[PATCH] Issue 5218 - double-free of the virtual attribute context in persistent searc...
authortbordaz <tbordaz@redhat.com>
Mon, 21 Mar 2022 13:24:12 +0000 (14:24 +0100)
committerAnton Gladky <gladk@debian.org>
Mon, 24 Apr 2023 04:08:15 +0000 (05:08 +0100)
commit8cc621fb5c42e417f2cb446b052126d20d30421b
treed6640a20f1d4b67af0728baefddbcd38d8d9670f
parent53a2e312b967bf98ad13577946bb907e433ef5b5
[PATCH] Issue 5218 - double-free of the virtual attribute context in persistent search (#5219)

description:
A search is processed by a worker using a private pblock.
If the search is persistent, the worker spawn a thread
and kind of duplicate its private pblock so that the spawn
        thread continue to process the persistent search.
Then worker ends the initial search, reinit (free) its private pblock,
        and returns monitoring the wait_queue.
When the persistent search completes, it frees the duplicated
pblock.
The problem is that private pblock and duplicated pblock
        are referring to a same structure (pb_vattr_context).
        That can lead to a double free

Fix:
When cloning the pblock (slapi_pblock_clone) make sure
to transfert the references inside the original (private)
pblock to the target (cloned) one
        That includes pb_vattr_context pointer.

Reviewed by: Mark Reynolds, James Chapman, Pierre Rogier (Thanks !)

Co-authored-by: Mark Reynolds <mreynolds@redhat.com>
Gbp-Pq: Name CVE-2021-4091.patch
ldap/servers/slapd/connection.c
ldap/servers/slapd/pblock.c