note about OpenSSL being more liberal than OpenLDAP when there is garbage past the...

[openldap] / servers / slapd / schema_init.c

diff --git a/servers/slapd/schema_init.c b/servers/slapd/schema_init.c
index 164c348b8c9e598b3bfaaac4887b1ec6f55b42e1..95d108f6a5f294bd53777cfff0a7aa8d0742a708 100644 (file)
--- a/servers/slapd/schema_init.c
+++ b/servers/slapd/schema_init.c
@@ -337,6 +337,7 @@ certificateListValidate( Syntax *syntax, struct berval *in )
        ber_skip_data( ber, len );
        tag = ber_skip_tag( ber, &len );
        /* Must be at end now */
+       /* NOTE: OpenSSL tolerates CL with garbage past the end */
        if ( len || tag != LBER_DEFAULT ) return LDAP_INVALID_SYNTAX;
        return LDAP_SUCCESS;
 }
@@ -389,7 +390,7 @@ attributeCertificateValidate( Syntax *syntax, struct berval *in )
        if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX;
        ber_skip_data( ber, len );
 
-       ber_peek_tag( ber, &len );
+       tag = ber_peek_tag( ber, &len );
 
        if ( tag == LBER_BITSTRING ) {  /* issuerUniqueID */
                tag = ber_skip_tag( ber, &len );