strengthen dn_issuffix

diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c
index 5dc8f50a7f9ada7caa3d1a5f103cd2fecf5f8ffa..b9705ba95095346a048fd3640074fefb7b50c5a4 100644 (file)
--- a/servers/slapd/dn.c
+++ b/servers/slapd/dn.c
@@ -450,16 +450,32 @@ char **dn_subtree(
 }
 
 
+int
 dn_issuffixbv(
        const struct berval *dn,
        const struct berval *suffix
 )
 {
-       if (suffix->bv_len > dn->bv_len)
+       int     d = dn->bv_len - suffix->bv_len;
+
+       /* suffix longer than dn */
+       if ( d < 0 ) {
+               return 0;
+       }
+
+       /* no rdn separator or escaped rdn separator */
+       if ( d > 1 && ( !DN_SEPARATOR( dn->bv_val[ d - 1 ] ) 
+                               || DN_ESCAPE( dn->bv_val[ d - 2 ] ) ) ) {
                return 0;
+       }
 
-       return( strcmp( dn->bv_val + dn->bv_len - suffix->bv_len,
-               suffix->bv_val ) == 0 );
+       /* no possible match or malformed dn */
+       if ( d == 1 ) {
+               return 0;
+       }
+
+       /* compare */
+       return( strcmp( dn->bv_val + d, suffix->bv_val ) == 0 );
 }
 
 /*
@@ -473,20 +489,14 @@ dn_issuffix(
        const char      *suffix
 )
 {
-       int     dnlen, suffixlen;
-
-       if ( dn == NULL ) {
-               return( 0 );
-       }
+       struct berval   bvdn, bvsuffix;
 
-       suffixlen = strlen( suffix );
-       dnlen = strlen( dn );
-
-       if ( suffixlen > dnlen ) {
-               return( 0 );
-       }
+       bvdn.bv_val = (char *) dn;
+       bvdn.bv_len = strlen( dn );
+       bvsuffix.bv_val = (char *) suffix;
+       bvsuffix.bv_len = strlen( suffix );
 
-       return( strcmp( dn + dnlen - suffixlen, suffix ) == 0 );
+       return dn_issuffixbv( &bvdn, &bvsuffix );
 }
 
 /*