ITS#5403

CHANGES

@@ -8,6 +8,7 @@ OpenLDAP 2.4.10 Engineering
 	Fixed slapd missing termination of integerFilter keys (ITS#5503)
 	Fixed slapd multiple attrs in URI (ITS#5516)
 	Fixed slapd socket assert (ITS#5489)
+	Fixed slapd sasl_ssf retrieval (ITS#5403)
 	Fixed slapd-bdb/hdb MAXPATHLEN (ITS#5531)
 	Fixed slapd-bdb indexing in single ADD/MOD (ITS#5521)
 	Fixed slapd-ldap entry_get() op-dependent behavior (ITS#5513)

servers/slapd/syncrepl.c

@@ -568,7 +568,12 @@ do_syncrep1(
 		op->o_tls_ssf = ldap_pvt_tls_get_strength( ssl );
 	}
 #endif /* HAVE_TLS */
-	ldap_get_option( si->si_ld, LDAP_OPT_X_SASL_SSF, &op->o_sasl_ssf );
+	{
+		ber_len_t ssf; /* ITS#5403, 3864 LDAP_OPT_X_SASL_SSF probably ought
+						  to use sasl_ssf_t but currently uses ber_len_t */
+		ldap_get_option( si->si_ld, LDAP_OPT_X_SASL_SSF, &ssf );
+		op->o_sasl_ssf = ssf;
+	}
 	op->o_ssf = ( op->o_sasl_ssf > op->o_tls_ssf )
 		?  op->o_sasl_ssf : op->o_tls_ssf;