https://bugs.openldap.org/show_bug.cgi?id=10493

Issue ID: 10493 Summary: change in 2.6.13 for ber_bvreplace_x introduces out of bounds reads Product: OpenLDAP Version: 2.6.13 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: dirk@dmllr.de Target Milestone: ---

2.6.13 includes the patch for "Fixed liblber ber_bvreplace_x potential NULL dereference"

However, this now introduces OOB reads.

If ber_memrealloc_x fails to allocate memory, the function executes

AC_MEMCPY( dst->bv_val, src->bv_val, dst->bv_len + 1 );

Because `dst->bv_len` was not updated to `src->bv_len`, `AC_MEMCPY` copies exactly `dst->bv_len + 1` bytes from `src`. Since `src` is strictly larger than the old `dst->bv_len`, the byte copied into the final position (`dst->bv_val[dst->bv_len]`) will be the corresponding character from `src`, **not a null-terminator**.

This leaves the `dst->bv_val` buffer without a null-terminator. Any subsequent string-based operations (like `strlen`, `printf`, or logging functions) acting on the `berval`'s `bv_val` will read out-of-bounds into adjacent heap memory until it randomly hits a null byte, leading to a heap buffer over-read (OOB Read) or information leak.

Similarly, if the source buffer was not null-terminated and was precisely sized to its length, it reads 1 byte past the end of src->bv_val, which is an Out-of-Bounds Read that could lead to crashes or leaking adjacent memory.

suggest to use this instead:

if ( dst->bv_val != NULL ) { AC_MEMCPY( dst->bv_val, src->bv_val, dst->bv_len ); dst->bv_val[dst->bv_len] = '\0'; }