File 0218-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch of Package openldap2.24984
From 2ef57f034f5f15ceca3b41592dd2a44e2704de22 Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Sun, 13 Dec 2020 21:48:45 +0000
Subject: [PATCH 218/222] ITS#9423 ldap_X509dn2bv: check for invalid BER after
RDN count
---
libraries/libldap/tls2.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index 27eab701c..3d2098053 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -1224,6 +1224,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
}
}
+ /* Rewind and prepare to extract */
+ ber_rewind( ber );
+ tag = ber_first_element( ber, &len, &dn_end );
+ if ( tag == LBER_DEFAULT )
+ return LDAP_DECODING_ERROR;
+
/* Allocate the DN/RDN/AVA stuff as a single block */
dnsize = sizeof(LDAPRDN) * (nrdns+1);
dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
@@ -1235,16 +1241,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
} else {
newDN = (LDAPDN)(char *)ptrs;
}
-
+
newDN[nrdns] = NULL;
newRDN = (LDAPRDN)(newDN + nrdns+1);
newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
baseAVA = newAVA;
- /* Rewind and start extracting */
- ber_rewind( ber );
-
- tag = ber_first_element( ber, &len, &dn_end );
for ( i = nrdns - 1; i >= 0; i-- ) {
newDN[i] = newRDN;
--
2.30.0
