49 lines
1.4 KiB
Diff
49 lines
1.4 KiB
Diff
|
From 8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Howard Chu <hyc@openldap.org>
|
||
|
|
Date: Sun, 13 Dec 2020 21:48:45 +0000
|
||
|
|
Subject: [PATCH] ITS#9423 ldap_X509dn2bv: check for invalid BER after RDN
|
||
|
|
count
|
||
|
|
|
||
|
|
---
|
||
|
|
libraries/libldap/tls2.c | 12 +++++++-----
|
||
|
|
1 file changed, 7 insertions(+), 5 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
|
||
|
|
index ca5a44ab0..e0c82fa9f 100644
|
||
|
|
--- a/libraries/libldap/tls2.c
|
||
|
|
+++ b/libraries/libldap/tls2.c
|
||
|
|
@@ -1254,6 +1254,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
+ /* Rewind and prepare to extract */
|
||
|
|
+ ber_rewind( ber );
|
||
|
|
+ tag = ber_first_element( ber, &len, &dn_end );
|
||
|
|
+ if ( tag == LBER_DEFAULT )
|
||
|
|
+ return LDAP_DECODING_ERROR;
|
||
|
|
+
|
||
|
|
/* Allocate the DN/RDN/AVA stuff as a single block */
|
||
|
|
dnsize = sizeof(LDAPRDN) * (nrdns+1);
|
||
|
|
dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
|
||
|
|
@@ -1265,16 +1271,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
|
||
|
|
} else {
|
||
|
|
newDN = (LDAPDN)(char *)ptrs;
|
||
|
|
}
|
||
|
|
-
|
||
|
|
+
|
||
|
|
newDN[nrdns] = NULL;
|
||
|
|
newRDN = (LDAPRDN)(newDN + nrdns+1);
|
||
|
|
newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
|
||
|
|
baseAVA = newAVA;
|
||
|
|
|
||
|
|
- /* Rewind and start extracting */
|
||
|
|
- ber_rewind( ber );
|
||
|
|
-
|
||
|
|
- tag = ber_first_element( ber, &len, &dn_end );
|
||
|
|
for ( i = nrdns - 1; i >= 0; i-- ) {
|
||
|
|
newDN[i] = newRDN;
|
||
|
|
|
||
|
|
--
|
||
|
|
GitLab
|
||
|
|
|