Internal range searches using OP_FLAG_REVERSE_CANDIDATE_ORDER can crash the server

[389-ds-bot]

Cloned from Pagure issue: https://pagure.io/389-ds-base/issue/47858

• Created at 2014-07-14 20:45:18 by mreynolds (@mreynolds389)
• Closed at 2017-04-20 16:32:55 as fixed
• Assigned to mreynolds (@mreynolds389)
• Associated bugzillas
  • https://bugzilla.redhat.com/show_bug.cgi?id=1109339
  • https://bugzilla.redhat.com/show_bug.cgi?id=1373734

---

Internal range searches using OP_FLAG_REVERSE_CANDIDATE_ORDER, that do not find any entries, can crash the server in ldbm_search().

This crash can not be reproduced externally. It was discovered while working on ticket 47819 which added an internal range search using the reverse candidates flag.

[389-ds-bot]

Comment from mreynolds (@mreynolds389) at 2014-07-14 21:00:31

attachment
0001-Ticket-47858-Internal-searches-using-OP_FLAG_REVERSE.patch

[389-ds-bot]

Comment from mreynolds (@mreynolds389) at 2014-07-14 21:57:13

git merge ticket47858
Updating 6d38125..e6cee31
Fast-forward
ldap/servers/slapd/back-ldbm/ldbm_search.c | 2 +-

git push origin master
6d38125..e6cee31 master -> master

commit e6cee31
Author: Mark Reynolds mreynolds389@redhat.com
Date: Mon Jul 14 10:47:52 2014 -0400

[389-ds-bot]

Comment from nhosoi (@nhosoi) at 2014-07-14 22:25:49

Hi Mark,

Is this bug introduced with 47767, where OP_FLAG_REVERSE_CANDIDATE_ORDER flag is newly defined?

[389-ds-bot]

Comment from mreynolds (@mreynolds389) at 2014-07-14 22:51:36

Replying to [comment:4 nhosoi]:

Hi Mark,

Is this bug introduced with 47767, where OP_FLAG_REVERSE_CANDIDATE_ORDER flag is newly defined?

Yes it was. I only found the crash when I created an internal range search for ticket 47819. So there is no "real" regression at this point in time. As this was committed before ticket 47819 was - so no one is doing internal range searches (with reverse candidate ordering). The only way to verify this fix is to run the ticket47819_test.py script.

[389-ds-bot]

Comment from mreynolds (@mreynolds389) at 2014-07-15 02:25:49

88aa59f..da318fa 389-ds-base-1.3.2 -> 389-ds-base-1.3.2
commit da318fa

45dcda2..722117e 389-ds-base-1.3.1 -> 389-ds-base-1.3.1
commit 722117e12de543a3a66695e795e32f55435779ec

1dbf87a..7dc69db 389-ds-base-1.2.11 -> 389-ds-base-1.2.11
commit 7dc69db

[389-ds-bot]

Comment from spichugi (@droideck) at 2016-12-14 17:46:58

attachment
0001-Ticket-47858-Add-test-case-for-nsTombstone.patch

[389-ds-bot]

Comment from firstyear (@Firstyear) at 2016-12-15 05:17:50

The code looks good and has my ack. I want to confirm that "without" the patch this causes the crash 100% of the time, and that with the patch this test passes? If that is the case, ack and commit!

[389-ds-bot]

Comment from spichugi (@droideck) at 2016-12-16 11:41:53

By Mark information, it is enough to check a tombstone purge operation, because during this the internal search with OP_FLAG_REVERSE_CANDIDATE_ORDER flag happens.

P.S. I've checked 6.9 with an old build (72), but no crash has happened. Maybe it is not 100% reproducible...

[389-ds-bot]

Comment from spichugi (@droideck) at 2016-12-16 14:27:09

I've pushed it for now, because it is basic tombstone test suite functionality. We always can add more test cases.

To ssh://git.fedorahosted.org/git/389/ds.git
8cda4b1..c3a940c master -> master
commit c3a940c
Author: Simon Pichugin droideck@redhat.com
Date: Wed Dec 14 11:17:05 2016 +0100

[389-ds-bot]

Comment from nhosoi (@nhosoi) at 2017-02-11 23:07:08

Metadata Update from @nhosoi:

• Issue assigned to mreynolds389
• Issue set to the milestone: 1.2.11.30

[389-ds-bot]

Comment from mreynolds (@mreynolds389) at 2017-03-06 17:55:58

Simon can this be closed?

[389-ds-bot]

Comment from mreynolds (@mreynolds389) at 2017-03-06 17:56:12

Metadata Update from @mreynolds389:

• Custom field reviewstatus reset
• Issue close_status updated to: None

[389-ds-bot]

Comment from mreynolds (@mreynolds389) at 2017-04-20 16:33:07

Metadata Update from @mreynolds389:

• Issue close_status updated to: fixed
• Issue status updated to: Closed (was: Open)