Add bounds checking in DN unescape function

My previous patch for bug 504817 could cause us to read past the
end of the RDN string if it ended with a single escape character.
This fix adds a bounds check to ensure that we don't read past
the end of the string.

1 files changed, 4 insertions, 2 deletions

diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index c8d9a744..71a2305b 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -236,8 +236,10 @@ strcpy_unescape_value( char *d, const char *s )
                 }
             }
             /* This is an escaped single character (like \"), so
-             * just copy the special character and not the escape. */
-            if (gotesc) {
+             * just copy the special character and not the escape.
+             * We need to be careful to not go past the end of
+             * the string when the loop increments s. */
+            if (gotesc && (s+1 < end)) {
                 s++;
                 *d++ = *s;
                 gotesc = 0;