Fix some null pointer dereferences in LDAP auth code

petere · petere · commit f9e2885d51bf · 2017-11-10T14:27:51.000-05:00
An LDAP URL without a host name such as "ldap://" or without a base DN
such as "ldap://localhost" would cause a crash when reading pg_hba.conf.

If no binddn is configured, an error message might end up trying to print a
null pointer, which could crash on some platforms.

Author: Thomas Munro &lt;thomas.munro@enterprisedb.com&gt;
Reviewed-by: Michael Paquier &lt;michael.paquier@gmail.com&gt;
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
@@ -2474,7 +2474,8 @@ CheckLDAPAuth(Port *port)
 		{
 			ereport(LOG,
 					(errmsg("could not perform initial LDAP bind for ldapbinddn \"%s\" on server \"%s\": %s",
-							port->hba->ldapbinddn, port->hba->ldapserver, ldap_err2string(r))));
+							port->hba->ldapbinddn ? port->hba->ldapbinddn : "",
+							port->hba->ldapserver, ldap_err2string(r))));
 			pfree(passwd);
 			return STATUS_ERROR;
 		}
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
@@ -1721,9 +1721,11 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline,
 			return false;
 		}
 
-		hbaline->ldapserver = pstrdup(urldata->lud_host);
+		if (urldata->lud_host)
+			hbaline->ldapserver = pstrdup(urldata->lud_host);
 		hbaline->ldapport = urldata->lud_port;
-		hbaline->ldapbasedn = pstrdup(urldata->lud_dn);
+		if (urldata->lud_dn)
+			hbaline->ldapbasedn = pstrdup(urldata->lud_dn);
 
 		if (urldata->lud_attrs)
 			hbaline->ldapsearchattribute = pstrdup(urldata->lud_attrs[0]);	/* only use first one */

Original file line number	Diff line number	Diff line change
`@@ -2474,7 +2474,8 @@ CheckLDAPAuth(Port *port)`
`2474`	`2474`	`{`
`2475`	`2475`	`ereport(LOG,`
`2476`	`2476`	`(errmsg("could not perform initial LDAP bind for ldapbinddn \"%s\" on server \"%s\": %s",`
`2477`		`- port->hba->ldapbinddn, port->hba->ldapserver, ldap_err2string(r))));`
	`2477`	`+ port->hba->ldapbinddn ? port->hba->ldapbinddn : "",`
	`2478`	`+ port->hba->ldapserver, ldap_err2string(r))));`
`2478`	`2479`	`pfree(passwd);`
`2479`	`2480`	`return STATUS_ERROR;`
`2480`	`2481`	`}`