Do not return pointers into BerElement we do not own

[openldap] / servers / slapd / dn.c

diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c
index 647468d92bffc5ba5804596c44278e2870f6b271..b1168901c001dac8fadb72f57778ef1e983be181 100644 (file)
--- a/servers/slapd/dn.c
+++ b/servers/slapd/dn.c
@@ -267,6 +267,11 @@ LDAPDN_rewrite( LDAPDN *dn, unsigned flags )
                        ava->la_attr = ad->ad_cname;
 
                        if( ava->la_flags & LDAP_AVA_BINARY ) {
+                               if( ava->la_value.bv_len == 0 ) {
+                                       /* BER encoding is empty */
+                                       return LDAP_INVALID_SYNTAX;
+                               }
+
                                /* AVA is binary encoded, don't muck with it */
                        } else if( flags & SLAP_LDAPDN_PRETTY ) {
                                transf = ad->ad_type->sat_syntax->ssyn_pretty;