ITS#6303

CHANGES

@@ -2,6 +2,7 @@ OpenLDAP 2.4 Change Log
 
 OpenLDAP 2.4.19 Engineering
 	Fixed slapd tools to allow -n for conversion (ITS#6258)
+	Fixed slapd-ldif buffer overflow (ITS#6303)
 	Fixed slapo-dynlist lock leak (ITS#6308)
 	Fixed slapo-pcache cache corruption (ITS#6242)
 	Fixed slapo-sssvlv sort control dereferencing (ITS#6288)

servers/slapd/back-ldif/ldif.c

@@ -593,9 +593,9 @@ typedef struct bvlist {
 	char *trunc;	/* filename was truncated here */
 	int  inum;		/* num from "attr={num}" in filename, or INT_MIN */
 	char savech;	/* original char at *trunc */
-	char fname;		/* variable length array BVL_NAME(bvl) = &fname */
-#	define BVL_NAME(bvl) ((char *) (bvl) + offsetof(bvlist, fname))
-#	define BVL_SIZE(namelen) (sizeof(bvlist) + (namelen))
+	/* BVL_NAME(&bvlist) is the filename, allocated after the struct: */
+#	define BVL_NAME(bvl)     ((char *) ((bvl) + 1))
+#	define BVL_SIZE(namelen) (sizeof(bvlist) + (namelen) + 1)
 } bvlist;
 
 static int