From 6566527af65f6a6ba18d082b19062a79529f6874 Mon Sep 17 00:00:00 2001 From: Lukas Dresel Date: Wed, 14 Jan 2026 15:23:50 +0200 Subject: [PATCH] ITS#10425 back-asyncmeta: suffixmassage empty target underflows dn length in asyncmeta_dn_massage --- servers/slapd/back-asyncmeta/map.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/servers/slapd/back-asyncmeta/map.c b/servers/slapd/back-asyncmeta/map.c index b19acb829b..aa2eefb529 100644 --- a/servers/slapd/back-asyncmeta/map.c +++ b/servers/slapd/back-asyncmeta/map.c @@ -205,7 +205,7 @@ ignore: goto ignore; /* if remote suffix is empty, remove or add the dn separator*/ - if ( nsuff->bv_len == 0 ) { + if ( nsuff->bv_len == 0 && diff > 0) { diff--; } else if ( osuff->bv_len == 0 ) { diff++; @@ -214,8 +214,10 @@ ignore: res->bv_len = diff + nsuff->bv_len; res->bv_val = dc->op->o_tmpalloc( res->bv_len + 1, dc->memctx ); - strncpy( res->bv_val, dn->bv_val, diff ); - if ( osuff->bv_len == 0 ) + if ( diff > 0 ) { + strncpy( res->bv_val, dn->bv_val, diff ); + } + if ( osuff->bv_len == 0 && diff > 0 ) res->bv_val[diff-1] = ','; strcpy( &res->bv_val[diff], nsuff->bv_val );