From: Howard Chu <hyc@openldap.org>
Date: Mon, 13 Jul 2026 17:54:44 +0000 (+0100)
Subject: ITS#10533 liblber: more for ITS#10489
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d5847429011bc0c607d3b4ca165235582832fd35;p=thirdparty%2Fopenldap.git

ITS#10533 liblber: more for ITS#10489

Another potential 1-byte overread
---

diff --git a/libraries/liblber/decode.c b/libraries/liblber/decode.c
index d8fca339fd..9682c1e298 100644
--- a/libraries/liblber/decode.c
+++ b/libraries/liblber/decode.c
@@ -415,7 +415,9 @@ ber_get_stringbvl( BerElement *ber, bgbvr *b )
 		}
 
 		ber->ber_ptr = orig;
-		ber->ber_tag = *(unsigned char *) orig;
+		ber->ber_tag = ( orig < ber->ber_end ) ?
+			*(unsigned char *)orig :
+			LBER_DEFAULT;
 	}
 
 	b->siz = i;