ITS#5300, reject substring filters with empty values

diff --git a/libraries/libldap/filter.c b/libraries/libldap/filter.c
index 6709540885ea4080d5b5431536588afd6201e46c..3ad77c4fdb8799d7bcfb479674cf1f0eb99e8b14 100644 (file)
--- a/libraries/libldap/filter.c
+++ b/libraries/libldap/filter.c
@@ -751,10 +751,12 @@ put_substring_filter( BerElement *ber, char *type, char *val )
                        }
                }
 
-               if ( *val != '\0' || ftype == LDAP_SUBSTRING_ANY ) {
+               if ( *val == '\0' ) {
+                       return -1;
+               } else {
                        ber_slen_t len = ldap_pvt_filter_value_unescape( val );
 
-                       if ( len < 0  ) {
+                       if ( len <= 0  ) {
                                return -1;
                        }