ITS#778: fix first/next attr

diff --git a/CHANGES b/CHANGES
index 597ea9e950e4a74fc738f9eb0e9bbe25ec12812f..b1b8a35259ca731e04f82a9b95bbf6dce4e217e8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,7 @@ OpenLDAP 2.0.X Engineering
        Fixed slapd caseIgnoreIA5string indexing bug (ITS#786)
        Fixed slurpd TLS initialization bug (ITS#768)
        Fixed -lldap SASL ctx close bug (ITS#790)
+       Fixed -lldap first/next attribute bug (ITS#778)
        Updated -llber bprint routine
        Build Environment
                Fixed IPv6 detection (ITS#669,ITS#770)

diff --git a/libraries/libldap/getattr.c b/libraries/libldap/getattr.c
index 79fe0a4ad03a3ef2c77616a1e82c0ff294e3ae5f..5ffc1fa81e7af03fc19cf4e0ea3cfd191b05d3d9 100644 (file)
--- a/libraries/libldap/getattr.c
+++ b/libraries/libldap/getattr.c
@@ -22,45 +22,73 @@
 #include "ldap-int.h"
 
 char *
-ldap_first_attribute( LDAP *ld, LDAPMessage *entry, BerElement **ber )
+ldap_first_attribute( LDAP *ld, LDAPMessage *entry, BerElement **berout )
 {
+       int rc;
+       ber_tag_t tag;
+       ber_len_t len = 0;
        char *attr;
+       BerElement *ber;
 
        Debug( LDAP_DEBUG_TRACE, "ldap_first_attribute\n", 0, 0, 0 );
 
        assert( ld != NULL );
        assert( LDAP_VALID( ld ) );
        assert( entry != NULL );
-       assert( ber != NULL );
+       assert( berout != NULL );
+
+       *berout = NULL;
 
-       if ( (*ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
-               *ber = NULL;
-               return( NULL );
+       ber = ldap_alloc_ber_with_options( ld );
+       if( ber == NULL ) {
+               return NULL;
        }
 
-       **ber = *entry->lm_ber;
+       *ber = *entry->lm_ber;
 
        /* 
-        * Skip past the sequence, dn, sequence of sequence, snarf the
-        * attribute type, and skip the set of values, leaving us
-        * positioned right before the next attribute type/value sequence.
+        * Skip past the sequence, dn, sequence of sequence leaving
+        * us at the first attribute.
         */
 
-       if ( ber_scanf( *ber, "{x{{ax}" /*}}*/, &attr )
-           == LBER_ERROR ) {
+       tag = ber_scanf( ber, "{xl{" /*}}*/, &len );
+       if( tag == LBER_ERROR ) {
                ld->ld_errno = LDAP_DECODING_ERROR;
-               ber_free( *ber, 0 );
-               *ber = NULL;
-               return( NULL );
+               ber_free( ber, 0 );
+               return NULL;
+       }
+
+       /* set the length to avoid overrun */
+       rc = ber_set_option( ber, LBER_OPT_REMAINING_BYTES, &len );
+       if( rc != LBER_OPT_SUCCESS ) {
+               ld->ld_errno = LDAP_LOCAL_ERROR;
+               ber_free( ber, 0 );
+               return NULL;
+       }
+
+       if ( ber_pvt_ber_remaining( ber ) == 0 ) {
+               assert( len == 0 );
+               return NULL;
        }
+       assert( len != 0 );
 
-       return( attr );
+       /* snatch the first attribute */
+       tag = ber_scanf( ber, "{ax}", &attr );
+       if( tag == LBER_ERROR ) {
+               ld->ld_errno = LDAP_DECODING_ERROR;
+               ber_free( ber, 0 );
+               return NULL;
+       }
+
+       *berout = ber;
+       return attr;
 }
 
 /* ARGSUSED */
 char *
 ldap_next_attribute( LDAP *ld, LDAPMessage *entry, BerElement *ber )
 {
+       ber_tag_t tag;
        char *attr;
 
        Debug( LDAP_DEBUG_TRACE, "ldap_next_attribute\n", 0, 0, 0 );
@@ -70,12 +98,16 @@ ldap_next_attribute( LDAP *ld, LDAPMessage *entry, BerElement *ber )
        assert( entry != NULL );
        assert( ber != NULL );
 
+       if ( ber_pvt_ber_remaining( ber ) == 0 ) {
+               return NULL;
+       }
+
        /* skip sequence, snarf attribute type, skip values */
-       if ( ber_scanf( ber, "{ax}", &attr ) 
-           == LBER_ERROR ) {
+       tag = ber_scanf( ber, "{ax}", &attr ); 
+       if( tag == LBER_ERROR ) {
                ld->ld_errno = LDAP_DECODING_ERROR;
-               return( NULL );
+               return NULL;
        }
 
-       return( attr );
+       return attr;
 }