From: Howard Chu <hyc@openldap.org>
Date: Sun, 13 Dec 2020 21:48:45 +0000 (+0000)
Subject: ITS#9423 ldap_X509dn2bv: check for invalid BER after RDN count
X-Git-Tag: OPENLDAP_REL_ENG_2_4_57~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793;p=thirdparty%2Fopenldap.git

ITS#9423 ldap_X509dn2bv: check for invalid BER after RDN count
---

diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index ca5a44ab0c..e0c82fa9f8 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -1254,6 +1254,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
 		}
 	}
 
+	/* Rewind and prepare to extract */
+	ber_rewind( ber );
+	tag = ber_first_element( ber, &len, &dn_end );
+	if ( tag == LBER_DEFAULT )
+		return LDAP_DECODING_ERROR;
+
 	/* Allocate the DN/RDN/AVA stuff as a single block */    
 	dnsize = sizeof(LDAPRDN) * (nrdns+1);
 	dnsize += sizeof(LDAPAVA *) * (navas+nrdns);
@@ -1265,16 +1271,12 @@ ldap_X509dn2bv( void *x509_name, struct berval *bv, LDAPDN_rewrite_func *func,
 	} else {
 		newDN = (LDAPDN)(char *)ptrs;
 	}
-	
+
 	newDN[nrdns] = NULL;
 	newRDN = (LDAPRDN)(newDN + nrdns+1);
 	newAVA = (LDAPAVA *)(newRDN + navas + nrdns);
 	baseAVA = newAVA;
 
-	/* Rewind and start extracting */
-	ber_rewind( ber );
-
-	tag = ber_first_element( ber, &len, &dn_end );
 	for ( i = nrdns - 1; i >= 0; i-- ) {
 		newDN[i] = newRDN;