New subject: [Issue 10357] Potential buffer underflow in function config_find_base

12 Jun 2025


      https://bugs.openldap.org/show_bug.cgi?id=10357
Issue ID: 10357
           Summary: Potential buffer underflow in function
                    config_find_base
           Product: OpenLDAP
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Keywords: needs_review
          Severity: normal
          Priority: ---
         Component: slapd
          Assignee: bugs@openldap.org
          Reporter: alexguo1023@gmail.com
  Target Milestone: ---
In function `config_find_base`, we have the code:
```c
char *c = dn->bv_val+dn->bv_len;
for (;*c != ',';c--);
```
In the loop, if the string doesn't contain any commas, `c` will decrement below
`dn->bv_val`, causing buffer underflow when `*c` is accessed.
-- 
You are receiving this mail because:
You are on the CC list for the issue.

[Issue 10357] New: Potential buffer underflow in function config_find_base