389-ds-base

#48981 RetroCL: When changelog size is large, strcmpi_fast can segfault
Closed: wontfix Opened by firstyear.

Closed: wontfix
Reopen Issue

When the changelog size is very large (thousands of entries), the changelog trim attempts to search it. It then calls slapi_entry_attr_find, which in turn eventually calls strcmpi_fast. However, the attribute in the entry isn't populated which causes NULL to be passed on the attribute, resulting in a segfault.

Trace is:

Thread 1 (Thread 0x2b7d07820940 (LWP 22411)):
    #0  strcmpi_fast (a=0x2b7d08038000, type=0x2b7c6ed5bf0f "changetime") at ldap/servers/slapd/intrinsics.h:94
    #1  attrlist_find (a=0x2b7d08038000, type=0x2b7c6ed5bf0f "changetime") at ldap/servers/slapd/attrlist.c:127
    #2  0x00002b7c6342c30b in slapi_entry_attr_find (e=<value optimized out>, type=0x2b7c6ed5bf0f "changetime", a=0x2b7d07820018) at ldap/servers/slapd/entry.c:2269
    #3  0x00002b7c6ed5b3ee in trim_changelog (arg=<value optimized out>) at ldap/servers/plugins/retrocl/retrocl_trim.c:287
    #4  changelog_trim_thread_fn (arg=<value optimized out>) at ldap/servers/plugins/retrocl/retrocl_trim.c:348
    #5  0x00002b7c651b8a51 in _pt_root (arg=<value optimized out>) at ../../../nspr/pr/src/pthreads/ptthread.c:212
    #6  0x00002b7c657ef83d in start_thread () from /lib64/libpthread.so.0
    #7  0x00002b7c65adafdd in clone () from /lib64/libc.so.6

The cause is that trim_changelog() calls:

·       if ( me > 0L ) {                                                                                        
·           e = get_changerecord( first_in_log, &ldrc );                         
·   ·   if ( NULL != e ) {                                                                                      
·   ·       Slapi_Value *sval = NULL;                                                                           
·   ·       const struct berval *val = NULL;                                                                    
·   ·       rc = slapi_entry_attr_find( e, attr_changetime, &attr );

Key, is the call to get_changerecord(). This calls:

    slapi_search_internal_callback_pb (pb, crtp,·                                
·   ·   ·   ·          handle_getchangerecord_result,·                           
·   ·   ·   ·          handle_getchangerecord_search, NULL );                    
    if ( err != NULL ) {                                                         
·   *err = crtp->crt_err;                                                        
    }
    slapi_pblock_destroy (pb);
    return( crtp->crt_entry );

handle_getchangerecord_search() when called, will put the entry into crtp->crt_entry. However, if this races, e will not have attributes available ,causing the segfault in attrlist_find().

In 1.3.x this section is completely re-written and may not be affected.

Duplicate of #47871

Replying to [comment:2 firstyear]:

Duplicate of #47871

No need to backport to 1.2.11?

Metadata Update from @nhosoi:
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

Metadata Update from @vashirov:
- Issue set to the milestone: None (was: 0.0 NEEDS_TRIAGE)

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/2040

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: Duplicate)
Metadata
None
None
None
None
Normal
None
Community
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.