ldb: Fix bug triggered by having an empty message in database during search.

Previously if the message had 0 elements, Talloc would reallocate the projected
array to NULL, fooling LDB into thinking that it failed to reallocate. This fix
corrects LDB to be able to handle the case where the message has no attributes
in common with the filter.

Also the realloc call resized the array to the number of elements in the message,
not the number of elements in common with the filter -- it essentially did nothing.

Unlike talloc_realloc, talloc_array always returns a non-null pointer. This would
help protect against possible errors.

Signed-off-by: Adrian Cochrane <adrianc@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

2 files changed, 34 insertions, 5 deletions

diff --git a/lib/ldb/ldb_tdb/ldb_search.c b/lib/ldb/ldb_tdb/ldb_search.c
index 1e7e7ea82f0..c939bcba6b4 100644
--- a/lib/ldb/ldb_tdb/ldb_search.c
+++ b/lib/ldb/ldb_tdb/ldb_search.c
@@ -407,10 +407,18 @@ int ltdb_filter_attrs(struct ldb_message *msg, const char * const *attrs)
 	}
 
 	talloc_free(msg->elements);
-	msg->elements = talloc_realloc(msg, el2, struct ldb_message_element, msg->num_elements);
+
+	if (num_elements > 0) {
+		msg->elements = talloc_realloc(msg, el2, struct ldb_message_element,
+					       num_elements);
+	} else {
+		msg->elements = talloc_array(msg, struct ldb_message_element, 0);
+		talloc_free(el2);
+	}
 	if (msg->elements == NULL) {
 		return -1;
 	}
+
 	msg->num_elements = num_elements;
 
 	return 0;
diff --git a/lib/ldb/tests/python/api.py b/lib/ldb/tests/python/api.py
index cb65199e884..af1ff03ce61 100755
--- a/lib/ldb/tests/python/api.py
+++ b/lib/ldb/tests/python/api.py
@@ -256,6 +256,23 @@ class SimpleLdb(TestCase):
         finally:
             l.delete(ldb.Dn(l, "dc=bar"))
 
+    def test_empty_dn(self):
+        l = ldb.Ldb(filename())
+        self.assertEqual(0, len(l.search()))
+        m = ldb.Message()
+        m.dn = ldb.Dn(l, "dc=empty")
+        l.add(m)
+        rm = l.search()
+        self.assertEqual(1, len(rm))
+        self.assertEqual(set(["dn", "distinguishedName"]), set(rm[0].keys()))
+
+        rm = l.search(m.dn)
+        self.assertEqual(1, len(rm))
+        self.assertEqual(set(["dn", "distinguishedName"]), set(rm[0].keys()))
+        rm = l.search(m.dn, attrs=["blah"])
+        self.assertEqual(1, len(rm))
+        self.assertEqual(0, len(rm[0]))
+
     def test_modify_delete(self):
         l = ldb.Ldb(filename())
         m = ldb.Message()
@@ -270,10 +287,12 @@ class SimpleLdb(TestCase):
             m["bla"] = ldb.MessageElement([], ldb.FLAG_MOD_DELETE, "bla")
             self.assertEqual(ldb.FLAG_MOD_DELETE, m["bla"].flags())
             l.modify(m)
-            rm = l.search(m.dn)[0]
+            rm = l.search(m.dn)
             self.assertEqual(1, len(rm))
+            self.assertEqual(set(["dn", "distinguishedName"]), set(rm[0].keys()))
             rm = l.search(m.dn, attrs=["bla"])
-            self.assertEqual(0, len(rm))
+            self.assertEqual(1, len(rm))
+            self.assertEqual(0, len(rm[0]))
         finally:
             l.delete(ldb.Dn(l, "dc=modifydelete"))
 
@@ -291,10 +310,12 @@ class SimpleLdb(TestCase):
             m["bla"] = ldb.MessageElement([], ldb.FLAG_MOD_DELETE, "bla")
             self.assertEqual(ldb.FLAG_MOD_DELETE, m["bla"].flags())
             l.modify(m)
-            rm = l.search(m.dn)[0]
+            rm = l.search(m.dn)
             self.assertEqual(1, len(rm))
+            self.assertEqual(set(["dn", "distinguishedName"]), set(rm[0].keys()))
             rm = l.search(m.dn, attrs=["bla"])
-            self.assertEqual(0, len(rm))
+            self.assertEqual(1, len(rm))
+            self.assertEqual(0, len(rm[0]))
         finally:
             l.delete(ldb.Dn(l, "dc=modifydelete"))