From 71b87e678bcc03bb9a0802f7dffc97cf354ee69a Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Thu, 5 Apr 2018 14:52:34 -0400
Subject: [PATCH] CVE-2018-1089 - Crash from long search filter

---
 ldap/servers/slapd/filter.c |  8 ++++----
 ldap/servers/slapd/util.c   | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/ldap/servers/slapd/filter.c b/ldap/servers/slapd/filter.c
index 2ac3d2cd8..393a4dcee 100644
--- a/ldap/servers/slapd/filter.c
+++ b/ldap/servers/slapd/filter.c
@@ -472,7 +472,7 @@ get_substring_filter(
 			f->f_sub_initial = val;
 			eval = (char*)slapi_escape_filter_value(val, -1);
 			if(eval) {
-				if (fstr_len < strlen(*fstr) + strlen(eval) + 1) {
+				if (fstr_len <= strlen(*fstr) + strlen(eval) + 1) {
 				    fstr_len += (strlen(eval) + 1) * 2;
 				    *fstr = slapi_ch_realloc(*fstr, fstr_len);
 				}
@@ -486,7 +486,7 @@ get_substring_filter(
 			charray_add(&f->f_sub_any, val);
 			eval = (char*)slapi_escape_filter_value(val, -1);
 			if(eval){
-				if (fstr_len < strlen(*fstr) + strlen(eval) + 1) {
+				if (fstr_len <= strlen(*fstr) + strlen(eval) + 1) {
 				    fstr_len += (strlen(eval) + 1) * 2;
 				    *fstr = slapi_ch_realloc(*fstr, fstr_len);
 				}
@@ -504,7 +504,7 @@ get_substring_filter(
 			f->f_sub_final = val;
 			eval = (char*)slapi_escape_filter_value( val, -1);
 			if(eval){
-				if (fstr_len < strlen(*fstr) + strlen(eval) + 1) {
+				if (fstr_len <= strlen(*fstr) + strlen(eval) + 1) {
 				    fstr_len += (strlen(eval) + 1) * 2;
 				    *fstr = slapi_ch_realloc(*fstr, fstr_len);
 				}
@@ -530,7 +530,7 @@ get_substring_filter(
 	}
 
 	filter_compute_hash(f);
-	if (fstr_len < strlen(*fstr) + 3) {
+	if (fstr_len <= strlen(*fstr) + 3) {
 		fstr_len += 3;
 		*fstr = slapi_ch_realloc(*fstr, fstr_len);
 	}
diff --git a/ldap/servers/slapd/util.c b/ldap/servers/slapd/util.c
index ddb2cc899..cb46efb3d 100644
--- a/ldap/servers/slapd/util.c
+++ b/ldap/servers/slapd/util.c
@@ -161,6 +161,11 @@ do_escape_string(
                     break;
                 }
                 do {
+                    if (bufSpace < 4) {
+                        memcpy(bufNext, "..", 2);
+                        bufNext += 2;
+                        goto bail;
+                    }
                     if (esc == UTIL_ESCAPE_BACKSLASH) {
                         /* *s is '\\' */
                         /* If *(s+1) and *(s+2) are both hex digits,
@@ -179,11 +184,6 @@ do_escape_string(
                         if (!(flags & DOESCAPE_FLAGS_HEX_NOESC)) {
                             *bufNext++ = '\\'; --bufSpace;
                         }
-                        if (bufSpace < 3) {
-                            memcpy(bufNext, "..", 2);
-                            bufNext += 2;
-                            goto bail;
-                        }
                         PR_snprintf(bufNext, 3, "%02x", *(unsigned char*)s);
                         bufNext += 2; bufSpace -= 2;
                     }
-- 
2.13.6