Merge r225746 from trunk:

* modules/ldap/util_ldap_cache_mgr.c (util_ald_cache_insert): Fix a
cache corruption case: ensure that there is room in the cache for a
copy of the payload before inserting the node.

PR: 34209
Reviewed by: jorton, bnicholes, minfrin

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@227332 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index b0388c051376483357b56416ae84047f7e63a01d..b5293b51d900158c7dd434eacb571b27dcb26e81 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.0.55
 
+  *) mod_ldap: Fix a possible crash in shared memory cache handling.
+     PR 34209.  [Joe Orton]
+
   *) Fix a file descriptor leak when starting piped loggers.  [Joe Orton]
 
   *) mod_ldap: Avoid segfaults when opening connections if using a version

diff --git a/STATUS b/STATUS
index 66f0cad72b7a5012881b85f355eea60e4dd1708a..a35e02c95a1d83c95d252a91493d3f3e10f0d582 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -378,11 +378,6 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:
         http://svn.apache.org/viewcvs.cgi?rev=209539&view=rev
         +1: pquerna
 
-     *) mod_ldap: Fix cache corruption case.
-        http://svn.apache.org/viewcvs?rev=225746&view=rev
-        PR: 34209
-        +1: jorton, bnicholes, minfrin
-
      *) mod_ldap: Use the correct shm segment size, fail on
         apr_rmm_init errors.
         http://svn.apache.org/viewcvs?rev=225753&view=rev

diff --git a/modules/experimental/util_ldap_cache_mgr.c b/modules/experimental/util_ldap_cache_mgr.c
index 31c82be97438c9011bf9513e1671f7f0744167eb..17483d5da888473353c669c535c8530dfec33a82 100644 (file)
--- a/modules/experimental/util_ldap_cache_mgr.c
+++ b/modules/experimental/util_ldap_cache_mgr.c
@@ -402,11 +402,18 @@ void *util_ald_cache_insert(util_ald_cache_t *cache, void *payload)
         return NULL;
     }
 
+    /* Take a copy of the payload before proceeeding. */
+    payload = (*cache->copy)(cache, payload);
+    if (!payload) {
+        util_ald_free(cache, node);
+        return NULL;
+    }
+
     /* populate the entry */
     cache->inserts++;
     hashval = (*cache->hash)(payload) % cache->size;
     node->add_time = apr_time_now();
-    node->payload = (*cache->copy)(cache, payload);
+    node->payload = payload;
     node->next = cache->nodes[hashval];
     cache->nodes[hashval] = node;