#46 Potential NULL-dereference in modify_ldap_common
Closed: Fixed None Opened 12 years ago by sgallagh.

Discovered by Coverity Integrity Manager scan.

1973static isc_result_t
1974modify_ldap_common(dns_name_t *owner, ldap_instance_t *ldap_inst,
1975                   dns_rdatalist_t *rdlist, int mod_op, isc_boolean_t delete_node)
1976{
1977        isc_result_t result;
1978        isc_mem_t *mctx = ldap_inst->mctx;
CID 12383: Explicit null dereferenced (FORWARD_NULL)Assigning: "ldap_conn" = 0.
1979        ldap_connection_t *ldap_conn = NULL;
1980        ld_string_t *owner_dn = NULL;
At conditional (1): "change@dim0 < 3UL" taking the true branch.
At conditional (2): "change@dim0 < 3UL" taking the true branch.
At conditional (3): "change@dim0 < 3UL" taking the false branch.
1981        LDAPMod *change[3] = { NULL };
1982        LDAPMod *change_ptr = NULL;
1983        ldap_cache_t *cache;
1984
1985        /* Flush modified record from the cache */
1986        cache = ldap_instance_getcache(ldap_inst);
At conditional (4): "result != 0U" taking the true branch.
1987        CHECK(discard_from_cache(cache, owner));
1988
<...>
2209        
2210cleanup:
Passing null variable "ldap_conn" to function "ldap_pool_putconnection", which dereferences it. [show details]
2211        ldap_pool_putconnection(ldap_inst->pool, ldap_conn);
2212        str_destroy(&owner_dn);
2213        free_ldapmod(mctx, &change[0]);
2214        free_ldapmod(mctx, &change[1]);
2215        if (change_ptr != NULL) free_ldapmod(mctx, &change_ptr);
2216
2217        return result;
2218}

If {{{CHECK(discard_from_cache(cache, owner))}}} results in a GOTO to cleanup, you'll dereference ldap_conn which is currently NULL.


Metadata Update from @atkac:
- Issue assigned to atkac
- Issue set to the milestone: 3.0 IPA

7 years ago

Login to comment on this ticket.

Metadata