Fix some null pointer dereferences in LDAP auth code

petere · petere · commit 62906461c0d2 · 2017-11-10T14:30:48.000-05:00
An LDAP URL without a host name such as "ldap://" or without a base DN
such as "ldap://localhost" would cause a crash when reading pg_hba.conf.

If no binddn is configured, an error message might end up trying to print a
null pointer, which could crash on some platforms.

Author: Thomas Munro &lt;thomas.munro@enterprisedb.com&gt;
Reviewed-by: Michael Paquier &lt;michael.paquier@gmail.com&gt;
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
@@ -2226,7 +2226,8 @@ CheckLDAPAuth(Port *port)
 		{
 			ereport(LOG,
 					(errmsg("could not perform initial LDAP bind for ldapbinddn \"%s\" on server \"%s\": %s",
-							port->hba->ldapbinddn, port->hba->ldapserver, ldap_err2string(r))));
+							port->hba->ldapbinddn ? port->hba->ldapbinddn : "",
+							port->hba->ldapserver, ldap_err2string(r))));
 			return STATUS_ERROR;
 		}
 
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
@@ -1471,9 +1471,11 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
 			return false;
 		}
 
-		hbaline->ldapserver = pstrdup(urldata->lud_host);
+		if (urldata->lud_host)
+			hbaline->ldapserver = pstrdup(urldata->lud_host);
 		hbaline->ldapport = urldata->lud_port;
-		hbaline->ldapbasedn = pstrdup(urldata->lud_dn);
+		if (urldata->lud_dn)
+			hbaline->ldapbasedn = pstrdup(urldata->lud_dn);
 
 		if (urldata->lud_attrs)
 			hbaline->ldapsearchattribute = pstrdup(urldata->lud_attrs[0]);		/* only use first one */

Original file line number	Diff line number	Diff line change
`@@ -2226,7 +2226,8 @@ CheckLDAPAuth(Port *port)`
`2226`	`2226`	`{`
`2227`	`2227`	`ereport(LOG,`
`2228`	`2228`	`(errmsg("could not perform initial LDAP bind for ldapbinddn \"%s\" on server \"%s\": %s",`
`2229`		`- port->hba->ldapbinddn, port->hba->ldapserver, ldap_err2string(r))));`
	`2229`	`+ port->hba->ldapbinddn ? port->hba->ldapbinddn : "",`
	`2230`	`+ port->hba->ldapserver, ldap_err2string(r))));`
`2230`	`2231`	`return STATUS_ERROR;`
`2231`	`2232`	`}`
`2232`	`2233`