From 8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793 Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Sun, 13 Dec 2020 21:48:45 +0000 Subject: [PATCH] ITS#9423 ldap_X509dn2bv: check for invalid BER after RDN count --- libraries/libldap/tls2.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c index ca5a44ab0c..e0c82fa9f8 100644 --- a/libraries/libldap/tls2.c +++ b/libraries/libldap/tls2.c @@ -1254,6 +1254,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func, } } + /* Rewind and prepare to extract */ + ber_rewind( ber ); + tag = ber_first_element( ber, &len, &dn_end ); + if ( tag == LBER_DEFAULT ) + return LDAP_DECODING_ERROR; + /* Allocate the DN/RDN/AVA stuff as a single block */ dnsize = sizeof(LDAPRDN) * (nrdns+1); dnsize += sizeof(LDAPAVA *) * (navas+nrdns); @@ -1265,16 +1271,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func, } else { newDN = (LDAPDN)(char *)ptrs; } - + newDN[nrdns] = NULL; newRDN = (LDAPRDN)(newDN + nrdns+1); newAVA = (LDAPAVA *)(newRDN + navas + nrdns); baseAVA = newAVA; - /* Rewind and start extracting */ - ber_rewind( ber ); - - tag = ber_first_element( ber, &len, &dn_end ); for ( i = nrdns - 1; i >= 0; i-- ) { newDN[i] = newRDN; -- 2.20.1