https://bugs.openldap.org/show_bug.cgi?id=10554

Issue ID: 10554 Summary: More bugs in deprecated functions in getdn.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: trivial Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: hyc@openldap.org Target Milestone: ---

Filing these for completeness, and to avoid repeated reports of them in the future. The relevant functions have been deprecated since 2006 and nothing currently uses them.

Reported by Yeo Jooho (여주호) jh.yeo@piolink.com

1. ldap_explode_rdn() allocates its values[] array without zeroing it. On error, freeing it can free garbage pointers left over from previous heap allocs.

2. strval2ADstrlen() terminates its loop on NUL but advances by UTF-8 char length, so a truncated lead byte at the end of a value steps the pointer past the terminator and reads out of bounds. Heap-buffer-overflow read, confirmed it does not disclose adjacent memory into output. Trigger: ldap_str2dn() on a value like "cn=ab\c9,dc=x" followed by ldap_dn2str() with LDAP_DN_FORMAT_AD_CANONICAL. Will trigger an error in ASAN but is benign in normal builds.

3. ldap_explode_dn() doesn't check ldap_rdn2str()'s return value. On failure that leaves a NULL embedded mid-array, which stops the caller's ldap_memvfree() walk early and leaks everything after it. Trigger: a DN with a bad RDN anywhere but the last position.