Misc bug fixes from -devel:

  Plug some memory leaks
  Change overlapping `strcpy( x, y )' to `SAFEMEMCPY( x, y, strlen( y ) + 1 )'

diff --git a/CHANGES b/CHANGES
index 9f4be6d44753fd8e371247f632f19cc7d9887934..a5b5beaa4a09da1e33e24ee07d2f5645cfe13f35 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,10 @@
 OpenLDAP Change Log
 
+Changes included in OpenLDAP 1.1.x
+       CVS Tag: OPENLDAP_REL_ENG_1_1
+       Fixed misc. overlapping strcpy bugs
+       Fixed misc. memory leaks
+
 Changes included in OpenLDAP 1.1.1
        CVS Tag: OPENLDAP_REL_ENG_1_1_1
        Updated INSTALL, README, hints, and devel documents.

diff --git a/clients/tools/ldapmodify.c b/clients/tools/ldapmodify.c
index 1817696c3d1e95e1989d0b7eb5a50d2c258dc396..01b2cbc85142ec0ace613d6469335d2dc6c389fb 100644 (file)
--- a/clients/tools/ldapmodify.c
+++ b/clients/tools/ldapmodify.c
@@ -414,7 +414,7 @@ process_ldapmod_rec( char *rbuf )
            rbuf = NULL;
        } else {
            if ( *(p-1) == '\\' ) {     /* lines ending in '\' are continued */
-               strcpy( p - 1, p );
+               SAFEMEMCPY( p - 1, p, strlen( p ) + 1 );
                rbuf = p;
                continue;
            }

diff --git a/clients/ud/print.c b/clients/ud/print.c
index ba665222b19b15c59a0c7b7d97d7dae5f39aabc0..ad62c50a4cf2096fbdce2bd9cd96391d9da94413 100644 (file)
--- a/clients/ud/print.c
+++ b/clients/ud/print.c
@@ -569,7 +569,7 @@ time2text( char *ldtimestr, int dateonly )
 
     timestr[ strlen( timestr ) - 1 ] = zone;   /* replace trailing newline */
     if ( dateonly ) {
-       strcpy( timestr + 11, timestr + 20 );
+       SAFEMEMCPY( timestr + 11, timestr + 20, strlen( timestr + 20 ) + 1 );
     }
 
     Free ( ldtimestr );

diff --git a/clients/ud/util.c b/clients/ud/util.c
index a0bd8497904a27db77d91e9e5abca0c4361e82c2..ae1072f29a0993cb2ddefb80af779135e8dc0387 100644 (file)
--- a/clients/ud/util.c
+++ b/clients/ud/util.c
@@ -206,7 +206,7 @@ fetch_buffer( char *buffer, int length, FILE *where )
                if ( isprint( *p )) {
                        ++p;
                } else {
-                       strcpy( p, p + 1 ); 
+                       SAFEMEMCPY( p, p + 1, strlen( p + 1 ) + 1 ); 
                }
        }
 

diff --git a/libraries/libldap/tmplout.c b/libraries/libldap/tmplout.c
index d3784a92fb90055a6472e420ccda126e774d0119..e596a9b94726ce35d001751af1b96ac058de7c4e 100644 (file)
--- a/libraries/libldap/tmplout.c
+++ b/libraries/libldap/tmplout.c
@@ -901,7 +901,7 @@ time2text( char *ldtimestr, int dateonly )
 
     timestr[ strlen( timestr ) - 1 ] = zone;   /* replace trailing newline */
     if ( dateonly ) {
-       strcpy( timestr + 11, timestr + 20 );
+       SAFEMEMCPY( timestr + 11, timestr + 20, strlen( timestr + 20 ) + 1 );
     }
 
     return( timestr );

diff --git a/libraries/libldap/ufn.c b/libraries/libldap/ufn.c
index 46a27b67ab91e6cc650d240252a1d1ab6ed4faca..02ac4d0a75ffb6b7309c445871e78b1d1df0fcc4 100644 (file)
--- a/libraries/libldap/ufn.c
+++ b/libraries/libldap/ufn.c
@@ -100,7 +100,8 @@ ldap_ufn_search_ctx( LDAP *ld, char **ufncomp, int ncomp, char *prefix,
 
                        if ( (quote = strrchr( ufncomp[ncomp], '"' )) != NULL )
                                *quote = '\0';
-                       strcpy( ufncomp[ncomp], ufncomp[ncomp] + 1 );
+                       SAFEMEMCPY( ufncomp[ncomp], ufncomp[ncomp] + 1,
+                                   strlen( ufncomp[ncomp] + 1 ) + 1 );
                }
                if ( ncomp == 0 )
                        phase = 3;

diff --git a/servers/slapd/add.c b/servers/slapd/add.c
index 0f497a0d73767a709692c7fba0849d3947c2e1e2..6e9541b4ee38e4e1811c7e754f563f1415a4fc74 100644 (file)
--- a/servers/slapd/add.c
+++ b/servers/slapd/add.c
@@ -71,6 +71,7 @@ do_add( Connection *conn, Operation *op )
                if ( ber_scanf( ber, "{a{V}}", &type, &vals ) == LBER_ERROR ) {
                        send_ldap_result( conn, op, LDAP_PROTOCOL_ERROR,
                            NULL, "decoding error" );
+                       free( dn );
                        entry_free( e );
                        return;
                }
@@ -80,6 +81,8 @@ do_add( Connection *conn, Operation *op )
                            0, 0 );
                        send_ldap_result( conn, op, LDAP_PROTOCOL_ERROR, NULL,
                            NULL );
+                       free( type );
+                       free( dn );
                        entry_free( e );
                        return;
                }
@@ -98,7 +101,9 @@ do_add( Connection *conn, Operation *op )
         * appropriate one, or send a referral to our "referral server"
         * if we don't hold it.
         */
-       if ( (be = select_backend( dn )) == NULL ) {
+       be = select_backend( dn );
+       free( dn );
+       if ( be == NULL ) {
                entry_free( e );
                send_ldap_result( conn, op, LDAP_PARTIAL_RESULTS, NULL,
                    default_referral );

diff --git a/servers/slapd/back-ldbm/delete.c b/servers/slapd/back-ldbm/delete.c
index 64723229f9dd7e1ce83dbadd14b4f25c363d958c..2072e2bfd8590fb0072408178ba6585f933249b5 100644 (file)
--- a/servers/slapd/back-ldbm/delete.c
+++ b/servers/slapd/back-ldbm/delete.c
@@ -67,6 +67,7 @@ ldbm_back_delete(
        /* XXX delete from parent's id2children entry XXX */
        pdn = dn_parent( be, dn );
        p = dn2entry_r( be, pdn, &matched );
+       free( pdn );
        if ( id2children_remove( be, p, e ) != 0 ) {
                send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR, "","" );
                 goto error_return;

diff --git a/servers/slapd/back-ldbm/dn2id.c b/servers/slapd/back-ldbm/dn2id.c
index b5ca2a4c7c0d84d61996629d46e5e45c86f1b2bd..ca8c209b6ff9f59f3ef1b9deddf584832214eea6 100644 (file)
--- a/servers/slapd/back-ldbm/dn2id.c
+++ b/servers/slapd/back-ldbm/dn2id.c
@@ -189,6 +189,9 @@ dn2entry(
        if ( (pdn = dn_parent( be, dn )) != NULL ) {
                /* get entry with reader lock */
                if ( (e = dn2entry_r( be, pdn, matched )) != NULL ) {
+                       if(*matched != NULL) {
+                               free(*matched);
+                       }
                        *matched = pdn;
                        /* free entry with reader lock */
                        cache_return_entry_r( &li->li_cache, e );

diff --git a/servers/slapd/back-ldbm/filterindex.c b/servers/slapd/back-ldbm/filterindex.c
index 31d9551e17a64a7bc43a5dbfa88b0c294510fb2b..21a9d6ef7c44e0bd60aad7ae7ced7ea2db761f94 100644 (file)
--- a/servers/slapd/back-ldbm/filterindex.c
+++ b/servers/slapd/back-ldbm/filterindex.c
@@ -30,7 +30,7 @@ filter_candidates(
     Filter     *f
 )
 {
-       IDList  *result;
+       IDList  *result, *tmp1, *tmp2;
 
        Debug( LDAP_DEBUG_TRACE, "=> filter_candidates\n", 0, 0, 0 );
 
@@ -78,8 +78,11 @@ filter_candidates(
 
        case LDAP_FILTER_NOT:
                Debug( LDAP_DEBUG_FILTER, "\tNOT\n", 0, 0, 0 );
-               result = idl_notin( be, idl_allids( be ), filter_candidates( be,
-                   f->f_not ) );
+               tmp1 = idl_allids( be );
+               tmp2 = filter_candidates( be, f->f_not );
+               result = idl_notin( be, tmp1, tmp2 );
+               idl_free( tmp2 );
+               idl_free( tmp1 );
                break;
        }
 

diff --git a/servers/slapd/back-ldbm/search.c b/servers/slapd/back-ldbm/search.c
index 99bebd224817ab11e083c7b7b37317e2c855e611..0b488c00041a33e748dc0cb450cde7a5faf17de8 100644 (file)
--- a/servers/slapd/back-ldbm/search.c
+++ b/servers/slapd/back-ldbm/search.c
@@ -237,6 +237,10 @@ ldbm_back_search(
                                                        nrefs > 0 ? rbuf : NULL, nentries );
                                                idl_free( candidates );
                                                free( rbuf );
+
+                                               if( realBase != NULL) {
+                                                       free( realBase );
+                                               }
                                                return( 0 );
                                        }
 
@@ -266,6 +270,10 @@ ldbm_back_search(
                                                cache_return_entry_r( &li->li_cache, e );
                                                idl_free( candidates );
                                                free( rbuf );
+
+                                               if( realBase != NULL) {
+                                                       free( realBase );
+                                               }
                                                return( 0 );
                                        }
                                }
@@ -414,7 +422,7 @@ subtree_candidates(
 )
 {
        struct ldbminfo *li = (struct ldbminfo *) be->be_private;
-       Filter          *f;
+       Filter          *f, **filterarg_ptr;
        IDList          *candidates;
 
        Debug(LDAP_DEBUG_TRACE, "subtree_candidates: base: %s\n",
@@ -454,7 +462,8 @@ subtree_candidates(
                /* Patch to use normalized uppercase */
                f->f_or->f_avvalue.bv_val = ch_strdup( "REFERRAL" );
                f->f_or->f_avvalue.bv_len = strlen( "REFERRAL" );
-               f->f_or->f_next = filter;
+               filterarg_ptr = &f->f_or->f_next;
+               *filterarg_ptr = filter;
                filter = f;
 
                if ( ! be_issuffix( be, base ) ) {
@@ -477,7 +486,7 @@ subtree_candidates(
 
        /* free up just the parts we allocated above */
        if ( f != NULL ) {
-               f->f_and->f_next = NULL;
+               *filterarg_ptr = NULL;
                filter_free( f );
        }
 

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index e5fa3bca6f08380b764f35951e2695c917ae9b94..d56881a8364095db1efda861ae8f45eb41508b67 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -484,11 +484,11 @@ strtok_quote( char *line, char *sep )
                        } else {
                                inquote = 1;
                        }
-                       strcpy( next, next + 1 );
+                       SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
                        break;
 
                case '\\':
-                       strcpy( next, next + 1 );
+                       SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
                        break;
 
                default:

diff --git a/servers/slapd/entry.c b/servers/slapd/entry.c
index 5e7ee6d31b73ab997e0c2cc535cfcc814255478d..5de991f4c45991f321e2fb2ca5f180007ddb13bc 100644 (file)
--- a/servers/slapd/entry.c
+++ b/servers/slapd/entry.c
@@ -47,8 +47,6 @@ str2entry( char       *s )
                s ? s : "NULL", 0, 0 );
 
        e = (Entry *) ch_calloc( 1, sizeof(Entry) );
-       /* initialize reader/writer lock */
-       entry_rdwr_init(e);
 
        /* check to see if there's an id included */
        next = s;
@@ -58,10 +56,14 @@ str2entry( char     *s )
                        Debug( LDAP_DEBUG_TRACE,
                            "<= str2entry NULL (missing newline after id)\n",
                            0, 0, 0 );
+                       free( e );
                        return( NULL );
                }
        }
 
+       /* initialize reader/writer lock */
+       entry_rdwr_init(e);
+
        /* dn + attributes */
        e->e_attrs = NULL;
        vals[0] = &bval;
@@ -101,6 +103,7 @@ str2entry( char     *s )
                    != 0 ) {
                        Debug( LDAP_DEBUG_TRACE,
                            "<= str2entry NULL (attr_merge)\n", 0, 0, 0 );
+                       entry_free( e );
                        return( NULL );
                }
                nvals++;

diff --git a/servers/slapd/main.c b/servers/slapd/main.c
index af2c86c8ef5e6cfad3ddc4230e964d501243ce80..543676bda9259b70aee504321b80a8da757d2999 100644 (file)
--- a/servers/slapd/main.c
+++ b/servers/slapd/main.c
@@ -268,6 +268,7 @@ main( int argc, char **argv )
                                /* log and send error */
                                Debug( LDAP_DEBUG_ANY,
                                   "ber_get_int returns 0x%lx\n", tag, 0, 0 );
+                               ber_free( &ber, 1 );
                                return 1;
                        }
 

diff --git a/servers/slapd/tools/ldapsyntax.c b/servers/slapd/tools/ldapsyntax.c
index 4fa12c407aefacef435a029e7c03f2c866238efe..2495e4db22d6dab7eda7c13e1f9e794b4a07b2ea 100644 (file)
--- a/servers/slapd/tools/ldapsyntax.c
+++ b/servers/slapd/tools/ldapsyntax.c
@@ -10,9 +10,13 @@
  * is provided ``as is'' without express or implied warranty.
  */
 
+#include "portable.h"
+
 #include <stdio.h>
-#include <string.h>
-#include <ctype.h>
+
+#include <ac/ctype.h>
+#include <ac/string.h>
+
 #include <quipu/commonarg.h>
 #include <quipu/attrvalue.h>
 #include <quipu/ds_error.h>
@@ -311,7 +315,7 @@ de_crypt( char *s )
     char *p;
 
     if ( strncmp( s, "{CRYPT}", 7 ) == 0 ) {
-       strcpy( s, s + 7 );                     /* strip off "{CRYPT}" */
+       SAFEMEMCPY( s, s + 7, strlen( s + 7 ) + 1 ); /* strip off "{CRYPT}" */
 
        for ( p = s; *p != '\0'; ++p) {         /* "decrypt" each byte */
            if ( *p != CRYPT_MASK ) {

diff --git a/servers/slapd/tools/ldif2id2children.c b/servers/slapd/tools/ldif2id2children.c
index 9ff967dfa868e2a36fc456a953023b6e9b88cd45..cf2ed8b90e04d2a32079e5eb100d40c8c28eec5b 100644 (file)
--- a/servers/slapd/tools/ldif2id2children.c
+++ b/servers/slapd/tools/ldif2id2children.c
@@ -214,6 +214,8 @@ main( int argc, char **argv )
                        line[0] = '\0';
                }
        }
+       if ( buf )
+               free( buf );
 
        /*
         * next, make the id2children index

diff --git a/servers/slurpd/config.c b/servers/slurpd/config.c
index 43a4bcd90b8796ac465a22086461a29d18a5bd0b..47d8fb419add4b00f68b308c65df6cf7e9e24d5f 100644 (file)
--- a/servers/slurpd/config.c
+++ b/servers/slurpd/config.c
@@ -173,11 +173,11 @@ strtok_quote(
            } else {
                inquote = 1;
            }
-           strcpy( next, next + 1 );
+           SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
            break;
 
        case '\\':
-           strcpy( next, next + 1 );
+           SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
            break;
 
        default: