diff --git a/servers/slapd/dn.c b/servers/slapd/dn.c
index a70d5df292..b776e18e30 100644
--- a/servers/slapd/dn.c
+++ b/servers/slapd/dn.c
@@ -470,6 +470,11 @@ dnPrettyNormal(
 		pretty->bv_len = 0;
 		normal->bv_len = 0;
 
+		/* FIXME: str2dn should take a bv and handle this */
+		if( strlen( val->bv_val ) != val->bv_len ) {
+			return LDAP_INVALID_SYNTAX;
+		}
+
 		/* FIXME: should be liberal in what we accept */
 		rc = ldap_str2dn( val->bv_val, &dn, LDAP_DN_FORMAT_LDAP );
 		if ( rc != LDAP_SUCCESS ) {