+ Fixed libldap referral input destroy issue (ITS#4533)

diff --git a/CHANGES b/CHANGES
index 6212b3127c7d94aa6f736f1708277ba7ad4bfe86..dd3deeeff83730d3bc86a3d7f076e55b4d97c33b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,7 @@
 OpenLDAP 2.3 Change Log
 
 OpenLDAP 2.3.22 Engineering
+       Fixed libldap referral input destroy issue (ITS#4533)
        Fixed libldap ldap_sort_entries tail bug (ITS#4536)
        Fixed libldap_r thread debug missing break
        Fixed libldap_r tpool cleanup

diff --git a/libraries/libldap/request.c b/libraries/libldap/request.c
index ce56f7ea7c55a12b5719a35e070df77895da0a9c..5cbac2c3ad44726ab66bbd15b74d753d7ee482d3 100644 (file)
--- a/libraries/libldap/request.c
+++ b/libraries/libldap/request.c
@@ -1274,8 +1274,7 @@ re_encode_request( LDAP *ld,
        ber_int_t       scope;
        int             rc;
        BerElement      tmpber, *ber;
-       struct berval           orig_dn;
-       char            *dn;
+       struct berval           dn;
 
        Debug( LDAP_DEBUG_TRACE,
            "re_encode_request: new msgid %ld, new dn <%s>\n",
@@ -1300,15 +1299,15 @@ re_encode_request( LDAP *ld,
        assert( tag != 0);
        if ( tag == LDAP_REQ_BIND ) {
                /* bind requests have a version number before the DN & other stuff */
-               rtag = ber_scanf( &tmpber, "{im" /*}*/, &ver, &orig_dn );
+               rtag = ber_scanf( &tmpber, "{im" /*}*/, &ver, &dn );
 
        } else if ( tag == LDAP_REQ_DELETE ) {
                /* delete requests don't have a DN wrapping sequence */
-               rtag = ber_scanf( &tmpber, "m", &orig_dn );
+               rtag = ber_scanf( &tmpber, "m", &dn );
 
        } else if ( tag == LDAP_REQ_SEARCH ) {
                /* search requests need to be re-scope-ed */
-               rtag = ber_scanf( &tmpber, "{me" /*"}"*/, &orig_dn, &scope );
+               rtag = ber_scanf( &tmpber, "{me" /*"}"*/, &dn, &scope );
 
                if( srv->lud_scope != LDAP_SCOPE_DEFAULT ) {
                        /* use the scope provided in reference */
@@ -1337,7 +1336,7 @@ re_encode_request( LDAP *ld,
                }
 
        } else {
-               rtag = ber_scanf( &tmpber, "{m" /*}*/, &orig_dn );
+               rtag = ber_scanf( &tmpber, "{m" /*}*/, &dn );
        }
 
        if( rtag == LBER_ERROR ) {
@@ -1345,24 +1344,25 @@ re_encode_request( LDAP *ld,
                return NULL;
        }
 
+       /* restore character zero'd out by ber_scanf*/
+       dn.bv_val[dn.bv_len] = tmpber.ber_tag;
+
        if (( ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
                return NULL;
        }
 
-       if ( srv->lud_dn == NULL ) {
-               dn = orig_dn.bv_val;
-       } else {
-               dn = srv->lud_dn;
+       if ( srv->lud_dn ) {
+               ber_str2bv( srv->lud_dn, 0, 0, &dn );
        }
 
        if ( tag == LDAP_REQ_BIND ) {
-               rc = ber_printf( ber, "{it{is" /*}}*/, msgid, tag, ver, dn );
+               rc = ber_printf( ber, "{it{iO" /*}}*/, msgid, tag, ver, &dn );
        } else if ( tag == LDAP_REQ_DELETE ) {
-               rc = ber_printf( ber, "{itsN}", msgid, tag, dn );
+               rc = ber_printf( ber, "{itON}", msgid, tag, &dn );
        } else if ( tag == LDAP_REQ_SEARCH ) {
-               rc = ber_printf( ber, "{it{se" /*}}*/, msgid, tag, dn, scope );
+               rc = ber_printf( ber, "{it{Oe" /*}}*/, msgid, tag, &dn, scope );
        } else {
-               rc = ber_printf( ber, "{it{s" /*}}*/, msgid, tag, dn );
+               rc = ber_printf( ber, "{it{O" /*}}*/, msgid, tag, &dn );
        }
 
        if ( rc == -1 ) {