389-ds-base

#48492 heap corruption at schema replication.

Closed: wontfix Opened Feb 4, 2016 by nhosoi.

Seems that there's a corrupted syntaxinfo structure at replicating the schema

Program terminated with signal 6, Aborted.

0 0x00007f0ce3e3e5f7 in __GI_raise (sig=sig@entry=6)

at ../nptl/sysdeps/unix/sysv/linux/raise.c:56

56 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);

(gdb) bt

0 0x00007f0ce3e3e5f7 in __GI_raise (sig=sig@entry=6)

at ../nptl/sysdeps/unix/sysv/linux/raise.c:56

1 0x00007f0ce3e3fce8 in __GI_abort () at abort.c:90

2 0x00007f0ce3e7e317 in __libc_message (do_abort=do_abort@entry=2,

fmt=fmt@entry=0x7f0ce3f879c8 "*** Error in `%s': %s: 0x%s ***\n")
at ../sysdeps/unix/sysv/linux/libc_fatal.c:196

3 0x00007f0ce3e85fe1 in malloc_printerr (

ar_ptr=0x7f0ce41c3760 <main_arena>, ptr=<optimized out>,
str=0x7f0ce3f850b4 "free(): invalid pointer", action=3) at malloc.c:5013

4 _int_free (av=0x7f0ce41c3760 , p=,

have_lock=0) at malloc.c:3835

5 0x00007f0ce65fe9c6 in slapi_ch_free (ptr=0x7f0c80075b90)

at ldap/servers/slapd/ch_malloc.c:292

6 0x00007f0ce65fea35 in slapi_ch_free_string (s=)

at ldap/servers/slapd/ch_malloc.c:325

7 0x00007f0ce65f9608 in attr_syntax_free (a=0x7f0c80075b90)

at ldap/servers/slapd/attrsyntax.c:195

8 0x00007f0ce666b6ba in schema_berval_to_atlist (

at_berval=at_berval@entry=0x7f0c80010580)
at ldap/servers/slapd/schema.c:7192

9 0x00007f0ce666cea3 in schema_attributetypes_superset_check (

remote_schema=remote_schema@entry=0x7f0c80010580,
type=type@entry=0x7f0cdb6f63e5 "supplier")
at ldap/servers/slapd/schema.c:7267

10 0x00007f0cdb6b28a7 in update_consumer_schema (

conn=conn@entry=0x7f0ce86f6a30)
at ldap/servers/plugins/replication/repl5_connection.c:1742

11 0x00007f0cdb6b39a8 in conn_push_schema (conn=0x7f0ce86f6a30,

remotecsn=remotecsn@entry=0x7f0c8f7fdc80)
at ldap/servers/plugins/replication/repl5_connection.c:1823

12 0x00007f0cdb6b5a77 in repl5_inc_run (prp=0x7f0ce86f9870)

at ldap/servers/plugins/replication/repl5_inc_protocol.c:973

13 0x00007f0cdb6bba3c in prot_thread_main (arg=0x7f0ce86a7230)

at ldap/servers/plugins/replication/repl5_protocol.c:267

14 0x00007f0ce48307bb in _pt_root (arg=0x7f0ce87037a0)

at ../../../nspr/pr/src/pthreads/ptthread.c:212

15 0x00007f0ce41d1dc5 in start_thread (arg=0x7f0c8f7fe700)

at pthread_create.c:308

16 0x00007f0ce3eff21d in clone ()

The problem seems to be when parsing the remote schema

       rc = parse_at_str(at_berval[i]->bv_val, &at, errorbuf, sizeof

(errorbuf),
DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_USE_PRIV_SCHEMA, 0,
schema_ds4x_compat, 0);
if(rc){
attr_syntax_free(at);
break;
}

The structure at_berval seems to be right in the core:

(gdb) print at_berval[859]->bv_val
$28 = 0x7f0c80073950 "( 2.16.840.1.113730.3.1.612 NAME 'generation' DESC
'Netscape defined attribute type' SYNTAX '1.3.6.1.4.1.1466.115.121.1.26'
X-ORIGIN 'Netscape Directory Server' )"
(gdb) print at_berval[859]
$29 = (struct berval ) 0x7f0c80073a00
(gdb) print at_berval[860]
$30 = (struct berval ) 0x0

so, it seems as if while parsing it to get the attribute syntaxes, something is
not going on fine.

Or the heap corruption could be former to that ?

nhosoi commented Feb 4, 2016

As seen in the report, SYNTAX OID value is in single quotes, which is not valid and no longer supported.
(gdb) print at_berval[859]->bv_val
$28 = 0x7f0c80073950 "( 2.16.840.1.113730.3.1.612 NAME 'generation' DESC 'Netscape defined attribute type' SYNTAX '1.3.6.1.4.1.1466.115.121.1.26' X-ORIGIN 'Netscape Directory Server' )"

But the server should not crash.

firstyear commented Feb 8, 2016

Instead of LDAPDebug1Arg which gets compiled out, can we use one of the slapi_log_error functions?

Otherwise a visual check looks good to me.

mreynolds commented Feb 8, 2016

Looks good to me too.

nhosoi commented Feb 8, 2016

Replying to [comment:3 firstyear]:

Instead of LDAPDebug1Arg which gets compiled out, can we use one of the slapi_log_error functions?

Otherwise a visual check looks good to me.
Thank you for reviewing the patch. I'm curious. Are there any particular reason why we'd better call slapi_log_error? It is a macro of "slapd_log_error_proc( NULL, fmt, arg );" We are using lots of LDAPDebug*. Are they to be replaced eventually?

nhosoi commented Feb 11, 2016

git patch file (master) -- replaced LDAPDebug macro with slapi_log_error
0001-Ticket-48492-heap-corruption-at-schema-replication.patch

nhosoi commented Feb 11, 2016

Reviewed by William and Mark (Thanks!!)

Pushed to master:
75b545a..b5bfa2a master -> master
commit b5bfa2a0386e168ce2196a077169382ae53a94b4

Pushed to 389-ds-base-1.3.4:
099883c..9bd53c2 389-ds-base-1.3.4 -> 389-ds-base-1.3.4
commit 9bd53c297683e691fef174bf1aed6842f475fb9f

nhosoi commented Feb 25, 2016

(In reply to German Parente from comment #49)

It's enough to use a particular custom schema and enable:

nsslapd-enquote-sup-oc: on

I will give more details later today.

Indeed, the schema code is adding the single quotes if the config param is on.
{{{
slap.h:#define CONFIG_ENQUOTE_SUP_OC_ATTRIBUTE "nsslapd-enquote-sup-oc"
outp += put_tagged_oid( outp, "SYNTAX ", syntaxoid, syntaxlengthbuf,
aew->enquote_sup_oc );
}}}
The case needs to be covered, as well.

firstyear commented Mar 29, 2016

I haven't run this code, but visually it looks okay.

nhosoi commented Apr 9, 2016

git patch file (master) -- additinal fixes for the crash and better nsslapd-enquote-sup-oc support
0001-Ticket-48492-heap-corruption-at-schema-replication.2.patch

firstyear commented Apr 12, 2016

Some minimal testing done, looks good to me.

nhosoi commented Apr 12, 2016

Reviewed by William (Thank you!!)

Pushed to master:
6186290..955dc66 master -> master
commit 955dc66d42511c2cc8d6ff18cf030508f6da2770

Pushed to 389-ds-base-1.3.4:
957dfe1..7927e44 389-ds-base-1.3.4 -> 389-ds-base-1.3.4
commit 7927e4420fb185ae328d56cfd4741583ae1f667b

Metadata Update from @nhosoi:
- Issue assigned to nhosoi
- Issue set to the milestone: 1.3.4.10

Feb 11, 2017

spichugi commented Sep 13, 2020

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/1774

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: Fixed)

Sep 13, 2020

Metadata

Assignee

nhosoi

Tags

None

Blocking

None

Depending on

None

Priority

Normal

reviewstatus

ack

origin

RHCust

rhbz

https://bugzilla.redhat.com/show_bug.cgi?id=1303641

389-ds-base

#48492 heap corruption at schema replication. Closed: wontfix Opened Feb 4, 2016 by nhosoi.

0 0x00007f0ce3e3e5f7 in __GI_raise (sig=sig@entry=6)

0 0x00007f0ce3e3e5f7 in __GI_raise (sig=sig@entry=6)

1 0x00007f0ce3e3fce8 in __GI_abort () at abort.c:90

2 0x00007f0ce3e7e317 in __libc_message (do_abort=do_abort@entry=2,

3 0x00007f0ce3e85fe1 in malloc_printerr (

4 _int_free (av=0x7f0ce41c3760 , p=,

5 0x00007f0ce65fe9c6 in slapi_ch_free (ptr=0x7f0c80075b90)

6 0x00007f0ce65fea35 in slapi_ch_free_string (s=)

7 0x00007f0ce65f9608 in attr_syntax_free (a=0x7f0c80075b90)

8 0x00007f0ce666b6ba in schema_berval_to_atlist (

9 0x00007f0ce666cea3 in schema_attributetypes_superset_check (

10 0x00007f0cdb6b28a7 in update_consumer_schema (

11 0x00007f0cdb6b39a8 in conn_push_schema (conn=0x7f0ce86f6a30,

12 0x00007f0cdb6b5a77 in repl5_inc_run (prp=0x7f0ce86f9870)

13 0x00007f0cdb6bba3c in prot_thread_main (arg=0x7f0ce86a7230)

14 0x00007f0ce48307bb in _pt_root (arg=0x7f0ce87037a0)

15 0x00007f0ce41d1dc5 in start_thread (arg=0x7f0c8f7fe700)

16 0x00007f0ce3eff21d in clone ()

Metadata

#48492 heap corruption at schema replication.

Closed: wontfix Opened Feb 4, 2016 by nhosoi.