diff options
| author | Lukas Slebodnik <lslebodn@redhat.com> | 2017-07-04 15:46:49 +0200 |
|---|---|---|
| committer | Andreas Schneider <asn@cryptomilk.org> | 2017-07-07 15:51:25 +0200 |
| commit | 963d9f12f902ae266a8c7edbf4249090de46173b (patch) | |
| tree | 03778f9c6e785dd012513cfaa1e35e9ff84116b7 /lib | |
| parent | b21ee14e2265a6dd11dd83c8e252a40de394585a (diff) | |
| download | samba-963d9f12f902ae266a8c7edbf4249090de46173b.tar.gz | |
ldb: Fix index out of bound in ldb_msg_find_common_values
cmocka unit test failed on i386
[==========] Running 2 test(s).
[ RUN ] test_ldb_msg_find_duplicate_val
[ OK ] test_ldb_msg_find_duplicate_val
[ RUN ] test_ldb_msg_find_common_values
[ FAILED ] test_ldb_msg_find_common_values
[==========] 2 test(s) run.
[ ERROR ] --- 0x14 != 0
[ LINE ] --- ../tests/ldb_msg.c:266: error: Failure!
[ PASSED ] 1 test(s).
[ FAILED ] 1 test(s), listed below:
[ FAILED ] test_ldb_msg_find_common_values
1 FAILED TEST(S)
But we were just lucky on other platforms because there is
index out of bound according to valgrind error.
==3298== Invalid read of size 4
==3298== at 0x486FCF6: ldb_val_cmp (ldb_msg.c:95)
==3298== by 0x486FCF6: ldb_msg_find_common_values (ldb_msg.c:266)
==3298== by 0x109A3D: test_ldb_msg_find_common_values (ldb_msg.c:265)
==3298== by 0x48E7490: ??? (in /usr/lib/libcmocka.so.0.4.1)
==3298== by 0x48E7EB0: _cmocka_run_group_tests (in /usr/lib/libcmocka.so.0.4.1)
==3298== by 0x1089B7: main (ldb_msg.c:352)
==3298== Address 0x4b07734 is 4 bytes after a block of size 48 alloc'd
==3298== at 0x483223E: malloc (vg_replace_malloc.c:299)
==3298== by 0x4907AA7: _talloc_array (in /usr/lib/libtalloc.so.2.1.9)
==3298== by 0x486FBF8: ldb_msg_find_common_values (ldb_msg.c:245)
==3298== by 0x109A3D: test_ldb_msg_find_common_values (ldb_msg.c:265)
==3298== by 0x48E7490: ??? (in /usr/lib/libcmocka.so.0.4.1)
==3298== by 0x48E7EB0: _cmocka_run_group_tests (in /usr/lib/libcmocka.so.0.4.1)
==3298== by 0x1089B7: main (ldb_msg.c:352)
Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/ldb/common/ldb_msg.c | 10 |
1 files changed, 1 insertions, 9 deletions
diff --git a/lib/ldb/common/ldb_msg.c b/lib/ldb/common/ldb_msg.c index abad5a83205..8e4047b41be 100644 --- a/lib/ldb/common/ldb_msg.c +++ b/lib/ldb/common/ldb_msg.c @@ -262,20 +262,12 @@ int ldb_msg_find_common_values(struct ldb_context *ldb, n_values = el->num_values; i = 0; j = 0; - while (i != n_values) { + while (i != n_values && j < el2->num_values) { int ret = ldb_val_cmp(&values[i], &values2[j]); if (ret < 0) { i++; } else if (ret > 0) { j++; - if (j == el2->num_values) { - /* - We have walked past the end of the second - list, meaning the remainder of the first - list cannot collide and we're done. - */ - break; - } } else { /* we have a collision */ if (! remove_duplicates) { |