make sure we don't test against stored values starting with "{"

diff --git a/libraries/liblutil/passwd.c b/libraries/liblutil/passwd.c
index 7a04154b98d65787e16778a9102f104214414223..3fc5e6f455e587f410216f282fc498d9fe3a60a6 100644 (file)
--- a/libraries/liblutil/passwd.c
+++ b/libraries/liblutil/passwd.c
@@ -328,7 +328,8 @@ lutil_passwd(
 
 #ifdef SLAPD_CLEARTEXT
        if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) {
-               return passwd->bv_len == cred->bv_len
+               return (( passwd->bv_len == cred->bv_len ) &&
+                               ( passwd->bv_val[0] != '{' /*'}'*/ ))
                        ? memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
                        : 1;
        }