don't get tricked when option separator occurs past end of berval

diff --git a/servers/slapd/ad.c b/servers/slapd/ad.c
index 2aa538e725d29c1663f0a9a0c101e21a6953dd8d..5258dc3fc3d2902b4c8a4c9f92ee6532a20eaaed 100644 (file)
--- a/servers/slapd/ad.c
+++ b/servers/slapd/ad.c
@@ -174,12 +174,15 @@ int slap_bv2ad(
        }
 
        /* find valid base attribute type; parse in place */
-       memset( &desc, 0, sizeof( desc ));
+       memset( &desc, 0, sizeof( desc ) );
        desc.ad_cname = *bv;
        name = bv->bv_val;
-       options = strchr(name, ';');
-       if( options != NULL ) {
+       options = strchr( name, ';' );
+       if ( options != NULL && ( options - name ) < bv->bv_len ) {
+               /* don't go past the end of the berval! */
                desc.ad_cname.bv_len = options - name;
+       } else {
+               options = NULL;
        }
        desc.ad_type = at_bvfind( &desc.ad_cname );
        if( desc.ad_type == NULL ) {