ldap_connect_to_host (ITS#2261)

[tboehrer@calltower.com]

Full_Name: Tracy Boehrer
Version: 2.1.10
OS: Windows XP
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (65.17.81.167)


This is a bit hard to explain, but here I go....

Windows XP, Visual Studio .NET (VC7), OpenLDAP 2.1.10.

When running slurpd compiled as release, an access violation happens.  Compiled
in debug, there doesn't seem to be a problem.

I traced the problem down to the 'ldap_connect_to_host' function (in os-ip.c). 
Near the top of the function there is a stack variable 'hp' declared, which is
"filled out" by a call to 'ldap_pvt_gethostbyname_a'.

After the call to 'ldap_pvt_gethostbyname_a', the 'hp' var is OK.  However,
further on it gets overwritten.

In 'ldap_connect_to_host', in the loop (below), it seems that 'hp' and 'sin'
have the same address.  So when the memset happens, 'hp' is overwritten.  Moving
'sin' from within the loop to the top of the function seems to correct it.

Go figure...

Code snippet of the loop:

	for ( i = 0; !use_hp || (hp->h_addr_list[i] != 0); ++i, rc = -1 ) {
		struct sockaddr_in	sin;

		s = ldap_int_socket( ld, PF_INET, socktype );
		if ( s == AC_SOCKET_INVALID ) {
			/* use_hp ? continue : break; */
			break;
		}
	   
		if ( ldap_int_prepare_socket( ld, s, proto ) == -1 ) {
			ldap_pvt_close_socket(ld, s);
			break;
		}

                // everything OK so far
		printf( "1) use_hp=%d, hp=%08X, add_list=%08X, name=%s\n", use_hp, hp,
hp->h_addr_list, hp->h_name );

                // &sin has the same value as hp
		printf( "sin=%08X\n", &sin );

		(void)memset((char *)&sin, '\0', sizeof sin);

                // hp is toast (all zero's)...
		printf( "2) use_hp=%d, hp=%08X, add_list=%08X, name=%s\n", use_hp, hp,
hp->h_addr_list, hp->h_name );