From 104ee6985fcf0b9a2164e6ba584f4073b1675df6 Mon Sep 17 00:00:00 2001
From: Thierry Bordaz <tbordaz@redhat.com>
Date: Mon, 15 Jan 2018 14:40:04 +0100
Subject: [PATCH] Ticket 49534 - Some coverity fix may prevent internal
 operation where a connection is not set in the pblock

Bug Description:
	op_shared_allow_pw_change can be call with internal operation without pb_conn set
	It should not failed if pb_conn is not set

Fix Description:
	Test pb_conn before dereferencing it

https://pagure.io/389-ds-base/issue/49534

Reviewed by: ?

Platforms tested: F26

Flag Day: no

Doc impact: no
---
 ldap/servers/slapd/modify.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 10d263159..216c0961d 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -1156,6 +1156,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
     char *proxydn = NULL;
     char *proxystr = NULL;
     char *errtext = NULL;
+    int needpw = 0;
 
     slapi_pblock_get(pb, SLAPI_IS_REPLICATED_OPERATION, &repl_op);
     if (repl_op) {
@@ -1171,10 +1172,13 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
     slapi_pblock_get(pb, SLAPI_PWPOLICY, &pwresponse_req);
     internal_op = operation_is_flag_set(operation, OP_FLAG_INTERNAL);
     slapi_pblock_get(pb, SLAPI_CONNECTION, &pb_conn);
+    if (pb_conn) {
+        needpw = pb_conn->c_needpw;
+    }
 
-    if (pb_conn == NULL || operation == NULL) {
+    if (operation == NULL) {
         slapi_log_err(SLAPI_LOG_ERR, "op_shared_allow_pw_change",
-                      "NULL param error: conn (0x%p) op (0x%p)\n", pb_conn, operation);
+                      "NULL param error: op (0x%p)\n", operation);
         rc = -1;
         goto done;
     }
@@ -1186,7 +1190,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
     if ((proxy_err = proxyauth_get_dn(pb, &proxydn, &errtext)) != LDAP_SUCCESS) {
         if (operation_is_flag_set(operation, OP_FLAG_ACTION_LOG_ACCESS)) {
             slapi_log_access(LDAP_DEBUG_STATS, "conn=%" PRIu64 " op=%d MOD dn=\"%s\"\n",
-                             pb_conn->c_connid, operation->o_opid,
+                             pb_conn ? pb_conn->c_connid : -1, operation->o_opid,
                              slapi_sdn_get_dn(&sdn));
         }
 
@@ -1225,7 +1229,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
                     proxystr = slapi_ch_smprintf(" authzid=\"%s\"", proxydn);
                 }
                 slapi_log_access(LDAP_DEBUG_STATS, "conn=%" PRIu64 " op=%d MOD dn=\"%s\"%s\n",
-                                 pb_conn->c_connid, operation->o_opid,
+                                 pb_conn ? pb_conn->c_connid : -1, operation->o_opid,
                                  slapi_sdn_get_dn(&sdn), proxystr ? proxystr : "");
             }
 
@@ -1254,7 +1258,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
 
         /* Check if password policy allows users to change their passwords.*/
         if (!operation->o_isroot && slapi_sdn_compare(&sdn, &operation->o_sdn) == 0 &&
-            !pb_conn->c_needpw && !pwpolicy->pw_change) {
+            !needpw && !pwpolicy->pw_change) {
             if (pwresponse_req == 1) {
                 slapi_pwpolicy_make_response_control(pb, -1, -1, LDAP_PWPOLICY_PWDMODNOTALLOWED);
             }
@@ -1267,7 +1271,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
                 }
 
                 slapi_log_access(LDAP_DEBUG_STATS, "conn=%" PRIu64 " op=%d MOD dn=\"%s\"%s, %s\n",
-                                 pb_conn->c_connid, operation->o_opid,
+                                 pb_conn ? pb_conn->c_connid : -1, operation->o_opid,
                                  slapi_sdn_get_dn(&sdn),
                                  proxystr ? proxystr : "",
                                  "user is not allowed to change password");
@@ -1280,7 +1284,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
 
     /* check if password is within password minimum age;
        error result is sent directly from check_pw_minage */
-    if (pb_conn && !pb_conn->c_needpw &&
+    if (needpw &&
         check_pw_minage(pb, &sdn, mod->mod_bvalues) == 1) {
         if (operation_is_flag_set(operation, OP_FLAG_ACTION_LOG_ACCESS)) {
             if (proxydn) {
@@ -1289,7 +1293,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
 
             if (!internal_op) {
                 slapi_log_access(LDAP_DEBUG_STATS, "conn=%" PRIu64 " op=%d MOD dn=\"%s\"%s, %s\n",
-                                 pb_conn->c_connid,
+                                 pb_conn ? pb_conn->c_connid : -1,
                                  operation->o_opid,
                                  slapi_sdn_get_dn(&sdn),
                                  proxystr ? proxystr : "",
@@ -1326,7 +1330,7 @@ op_shared_allow_pw_change(Slapi_PBlock *pb, LDAPMod *mod, char **old_pw, Slapi_M
 
             if (!internal_op) {
                 slapi_log_access(LDAP_DEBUG_STATS, "conn=%" PRIu64 " op=%d MOD dn=\"%s\"%s, %s\n",
-                                 pb_conn->c_connid,
+                                 pb_conn ? pb_conn->c_connid : -1,
                                  operation->o_opid,
                                  slapi_sdn_get_dn(&sdn),
                                  proxystr ? proxystr : "",
-- 
2.13.6