[jira] [Resolved] (DIRAPI-436) A not terminated ObjectClass element in a schema will loop and kill the JVM with a OOM

["Emmanuel Lécharny (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/DIRAPI-436?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Emmanuel Lécharny resolved DIRAPI-436.
--------------------------------------
    Resolution: Fixed

Fixed with commit 6b4f6a1ee7cda903dd2c9583032f9d485c54be6a

> A not terminated ObjectClass element in a schema will loop and kill the JVM with a OOM
> --------------------------------------------------------------------------------------
>
>                 Key: DIRAPI-436
>                 URL: https://issues.apache.org/jira/browse/DIRAPI-436
>             Project: Directory Client API
>          Issue Type: Bug
>    Affects Versions: 2.1.7
>            Reporter: Emmanuel Lécharny
>            Priority: Minor
>             Fix For: 2.1.8
>
>
> Reported by  nomilksec@gmail.com
> The hand-written *OpenLdapSchemaParser* (which backs every schema-description
> parser, e.g. *ObjectClassDescriptionSchemaParser*) parses an OID list with
> the loop :
> {code:java}
> while ( !startsWith( reader, pos, RPAREN ) ) 
> { 
>     oids.add(getOidStrict( pos ) ); ... 
> }
> {code}
> When the value ends inside the list (noclosing ')'), *getOidStrict()* hits end-of-input and returns "" without advancing the position, and the following *skipWhites(reader, pos, false)*
> neither advances nor throws; 
> the loop condition therefore stays true forever. The parser spins at 100% CPU and adds "" to the oids ArrayList on every iteration, so heap is exhausted as well.
>  Because a client that calls *loadSchema()* parses the server's cn=subschema values with these parsers, a malicious or MITM LDAP server can hang and then OOM the client with a
> roughly 12-byte attribute value. 
> This is a distinct string-parser defect from the BER-codec filter-depth and PDU-size limits added on the default branch — neither of those bounds this parser.
> An example of wrongly formatted schema element is :
> {code:java}
> "ObjectClass ( 1.2.3 MUST ("
> {code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org