From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 17 Jun 2021 14:52:41 +0000 (-0400)
Subject: check if the clone ref exists before loading it
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=32c755606817e34ed148a54b1990cb77acbcd439;p=thirdparty%2Ffreeradius-server.git

check if the clone ref exists before loading it

and also check that a clone ref cannot refer to a parent. otherwise
we have recursive clones, and that's bad.
---

diff --git a/src/lib/util/dict_fixup.c b/src/lib/util/dict_fixup.c
index a0cc2c7997d..67304cd2781 100644
--- a/src/lib/util/dict_fixup.c
+++ b/src/lib/util/dict_fixup.c
@@ -412,8 +412,23 @@ static inline CC_HINT(always_inline) int dict_fixup_clone_apply(UNUSED dict_fixu
 	fr_dict_attr_t		*cloned;
 	fr_dict_t		*dict = fr_dict_unconst(fr_dict_by_da(fixup->da));
 
-	da = dict_find_or_load_reference(&dict, fixup->ref, fixup->common.filename, fixup->common.line);
-	if (!da) return -1;
+	/*
+	 *	We can't clone our parents.
+	 */
+	da = fr_dict_attr_by_oid(NULL, fr_dict_root(dict), fixup->ref);
+	if (da) {
+		fr_dict_attr_t const *old;
+
+		old = fr_dict_attr_common_parent(da, fixup->da, false);
+		if (old) {
+			fr_strerror_printf("Clone references MUST NOT refer to a parent attribute %s at %s[%d]",
+					   old->name, fr_cwd_strip(fixup->common.filename), fixup->common.line);
+			return -1;
+		}
+	} else {
+		da = dict_find_or_load_reference(&dict, fixup->ref, fixup->common.filename, fixup->common.line);
+		if (!da) return -1;
+	}
 
 	/*
 	 *	We can only clone attributes of the same data type.