Issue 7545 - Heap buffer overflow in entry.c

[IliaKash1]

Bug description:

Heap buffer overflow in str2entry_state_information_from_type() can be triggered with a specific input, since ';' is supposed to precede enough symbols.

Fix description:

Additional strlen() check before accessing specific symbols is added.

Fixes: #7545

Author: Ilia Kashintsev

Summary by Sourcery

Bug Fixes:

• Add a string length guard in str2entry_state_information_from_type() to avoid out-of-bounds access on malformed input.

[sourcery-ai]

Hey - I've left some high level feedback:

• The new strlen(p) >= 7 check prevents the overflow, but repeatedly calling strlen inside the loop may be unnecessary overhead; consider computing the length once per iteration (or deriving it from the parsing logic) and reusing it before the character index checks.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The new `strlen(p) >= 7` check prevents the overflow, but repeatedly calling `strlen` inside the loop may be unnecessary overhead; consider computing the length once per iteration (or deriving it from the parsing logic) and reusing it before the character index checks.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[packit-as-a-service]

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

• sudo dnf install -y 'dnf*-command(copr)'
• dnf copr enable packit/389ds-389-ds-base-7546
• And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

[progier389]

Probably better test that p[0] != 0 && p[1] != 0 && p[2] != 0 && ... rather than use strlen(p) >= 7
But I even wonder if we want to "fix" that:
entry state is internal data. As far as know the only way to provide a bad entry state is to have an administrator importing an ldif file that have been badly tampered - Having a crash in that case is not really an issue
but impacting the performance of this function could be one