From: Howard Chu <hyc@openldap.org>
Date: Tue, 6 Jan 2026 20:52:25 +0000 (+0000)
Subject: ITS#10421 mdb_load: check for malicious input
X-Git-Tag: LMDB_1.0.0-branch~34
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b136c42f1968310ab2124dc45dbd14ef2214dcf;p=thirdparty%2Fopenldap.git

ITS#10421 mdb_load: check for malicious input
---

diff --git a/libraries/liblmdb/mdb_load.c b/libraries/liblmdb/mdb_load.c
index 6d1b5a4328..e6b23406e2 100644
--- a/libraries/liblmdb/mdb_load.c
+++ b/libraries/liblmdb/mdb_load.c
@@ -218,6 +218,12 @@ badend:
 
 	c1 = buf->mv_data;
 	len = strlen((char *)c1);
+	if (!len) {
+		/* This can only happen with an intentionally invalid input
+		 * with a NUL byte after the leading SPACE
+		 */
+		goto badend;
+	}
 	l2 = len;
 
 	/* Is buffer too short? */