On 11. okt. 2016 18:10, elecharny@apache.org wrote:

IMO, the code that deal with tags in the lber decode.c ber_tag_and_rest() method is incorrectly decoding tags that are longer than 1 byte. (...)

It's far too late to change the ASN.1 <-> integer mapping. liblber is widely used outside OpenLDAP, we don't know if we'd break something.

As lber.h explains: * ber_tag_t represents the identifier octets at the beginning of BER * elements. OpenLDAP treats them as mere big-endian unsigned integers.

I wish it had at least used little-endian so we could check the class and P/C bits with a simple '&' operation. Oh well.