CVE-2022-2850 - Sync_repl may crash while managing invalid cookie (#5420) - Issue...
authortbordaz <tbordaz@redhat.com>
Thu, 18 Aug 2022 09:17:30 +0000 (11:17 +0200)
committerAndrej Shadura <andrewsh@debian.org>
Sun, 19 Jan 2025 12:30:31 +0000 (13:30 +0100)
commit9ad2a57d213410f3a2ab89bd3f9b1dcdb767f235
tree71f607b27725874469a0de093d0dc767e7422866
parent4aa179339f804d46cdc899679f6ebb72318b8748
CVE-2022-2850 - Sync_repl may crash while managing invalid cookie (#5420) - Issue 5418

Bug description:
If the servers receives an invalid cookie without separator '#',
it parses it into an empty cookie (Sync_Cookie) instead of a NULL
cookie (failure).
Later it sigsegv when using the empty cookie.

Fix description:
If the parsing fails return NULL

relates: #5418

Reviewed by: Viktor Ashirov, Mark Reynolds, William Brown, Simon
 Pichugin (thanks !)

Origin: backport, commit:513a763b551848e5532ec22bb0086464aa09252f

Gbp-Pq: Name CVE-2022-2850-Sync_repl-may-crash-with-invalid-cookie.patch
dirsrvtests/tests/suites/syncrepl_plugin/basic_test.py
ldap/servers/plugins/sync/sync_util.c