[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: (ITS#6163) back-sql DoS when searching for empty attr

The bug is in the fact that (cn=) is an invalid filter, because cn's
syntax is directoryString, which does not allow the empty string.  As
such, the filter evaluates to undefined, and this is not properly handled
by back-sql.  A fix is in HEAD, please test (you only need to patch
back-sql/search.c and the patch should apply to almost any OpenLDAP 2.4