>From c177c34eef54e4ef6dc96cd22418a47cbd03789e Mon Sep 17 00:00:00 2001
From: Nathan Kinder <nkinder@redhat.com>
Date: Wed, 18 Nov 2009 22:05:57 -0800
Subject: [PATCH] Add bounds checking in DN unescape function

My previous patch for bug 504817 could cause us to read past the
end of the RDN string if it ended with a single escape character.
This fix adds a bounds check to ensure that we don't read past
the end of the string.
---
 ldap/servers/slapd/util.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index c8d9a74..71a2305 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -236,8 +236,10 @@ strcpy_unescape_value( char *d, const char *s )
                 }
             }
             /* This is an escaped single character (like \"), so
-             * just copy the special character and not the escape. */
-            if (gotesc) {
+             * just copy the special character and not the escape.
+             * We need to be careful to not go past the end of
+             * the string when the loop increments s. */
+            if (gotesc && (s+1 < end)) {
                 s++;
                 *d++ = *s;
                 gotesc = 0;
-- 
1.6.2.5

