etc) (I
> > would recommend passing --enable-debug to configure, no optimisation
> > flags)? Anything else out of the ordinary?
> 
> I build using 'DEB_BUILD_OPTIONS=nostrip debuild'. :)

You could also try to just run configure from the source tarball and run
the resulting nslcd. Passing --enable-debug to configure may also
include some more information.

> > This is really strange, because it is when doing a hostname resolution
> > (probably for the name of the LDAP server). It should be outside the
> > scope of nslcd and before any real LDAP operations take place.
>
> I included the entire output that time, and it also included stuff
> before any LDAP operations.

Strange that it doesn't show up in the log in this email. Curiouser and
curiouser.

> It did not solve the problem.  Still crashing.  Here is the complete
> valgrind output:

Thanks for bearing with me. I just went over the code another couple of
times and I was adding extra debugging code when I came up with a
possible cause of the bug.

Could you try the attached patch? This adds clearing of the allocated
memory region (which should get rid of the "uninitialised value(s)" but
isn't a solution in itself). It also adds some logging of the values
that are added as group members. It could be that AD returns binary
attribute values which confuse nslcd. The logs should show that.

Could you test that for me and report the output on stderr (or part of
it) and possibly valgrind output?

-- 
-- arthur - [EMAIL PROTECTED] - http://people.debian.org/~adejong --

Index: nslcd/group.c
===================================================================
--- nslcd/group.c	(revision 673)
+++ nslcd/group.c	(working copy)
@@ -188,12 +188,14 @@
     log_log(LOG_CRIT,"get_members(): malloc() failed to allocate memory");
     return NULL;
   }
+  memset(buf,'\0',bufalloc);
   buf[0]='\0';
   /* add the memberUid values */
   values=myldap_get_values(entry,attmap_group_memberUid);
   if (values!=NULL)
     for (i=0;values[i]!=NULL;i++)
     {
+      fprintf(stderr,"MEMBERUID_VALUE \"%s\"\n",values[i]);
       /* ensure that we have enough space */
       if ((strlen(values[i])+2)>=(bufalloc-bufsz))
       {
@@ -206,11 +208,13 @@
           return NULL;
         }
         buf=nw;
+        memset(buf+bufsz,'\0',bufalloc-bufsz);
       }
       /* only add non-emtpty values */
       if (values[i][0]!='\0')
       {
         strcpy(buf+bufsz,values[i]);
+        fprintf(stderr,"ADDED \"%s\"\n",buf+bufsz);
         bufsz+=strlen(buf+bufsz)+1;
       }
     }
@@ -219,6 +223,7 @@
   if (values!=NULL)
     for (i=0;values[i]!=NULL;i++)
     {
+      fprintf(stderr,"UNIQUEMEMBER_VALUE \"%s\"\n",values[i]);
       /* ensure that we have enough space */
       if ((strlen(values[i])+2)>=(bufalloc-bufsz))
       {
@@ -231,6 +236,7 @@
           return NULL;
         }
         buf=nw;
+        memset(buf+bufsz,'\0',bufalloc-bufsz);
       }
       /* check the value */
       if (values[i][0]=='\0')
@@ -239,13 +245,17 @@
       {
         /* just add the value, it doesn't look like a DN */
         strcpy(buf+bufsz,values[i]);
+        fprintf(stderr,"ADDED \"%s\"\n",buf+bufsz);
         bufsz+=strlen(buf+bufsz)+1;
       }
       else
       {
         /* transform the DN into a uid */
         if (dn2uid(session,values[i],buf+bufsz,bufalloc-bufsz)!=NULL)
+        {
+          fprintf(stderr,"ADDED \"%s\"\n",buf+bufsz);
           bufsz+=strlen(buf+bufsz)+1;
+        }
       }
     }
   /* if the buffer does not contain any data, return NULL */

signature.asc
Description: This is a digitally signed message part