From: Kurt Zeilenga <kurt@openldap.org>
Date: Mon, 28 Dec 1998 18:08:42 +0000 (+0000)
Subject: Misc bug fixes from -devel:
X-Git-Tag: OPENLDAP_REL_ENG_1_1_2~17
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9918c4a0939f17eb3613d9485d171cc157691410;p=thirdparty%2Fopenldap.git

Misc bug fixes from -devel:
  Plug some memory leaks
  Change overlapping `strcpy( x, y )' to `SAFEMEMCPY( x, y, strlen( y ) + 1 )'
---

diff --git a/CHANGES b/CHANGES
index 9f4be6d447..a5b5beaa4a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,10 @@
 OpenLDAP Change Log
 
+Changes included in OpenLDAP 1.1.x
+	CVS Tag: OPENLDAP_REL_ENG_1_1
+	Fixed misc. overlapping strcpy bugs
+	Fixed misc. memory leaks
+
 Changes included in OpenLDAP 1.1.1
 	CVS Tag: OPENLDAP_REL_ENG_1_1_1
 	Updated INSTALL, README, hints, and devel documents.
diff --git a/clients/tools/ldapmodify.c b/clients/tools/ldapmodify.c
index 1817696c3d..01b2cbc851 100644
--- a/clients/tools/ldapmodify.c
+++ b/clients/tools/ldapmodify.c
@@ -414,7 +414,7 @@ process_ldapmod_rec( char *rbuf )
 	    rbuf = NULL;
 	} else {
 	    if ( *(p-1) == '\\' ) {	/* lines ending in '\' are continued */
-		strcpy( p - 1, p );
+		SAFEMEMCPY( p - 1, p, strlen( p ) + 1 );
 		rbuf = p;
 		continue;
 	    }
diff --git a/clients/ud/print.c b/clients/ud/print.c
index ba665222b1..ad62c50a4c 100644
--- a/clients/ud/print.c
+++ b/clients/ud/print.c
@@ -569,7 +569,7 @@ time2text( char *ldtimestr, int dateonly )
 
     timestr[ strlen( timestr ) - 1 ] = zone;	/* replace trailing newline */
     if ( dateonly ) {
-	strcpy( timestr + 11, timestr + 20 );
+	SAFEMEMCPY( timestr + 11, timestr + 20, strlen( timestr + 20 ) + 1 );
     }
 
     Free ( ldtimestr );
diff --git a/clients/ud/util.c b/clients/ud/util.c
index a0bd849790..ae1072f29a 100644
--- a/clients/ud/util.c
+++ b/clients/ud/util.c
@@ -206,7 +206,7 @@ fetch_buffer( char *buffer, int length, FILE *where )
 		if ( isprint( *p )) {
 			++p;
 		} else {
-			strcpy( p, p + 1 ); 
+			SAFEMEMCPY( p, p + 1, strlen( p + 1 ) + 1 ); 
 		}
 	}
 
diff --git a/libraries/libldap/tmplout.c b/libraries/libldap/tmplout.c
index d3784a92fb..e596a9b947 100644
--- a/libraries/libldap/tmplout.c
+++ b/libraries/libldap/tmplout.c
@@ -901,7 +901,7 @@ time2text( char *ldtimestr, int dateonly )
 
     timestr[ strlen( timestr ) - 1 ] = zone;	/* replace trailing newline */
     if ( dateonly ) {
-	strcpy( timestr + 11, timestr + 20 );
+	SAFEMEMCPY( timestr + 11, timestr + 20, strlen( timestr + 20 ) + 1 );
     }
 
     return( timestr );
diff --git a/libraries/libldap/ufn.c b/libraries/libldap/ufn.c
index 46a27b67ab..02ac4d0a75 100644
--- a/libraries/libldap/ufn.c
+++ b/libraries/libldap/ufn.c
@@ -100,7 +100,8 @@ ldap_ufn_search_ctx( LDAP *ld, char **ufncomp, int ncomp, char *prefix,
 
 			if ( (quote = strrchr( ufncomp[ncomp], '"' )) != NULL )
 				*quote = '\0';
-			strcpy( ufncomp[ncomp], ufncomp[ncomp] + 1 );
+			SAFEMEMCPY( ufncomp[ncomp], ufncomp[ncomp] + 1,
+				    strlen( ufncomp[ncomp] + 1 ) + 1 );
 		}
 		if ( ncomp == 0 )
 			phase = 3;
diff --git a/servers/slapd/add.c b/servers/slapd/add.c
index 0f497a0d73..6e9541b4ee 100644
--- a/servers/slapd/add.c
+++ b/servers/slapd/add.c
@@ -71,6 +71,7 @@ do_add( Connection *conn, Operation *op )
 		if ( ber_scanf( ber, "{a{V}}", &type, &vals ) == LBER_ERROR ) {
 			send_ldap_result( conn, op, LDAP_PROTOCOL_ERROR,
 			    NULL, "decoding error" );
+			free( dn );
 			entry_free( e );
 			return;
 		}
@@ -80,6 +81,8 @@ do_add( Connection *conn, Operation *op )
 			    0, 0 );
 			send_ldap_result( conn, op, LDAP_PROTOCOL_ERROR, NULL,
 			    NULL );
+			free( type );
+			free( dn );
 			entry_free( e );
 			return;
 		}
@@ -98,7 +101,9 @@ do_add( Connection *conn, Operation *op )
 	 * appropriate one, or send a referral to our "referral server"
 	 * if we don't hold it.
 	 */
-	if ( (be = select_backend( dn )) == NULL ) {
+	be = select_backend( dn );
+	free( dn );
+	if ( be == NULL ) {
 		entry_free( e );
 		send_ldap_result( conn, op, LDAP_PARTIAL_RESULTS, NULL,
 		    default_referral );
diff --git a/servers/slapd/back-ldbm/delete.c b/servers/slapd/back-ldbm/delete.c
index 64723229f9..2072e2bfd8 100644
--- a/servers/slapd/back-ldbm/delete.c
+++ b/servers/slapd/back-ldbm/delete.c
@@ -67,6 +67,7 @@ ldbm_back_delete(
 	/* XXX delete from parent's id2children entry XXX */
 	pdn = dn_parent( be, dn );
 	p = dn2entry_r( be, pdn, &matched );
+	free( pdn );
 	if ( id2children_remove( be, p, e ) != 0 ) {
 		send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR, "","" );
                 goto error_return;
diff --git a/servers/slapd/back-ldbm/dn2id.c b/servers/slapd/back-ldbm/dn2id.c
index b5ca2a4c7c..ca8c209b6f 100644
--- a/servers/slapd/back-ldbm/dn2id.c
+++ b/servers/slapd/back-ldbm/dn2id.c
@@ -189,6 +189,9 @@ dn2entry(
 	if ( (pdn = dn_parent( be, dn )) != NULL ) {
 		/* get entry with reader lock */
 		if ( (e = dn2entry_r( be, pdn, matched )) != NULL ) {
+			if(*matched != NULL) {
+				free(*matched);
+			}
 			*matched = pdn;
 			/* free entry with reader lock */
 			cache_return_entry_r( &li->li_cache, e );
diff --git a/servers/slapd/back-ldbm/filterindex.c b/servers/slapd/back-ldbm/filterindex.c
index 31d9551e17..21a9d6ef7c 100644
--- a/servers/slapd/back-ldbm/filterindex.c
+++ b/servers/slapd/back-ldbm/filterindex.c
@@ -30,7 +30,7 @@ filter_candidates(
     Filter	*f
 )
 {
-	IDList	*result;
+	IDList	*result, *tmp1, *tmp2;
 
 	Debug( LDAP_DEBUG_TRACE, "=> filter_candidates\n", 0, 0, 0 );
 
@@ -78,8 +78,11 @@ filter_candidates(
 
 	case LDAP_FILTER_NOT:
 		Debug( LDAP_DEBUG_FILTER, "\tNOT\n", 0, 0, 0 );
-		result = idl_notin( be, idl_allids( be ), filter_candidates( be,
-		    f->f_not ) );
+		tmp1 = idl_allids( be );
+		tmp2 = filter_candidates( be, f->f_not );
+		result = idl_notin( be, tmp1, tmp2 );
+		idl_free( tmp2 );
+		idl_free( tmp1 );
 		break;
 	}
 
diff --git a/servers/slapd/back-ldbm/search.c b/servers/slapd/back-ldbm/search.c
index 99bebd2248..0b488c0004 100644
--- a/servers/slapd/back-ldbm/search.c
+++ b/servers/slapd/back-ldbm/search.c
@@ -237,6 +237,10 @@ ldbm_back_search(
 							nrefs > 0 ? rbuf : NULL, nentries );
 						idl_free( candidates );
 						free( rbuf );
+
+						if( realBase != NULL) {
+							free( realBase );
+						}
 						return( 0 );
 					}
 
@@ -266,6 +270,10 @@ ldbm_back_search(
 						cache_return_entry_r( &li->li_cache, e );
 						idl_free( candidates );
 						free( rbuf );
+
+						if( realBase != NULL) {
+							free( realBase );
+						}
 						return( 0 );
 					}
 				}
@@ -414,7 +422,7 @@ subtree_candidates(
 )
 {
 	struct ldbminfo	*li = (struct ldbminfo *) be->be_private;
-	Filter		*f;
+	Filter		*f, **filterarg_ptr;
 	IDList		*candidates;
 
 	Debug(LDAP_DEBUG_TRACE, "subtree_candidates: base: %s\n",
@@ -454,7 +462,8 @@ subtree_candidates(
 		/* Patch to use normalized uppercase */
 		f->f_or->f_avvalue.bv_val = ch_strdup( "REFERRAL" );
 		f->f_or->f_avvalue.bv_len = strlen( "REFERRAL" );
-		f->f_or->f_next = filter;
+		filterarg_ptr = &f->f_or->f_next;
+		*filterarg_ptr = filter;
 		filter = f;
 
 		if ( ! be_issuffix( be, base ) ) {
@@ -477,7 +486,7 @@ subtree_candidates(
 
 	/* free up just the parts we allocated above */
 	if ( f != NULL ) {
-		f->f_and->f_next = NULL;
+		*filterarg_ptr = NULL;
 		filter_free( f );
 	}
 
diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index e5fa3bca6f..d56881a836 100644
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -484,11 +484,11 @@ strtok_quote( char *line, char *sep )
 			} else {
 				inquote = 1;
 			}
-			strcpy( next, next + 1 );
+			SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
 			break;
 
 		case '\\':
-			strcpy( next, next + 1 );
+			SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
 			break;
 
 		default:
diff --git a/servers/slapd/entry.c b/servers/slapd/entry.c
index 5e7ee6d31b..5de991f4c4 100644
--- a/servers/slapd/entry.c
+++ b/servers/slapd/entry.c
@@ -47,8 +47,6 @@ str2entry( char	*s )
 		s ? s : "NULL", 0, 0 );
 
 	e = (Entry *) ch_calloc( 1, sizeof(Entry) );
-	/* initialize reader/writer lock */
-	entry_rdwr_init(e);
 
 	/* check to see if there's an id included */
 	next = s;
@@ -58,10 +56,14 @@ str2entry( char	*s )
 			Debug( LDAP_DEBUG_TRACE,
 			    "<= str2entry NULL (missing newline after id)\n",
 			    0, 0, 0 );
+			free( e );
 			return( NULL );
 		}
 	}
 
+	/* initialize reader/writer lock */
+	entry_rdwr_init(e);
+
 	/* dn + attributes */
 	e->e_attrs = NULL;
 	vals[0] = &bval;
@@ -101,6 +103,7 @@ str2entry( char	*s )
 		    != 0 ) {
 			Debug( LDAP_DEBUG_TRACE,
 			    "<= str2entry NULL (attr_merge)\n", 0, 0, 0 );
+			entry_free( e );
 			return( NULL );
 		}
 		nvals++;
diff --git a/servers/slapd/main.c b/servers/slapd/main.c
index af2c86c8ef..543676bda9 100644
--- a/servers/slapd/main.c
+++ b/servers/slapd/main.c
@@ -268,6 +268,7 @@ main( int argc, char **argv )
 				/* log and send error */
 				Debug( LDAP_DEBUG_ANY,
 				   "ber_get_int returns 0x%lx\n", tag, 0, 0 );
+				ber_free( &ber, 1 );
 				return 1;
 			}
 
diff --git a/servers/slapd/tools/ldapsyntax.c b/servers/slapd/tools/ldapsyntax.c
index 4fa12c407a..2495e4db22 100644
--- a/servers/slapd/tools/ldapsyntax.c
+++ b/servers/slapd/tools/ldapsyntax.c
@@ -10,9 +10,13 @@
  * is provided ``as is'' without express or implied warranty.
  */
 
+#include "portable.h"
+
 #include <stdio.h>
-#include <string.h>
-#include <ctype.h>
+
+#include <ac/ctype.h>
+#include <ac/string.h>
+
 #include <quipu/commonarg.h>
 #include <quipu/attrvalue.h>
 #include <quipu/ds_error.h>
@@ -311,7 +315,7 @@ de_crypt( char *s )
     char *p;
 
     if ( strncmp( s, "{CRYPT}", 7 ) == 0 ) {
-	strcpy( s, s + 7 );			/* strip off "{CRYPT}" */
+	SAFEMEMCPY( s, s + 7, strlen( s + 7 ) + 1 ); /* strip off "{CRYPT}" */
 
 	for ( p = s; *p != '\0'; ++p) {		/* "decrypt" each byte */
 	    if ( *p != CRYPT_MASK ) {
diff --git a/servers/slapd/tools/ldif2id2children.c b/servers/slapd/tools/ldif2id2children.c
index 9ff967dfa8..cf2ed8b90e 100644
--- a/servers/slapd/tools/ldif2id2children.c
+++ b/servers/slapd/tools/ldif2id2children.c
@@ -214,6 +214,8 @@ main( int argc, char **argv )
 			line[0] = '\0';
 		}
 	}
+	if ( buf )
+		free( buf );
 
 	/*
 	 * next, make the id2children index
diff --git a/servers/slurpd/config.c b/servers/slurpd/config.c
index 43a4bcd90b..47d8fb419a 100644
--- a/servers/slurpd/config.c
+++ b/servers/slurpd/config.c
@@ -173,11 +173,11 @@ strtok_quote(
 	    } else {
 		inquote = 1;
 	    }
-	    strcpy( next, next + 1 );
+	    SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
 	    break;
 
 	case '\\':
-	    strcpy( next, next + 1 );
+	    SAFEMEMCPY( next, next + 1, strlen( next + 1 ) + 1 );
 	    break;
 
 	default: