From 2ba2fe354026aa4d60ab06fbc9b6ac1e56d1b92f Mon Sep 17 00:00:00 2001 From: Alhuda Khan Date: Thu, 16 Jul 2026 22:03:35 +0530 Subject: [PATCH] ldap: base64-encode LDIF values beginning with colon or less-than A value whose first byte is ':' or '<' is not a SAFE-INIT-CHAR per RFC 2849 and must be base64-encoded, but ldap_value_needs_base64() and the inline check in oldap_recv() only encoded on a control byte or leading/trailing blank. Such a value was emitted verbatim, producing LDIF that strict parsers reject. Closes #22339 --- lib/ldap.c | 6 ++++-- lib/openldap.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/ldap.c b/lib/ldap.c index 350bd17377..2676f732bb 100644 --- a/lib/ldap.c +++ b/lib/ldap.c @@ -238,8 +238,10 @@ static bool ldap_value_needs_base64(const char *attr, size_t attr_len, if((attr_len > 7) && curl_strequal(";binary", attr + attr_len - 7)) return TRUE; - /* check for leading or trailing whitespace */ - if(val->bv_len && (ISBLANK(val->bv_val[0]) || + /* check for a leading ':' or '<' (not a SAFE-INIT-CHAR per RFC 2849) or + leading or trailing whitespace */ + if(val->bv_len && ((val->bv_val[0] == ':') || (val->bv_val[0] == '<') || + ISBLANK(val->bv_val[0]) || ISBLANK(val->bv_val[val->bv_len - 1]))) return TRUE; diff --git a/lib/openldap.c b/lib/openldap.c index 8ce4758d62..887336e5ca 100644 --- a/lib/openldap.c +++ b/lib/openldap.c @@ -1206,9 +1206,11 @@ static CURLcode oldap_recv(struct Curl_easy *data, int8_t sockindex, char *buf, break; if(!binary) { - /* check for leading or trailing whitespace */ + /* check for a leading ':' or '<' (not a SAFE-INIT-CHAR per RFC + 2849) or leading or trailing whitespace */ if(bvals[i].bv_len && - (ISBLANK(bvals[i].bv_val[0]) || + ((bvals[i].bv_val[0] == ':') || (bvals[i].bv_val[0] == '<') || + ISBLANK(bvals[i].bv_val[0]) || ISBLANK(bvals[i].bv_val[bvals[i].bv_len - 1]))) binval = TRUE; else {