check if the clone ref exists before loading it

and also check that a clone ref cannot refer to a parent. otherwise
we have recursive clones, and that's bad.

diff --git a/src/lib/util/dict_fixup.c b/src/lib/util/dict_fixup.c
index a0cc2c7997dec35a1655e903c53bcbfecaff3ad8..67304cd2781a895927b7c147642f6938fdc7b997 100644 (file)
--- a/src/lib/util/dict_fixup.c
+++ b/src/lib/util/dict_fixup.c
@@ -412,8 +412,23 @@ static inline CC_HINT(always_inline) int dict_fixup_clone_apply(UNUSED dict_fixu
        fr_dict_attr_t          *cloned;
        fr_dict_t               *dict = fr_dict_unconst(fr_dict_by_da(fixup->da));
 
-       da = dict_find_or_load_reference(&dict, fixup->ref, fixup->common.filename, fixup->common.line);
-       if (!da) return -1;
+       /*
+        *      We can't clone our parents.
+        */
+       da = fr_dict_attr_by_oid(NULL, fr_dict_root(dict), fixup->ref);
+       if (da) {
+               fr_dict_attr_t const *old;
+
+               old = fr_dict_attr_common_parent(da, fixup->da, false);
+               if (old) {
+                       fr_strerror_printf("Clone references MUST NOT refer to a parent attribute %s at %s[%d]",
+                                          old->name, fr_cwd_strip(fixup->common.filename), fixup->common.line);
+                       return -1;
+               }
+       } else {
+               da = dict_find_or_load_reference(&dict, fixup->ref, fixup->common.filename, fixup->common.line);
+               if (!da) return -1;
+       }
 
        /*
         *      We can only clone attributes of the same data type.