ITS#9768 Enforce single name per olcTranslucentLocal/olcTranslucentRemote value

servers/slapd/overlays/translucent.c

@@ -218,10 +218,21 @@ translucent_cf_gen( ConfigArgs *c )
 		}
 		return 0;
 	}
+
+	/* cn=config values could be deleted later, make sure we only allow one
+	 * name per value for valx to match. */
+	if ( c->op != SLAP_CONFIG_ADD && strchr( c->argv[1], ',' ) ) {
+		snprintf( c->cr_msg, sizeof( c->cr_msg ),
+			"%s: Please provide attribute names in separate values",
+			c->argv[0] );
+		goto fail;
+	}
+
 	a2 = str2anlist( *an, c->argv[1], "," );
 	if ( !a2 ) {
 		snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s unable to parse attribute %s",
 			c->argv[0], c->argv[1] );
+fail:
 		Debug( LDAP_DEBUG_CONFIG|LDAP_DEBUG_NONE,
 			"%s: %s\n", c->log, c->cr_msg );
 		return ARG_BAD_CONF;