ITS#5324

CHANGES

@@ -8,6 +8,7 @@ OpenLDAP 2.4.8 Engineering
 	Fixed libldap ldap_parse_sasl_bind_result (ITS#5263)
 	Fixed libldap search timeout crash (ITS#5291)
 	Fixed libldap paged results crash (ITS#5315)
+	Fixed libldap use of %n (ITS#5324)
 	Fixed ldapdelete with sizelimit (ITS#5294)
 	Fixed slapd idlcache on adds (ITS#5086)
 	Fixed slapd include handling (ITS#5276)

libraries/libldap/url.c

@@ -642,14 +642,16 @@ desc2str( LDAPURLDesc *u, char *s, int len )
 	}
 
 	if ( u->lud_port ) {
-		len -= sprintf( s, "%s://%s%s%s:%d%n", u->lud_scheme,
+		sofar = sprintf( s, "%s://%s%s%s:%d", u->lud_scheme,
 				is_v6 ? "[" : "",
 				u->lud_host ? u->lud_host : "",
 				is_v6 ? "]" : "",
-				u->lud_port, &sofar );
+				u->lud_port );
+		len -= sofar;
 
 	} else {
-		len -= sprintf( s, "%s://%n", u->lud_scheme, &sofar );
+		sofar = sprintf( s, "%s://", u->lud_scheme );
+		len -= sofar;
 		if ( u->lud_host && u->lud_host[0] ) {
 			if ( is_v6 ) {
 				s[sofar++] = '[';