/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions Copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.server.controls;
|
|
import static org.opends.server.protocols.internal.InternalClientConnection.*;
|
import static org.opends.server.protocols.internal.Requests.*;
|
import static org.testng.Assert.*;
|
|
import org.forgerock.opendj.ldap.ResultCode;
|
import org.forgerock.opendj.ldap.SearchScope;
|
import org.opends.server.TestCaseUtils;
|
import org.opends.server.protocols.internal.InternalSearchOperation;
|
import org.opends.server.protocols.internal.SearchRequest;
|
import org.testng.annotations.BeforeClass;
|
import org.testng.annotations.Test;
|
|
/**
|
* Regression test for GHSA-q4wx-wj4j-4657 / OPENDJ-003 — unbounded array
|
* allocation via VLV beforeCount/afterCount/offset (CWE-789 / CWE-770 / CWE-190).
|
* <p>
|
* A VLV-by-offset request carries attacker-controlled before/after counts. The
|
* server computed {@code count = 1 + beforeCount + afterCount} and allocated
|
* {@code new long[count]} without clamping it to the actual list size. With
|
* {@code afterCount = Integer.MAX_VALUE} the sum overflowed to a negative int,
|
* yielding a {@code NegativeArraySizeException} (or, with large non-overflowing
|
* values, a multi-gigabyte allocation / {@code OutOfMemoryError}) from a single
|
* search request. The fix computes the count with long arithmetic and clamps it
|
* to the number of entries actually available, so the oversized window is now
|
* bounded instead of faulting the search handler.
|
* <p>
|
* Note: this exercises the default in-memory sort path
|
* ({@code EntryContainer.sortByOffset}), which requires no VLV index — the same
|
* unclamped allocation also existed in {@code VLVIndex.readRange}.
|
*/
|
@SuppressWarnings("javadoc")
|
public class VLVOffsetAllocationDoSTest extends ControlsTestCase
|
{
|
@BeforeClass
|
public void startServer() throws Exception
|
{
|
TestCaseUtils.startServer();
|
}
|
|
private void populateDB() throws Exception
|
{
|
TestCaseUtils.clearBackend("userRoot", "dc=example,dc=com");
|
TestCaseUtils.addEntries(
|
"dn: uid=albert.zimmerman,dc=example,dc=com",
|
"objectClass: top",
|
"objectClass: person",
|
"objectClass: organizationalPerson",
|
"objectClass: inetOrgPerson",
|
"uid: albert.zimmerman",
|
"givenName: Albert",
|
"sn: Zimmerman",
|
"cn: Albert Zimmerman",
|
"",
|
"dn: uid=aaron.zimmerman,dc=example,dc=com",
|
"objectClass: top",
|
"objectClass: person",
|
"objectClass: organizationalPerson",
|
"objectClass: inetOrgPerson",
|
"uid: aaron.zimmerman",
|
"givenName: Aaron",
|
"sn: Zimmerman",
|
"cn: Aaron Zimmerman",
|
"",
|
"dn: uid=mary.jones,dc=example,dc=com",
|
"objectClass: top",
|
"objectClass: person",
|
"objectClass: organizationalPerson",
|
"objectClass: inetOrgPerson",
|
"uid: mary.jones",
|
"givenName: Mary",
|
"sn: Jones",
|
"cn: Mary Jones");
|
}
|
|
/**
|
* A single VLV-by-offset search with {@code afterCount = Integer.MAX_VALUE}
|
* (which previously overflowed {@code 1 + beforeCount + afterCount} into a
|
* negative array size) must now be clamped to the list size and return the
|
* same bounded page as a normal request — not fault the search handler with a
|
* {@code NegativeArraySizeException} / {@code OTHER}.
|
*/
|
@Test
|
public void offsetAllocationOverflowIsClamped() throws Exception
|
{
|
populateDB();
|
|
// Baseline: a normal, bounded window.
|
SearchRequest ok = newSearchRequest("dc=example,dc=com", SearchScope.WHOLE_SUBTREE, "(objectClass=person)")
|
.addControl(new ServerSideSortRequestControl("givenName"))
|
.addControl(new VLVRequestControl(0, 3, 1, 0));
|
InternalSearchOperation okOp = getRootConnection().processSearch(ok);
|
assertEquals(okOp.getResultCode(), ResultCode.SUCCESS);
|
|
// Oversized window: afterCount = Integer.MAX_VALUE. Before the fix this
|
// overflowed to new long[-2147483648]; a larger non-overflowing count would
|
// instead force a multi-gigabyte allocation (OutOfMemoryError).
|
SearchRequest bad = newSearchRequest("dc=example,dc=com", SearchScope.WHOLE_SUBTREE, "(objectClass=person)")
|
.addControl(new ServerSideSortRequestControl("givenName"))
|
.addControl(new VLVRequestControl(0, Integer.MAX_VALUE, 1, 0));
|
InternalSearchOperation badOp = getRootConnection().processSearch(bad);
|
|
assertEquals(badOp.getResultCode(), ResultCode.SUCCESS,
|
"oversized VLV afterCount must be clamped to the list size, not fault the search handler "
|
+ "(GHSA-q4wx-wj4j-4657): " + badOp.getErrorMessage());
|
// The page is bounded by the number of entries that actually exist (offset 1
|
// onwards), i.e. the same result as the bounded baseline request.
|
assertEquals(badOp.getSearchEntries().size(), okOp.getSearchEntries().size());
|
}
|
}
|
