Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Lib ldb minor fixes #4

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Lib ldb minor fixes #4

wants to merge 9 commits into from

Conversation

kamenim
Copy link
Owner

@kamenim kamenim commented Nov 11, 2014

No description provided.

@kamenim kamenim force-pushed the lib-ldb-minor-fixes branch 4 times, most recently from e7a1426 to 2d833e9 Compare November 14, 2014 03:15
@kamenim
lib-pyldb: Avoid SEGFAUL in case we can't convert passed valud to py-…
0fb25b0 
…String

Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-pyldb: Avoid leaking memory in error cases
951b913 
Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-pyldb: Throw exception when we can't create MessageElement object
da1471a 
At the moment we return an error, but no exception and it is
hard to instantly see what the problem is from Python

Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-ldb: Check for input parameter when searching attributes by name
94d9e44 
This prevents a segfault that is hard to be tracked down from
Python bindings for instance.

Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-ldb_ldif: Stop processing if ldb_message element name is NULL
316832a 
I have hit this while using Python bindings for testing and
forgot to pass 'name' argument to MessageElement constructor
Passing NULL as 'name' is obviously a mistake and this commits
aims to warn about such unintetional mistakes.

Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-pyldb: Avoid crash when copying MessageElements between Python Me…
e9b0939 
…ssage objects

This patch allows for following snipets in Python:
  res = ldb.search(...)
  m_from = res[0]
  m_to = Message()
  m_to.add(m_from["attrName"])

The problem previously is that we are trying to reference a
ldb_message_element that may not be a memory context on its own.
For instance, when search request from above example returns
Messages with more than one attribute, this leads immediately
to "Bad talloc magic value" crash, every message element beside
the first one is not a memory context

Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-ldb-test: Test copying message element from a message to a new me…
bb609e0 
…ssage

Change-Id: Iefcafb418a170ee410aec900bb36eb8e01e946b1
Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-pyldb: Fix docstring for msg.add() method - it was "S.append()"
550fa9f 
Change-Id: I9492d3c3993fc3d68d7bf24405db6e8cd746eaac
Signed-off-by: Kamen Mazdrashki <[email protected]>
@kamenim
lib-pyldb: Block elements should be surrounded by {} in py_msg.setitem()
c5858f3 
Change-Id: I0d09374b27708fcaad3523d985a2db7983dbd81a
Signed-off-by: Kamen Mazdrashki <[email protected]>
abartlet pushed a commit to abartlet/samba-old that referenced this pull request Jun 17, 2015
@metze-samba @jrasamba
tevent: fix access after free in tevent_common_check_signal()
9d797ff 
This was reported by Pavel Březina <[email protected]>:

    We found a crash in SSSD when a tevent signal is freed in its handler, tevent
    than crashes when it access siginfo.

    sig_info is freed in signal destructor:

    > #ifdef SA_SIGINFO
    >         if (se->sa_flags & SA_SIGINFO) {
    >             if (sig_state->sig_info[se->signum]) {
    >                 talloc_free(sig_state->sig_info[se->signum]);
    >                 sig_state->sig_info[se->signum] = NULL;
    >             }
    >         }
    > #endif

    (gdb) bt
    #0  0x00007f5d4d86cc74 in tevent_signal_destructor (se=0x7f5d5370f920) at
    ../tevent_signal.c:213
    kamenim#1  0x00007f5d4d65f233 in _talloc_free_internal () from /lib64/libtalloc.so.2
    kamenim#2  0x00007f5d4d6593a3 in _talloc_free () from /lib64/libtalloc.so.2
    kamenim#3  0x00007f5d4342f3d4 in proxy_child_init_done (subreq=0x7f5d5370f600) at
    src/providers/proxy/proxy_auth.c:436
    kamenim#4  0x00007f5d4d86b0c2 in _tevent_req_error (req=req@entry=0x7f5d5370f600,
    error=error@entry=5, location=location@entry=0x7f5d43433010
    "src/providers/proxy/proxy_auth.c:356")
        at ../tevent_req.c:167
    kamenim#5  0x00007f5d4342ef5e in pc_init_sig_handler (ev=<optimized out>,
    sige=<optimized out>, signum=<optimized out>, count=<optimized out>,
    __siginfo=<optimized out>, pvt=<optimized out>)
        at src/providers/proxy/proxy_auth.c:356
    kamenim#6  0x00007f5d4d86d48c in tevent_common_check_signal (ev=0x7f5d536de670) at
    ../tevent_signal.c:428
    #7  0x00007f5d4d86f28c in epoll_event_loop (tvalp=0x7fff7b568490,
    epoll_ev=0x7f5d536de8b0) at ../tevent_epoll.c:647
    #8  epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at
    ../tevent_epoll.c:926
    #9  0x00007f5d4d86d7d7 in std_event_loop_once (ev=0x7f5d536de670,
    location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent_standard.c:114
    #10 0x00007f5d4d869fbd in _tevent_loop_once (ev=ev@entry=0x7f5d536de670,
    location=location@entry=0x7f5d50faedc3 "src/util/server.c:668") at
    ../tevent.c:530
    #11 0x00007f5d4d86a15b in tevent_common_loop_wait (ev=0x7f5d536de670,
    location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent.c:634
    #12 0x00007f5d4d86d777 in std_event_loop_wait (ev=0x7f5d536de670,
    location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent_standard.c:140
    #13 0x00007f5d50f96863 in server_loop (main_ctx=0x7f5d536dfac0) at
    src/util/server.c:668
    #14 0x00007f5d5180aa42 in main (argc=8, argv=<optimized out>) at
    src/providers/data_provider_be.c:2909

    But then it is accessed again in tevent_common_check_signal:

    > #ifdef SA_SIGINFO
    >         if (clear_processed_siginfo) {
    >             uint32_t j;
    >             for (j=0;j<count;j++) {
    >                 uint32_t ofs = (counter.seen + j)
    >                     % TEVENT_SA_INFO_QUEUE_COUNT;
    >                 memset((void*)&sig_state->sig_info[i][ofs],
    >                     '\0',
    >                     sizeof(siginfo_t));
    >             }
    >         }
    > #endif

    (gdb) bt
    #0  0x00007fd7ba400505 in memset (__len=<optimized out>, __ch=<optimized out>,
    __dest=<optimized out>) at /usr/include/bits/string3.h:84
    kamenim#1  tevent_common_check_signal (ev=0x7fd7bfddf670) at ../tevent_signal.c:459
    kamenim#2  0x00007fd7ba40228c in epoll_event_loop (tvalp=0x7fff85536430,
    epoll_ev=0x7fd7bfddf8b0) at ../tevent_epoll.c:647
    kamenim#3  epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at
    ../tevent_epoll.c:926
    kamenim#4  0x00007fd7ba4007d7 in std_event_loop_once (ev=0x7fd7bfddf670,
    location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent_standard.c:114
    kamenim#5  0x00007fd7ba3fcfbd in _tevent_loop_once (ev=ev@entry=0x7fd7bfddf670,
    location=location@entry=0x7fd7bdb417c3 "src/util/server.c:668") at
    ../tevent.c:530
    kamenim#6  0x00007fd7ba3fd15b in tevent_common_loop_wait (ev=0x7fd7bfddf670,
    location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent.c:634
    #7  0x00007fd7ba400777 in std_event_loop_wait (ev=0x7fd7bfddf670,
    location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent_standard.c:140
    #8  0x00007fd7bdb29343 in server_loop (main_ctx=0x7fd7bfde0ac0) at
    src/util/server.c:668
    #9  0x00007fd7be39ca42 in main (argc=8, argv=<optimized out>) at
    src/providers/data_provider_be.c:2909

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11308

Signed-off-by: Stefan Metzmacher <[email protected]>
Reviewed-by: Jeremy Allison <[email protected]>

Autobuild-User(master): Jeremy Allison <[email protected]>
Autobuild-Date(master): Tue Jun  2 21:02:11 CEST 2015 on sn-devel-104
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@kamenim