https://bugs.openldap.org/show_bug.cgi?id=10641
--- Comment #2 from Xiangfei Ding xfding@google.com ---
so the length is still being checked.
I think the order matters. Without bound check coming first, under MSAN that is one assertion for you.
if ((dlen == cnlen-1) &&
Likewise, this is one check coming too late.