ITS#9643 Fix out of bounds read in entry_decode()

diff --git a/servers/slapd/entry.c b/servers/slapd/entry.c
index 7c78239c9665d26cdd92c2b10dde4a6852df1a2d..04df2faf8d027c0fcdedcb3954dd2fad6e3a92a4 100644 (file)
--- a/servers/slapd/entry.c
+++ b/servers/slapd/entry.c
@@ -845,7 +845,8 @@ int entry_decode(EntryHeader *eh, Entry **e)
        a = x->e_attrs;
        bptr = (BerVarray)eh->bv.bv_val;
 
-       while ((i = entry_getlen(&ptr))) {
+       while (((char *)ptr - eh->bv.bv_val < eh->bv.bv_len) &&
+              (i = entry_getlen(&ptr))) {
                struct berval bv;
                bv.bv_len = i;
                bv.bv_val = (char *) ptr;