ITS#5817

diff --git a/CHANGES b/CHANGES
index eca10bea515d2271df08365926cfc4101f397348..feb79089ea42039ad7f04ddb8d154bc484251579 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,7 @@ OpenLDAP 2.4 Change Log
 
 OpenLDAP 2.4.13 Release (2008/11/20)
        Added libldap dereference control support (ITS#5768)
+       Fixed libldap parameter checking (ITS#5817)
        Fixed liblutil hex conversion (ITS#5699)
        Fixed liblutil returning undefined data (ITS#5748)
        Fixed libldap error code return (ITS#5762)

diff --git a/libraries/libldap/add.c b/libraries/libldap/add.c
index d993650613fa70edf2581a63f476f2a625ee5e06..1a50a7929ff6fbfaa0127435c631bac2c9d744f4 100644 (file)
--- a/libraries/libldap/add.c
+++ b/libraries/libldap/add.c
@@ -151,9 +151,32 @@ ldap_add_ext(
                /* for each attribute in the entry... */
                for ( i = 0; attrs[i] != NULL; i++ ) {
                        if ( ( attrs[i]->mod_op & LDAP_MOD_BVALUES) != 0 ) {
+                               int j;
+
+                               if ( attrs[i]->mod_bvalues == NULL ) {
+                                       ld->ld_errno = LDAP_PARAM_ERROR;
+                                       ber_free( ber, 1 );
+                                       return ld->ld_errno;
+                               }
+
+                               for ( j = 0; attrs[i]->mod_bvalues[ j ] != NULL; j++ ) {
+                                       if ( attrs[i]->mod_bvalues[ j ]->bv_val == NULL ) {
+                                               ld->ld_errno = LDAP_PARAM_ERROR;
+                                               ber_free( ber, 1 );
+                                               return ld->ld_errno;
+                                       }
+                               }
+
                                rc = ber_printf( ber, "{s[V]N}", attrs[i]->mod_type,
                                    attrs[i]->mod_bvalues );
+
                        } else {
+                               if ( attrs[i]->mod_values == NULL ) {
+                                       ld->ld_errno = LDAP_PARAM_ERROR;
+                                       ber_free( ber, 1 );
+                                       return ld->ld_errno;
+                               }
+
                                rc = ber_printf( ber, "{s[v]N}", attrs[i]->mod_type,
                                    attrs[i]->mod_values );
                        }