components/openldap/patches/02-CVE-2015-1545.patch
author John Beck <John.Beck@Oracle.COM>
Tue, 06 Oct 2015 07:41:40 -0700
changeset 4973 be26c0c14fa7
parent 4654 94e90d50dc0e
permissions -rw-r--r--
21960309 Userland mangler should drop depend actions from obsolete packages

Fixes problem with OpenLDAP server configuration in Solaris.
Patch was generated from upstream.

--- openldap-2.4.30/servers/slapd/overlays/deref.c.old	Fri Jun 26 13:59:18 2015
+++ openldap-2.4.30/servers/slapd/overlays/deref.c	Fri Jun 26 13:59:40 2015
@@ -182,7 +182,8 @@
 		ber_len_t cnt = sizeof(struct berval);
 		ber_len_t off = 0;
 
-		if ( ber_scanf( ber, "{m{M}}", &derefAttr, &attributes, &cnt, off ) == LBER_ERROR )
+		if ( ber_scanf( ber, "{m{M}}", &derefAttr, &attributes, &cnt, off ) == LBER_ERROR
+			|| !cnt )
 		{
 			rs->sr_text = "Dereference control: derefSpec decoding error";
 			rs->sr_err = LDAP_PROTOCOL_ERROR;