New subject: [Issue 10488] Multiple out-of-bounds reads in servers/slapd/result.c v2ref() function

9 Apr 2026


      https://bugs.openldap.org/show_bug.cgi?id=10488
Issue ID: 10488
           Summary: Multiple out-of-bounds reads in servers/slapd/result.c
                    v2ref() function
           Product: OpenLDAP
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Keywords: needs_review
          Severity: normal
          Priority: ---
         Component: slapd
          Assignee: bugs@openldap.org
          Reporter: wangxiaomeng@kylinos.cn
  Target Milestone: ---
Created attachment 1142
  --> https://bugs.openldap.org/attachment.cgi?id=1142&action=edit
Fix two out-of-bounds reads in servers/slapd/result.c v2ref() function
The v2ref() function in servers/slapd/result.c is responsible for converting
LDAPv3 referrals to an LDAPv2-compatible string format. Two separate
out-of-bounds read vulnerabilities exist in this function, both caused by
insufficient checks for zero-length data before accessing the last character of
the data buffer.
Vulnerability 1: Out-of-bounds read in text buffer handling
Location: servers/slapd/result.c, line 94 (within the v2ref() function):
Vulnerable Code:
if ( text != NULL ) {
    len = strlen( text );
    if (text[len-1] != '\n') {
        i = 1;
    }
}
When the 'text' parameter is non-NULL but points to an empty string (""),
strlen(text) returns 0. Accessing text[len-1] (i.e., text[-1]) results in an
out-of-bounds read of one byte before the start of the 'text' buffer.
Vulnerability 2: Out-of-bounds read in BerValue referral handling
Location: servers/slapd/result.c, line 115 (within the v2ref() function)
Vulnerable Code:
len += ref[i].bv_len;
if (ref[i].bv_val[ref[i].bv_len-1] != '/') {
    ++len;
}
When ref[i].bv_val is non-NULL but ref[i].bv_len is 0 (a valid state per LDAP
BerValue semantics, representing an empty string), accessing
ref[i].bv_val[ref[i].bv_len-1] (i.e., ref[i].bv_val[-1]) results in an
out-of-bounds read of one byte before the start of the ref[i].bv_val buffer.
Fix
Add checks for zero-length data before accessing the last character of the
respective buffers. The fix addresses both vulnerabilities with minimal,
targeted changes that preserve the original functionality.
-- 
You are receiving this mail because:
You are on the CC list for the issue.

[Issue 10488] New: Multiple out-of-bounds reads in servers/slapd/result.c v2ref() function