From 51c2d881ff4f337ae78a359ed4e3efee20dd49fb Mon Sep 17 00:00:00 2001 From: Alhuda Khan Date: Thu, 16 Jul 2026 22:03:35 +0530 Subject: [PATCH] ldap: base64-encode LDIF values beginning with colon or less-than A value whose first byte is ':' or '<' is not a SAFE-INIT-CHAR per RFC 2849 and must be base64-encoded, but ldap_value_needs_base64() and the inline check in oldap_recv() only encoded on a control byte or leading/trailing blank. Such a value was emitted verbatim, producing LDIF that strict parsers reject. --- lib/ldap.c | 6 ++++-- lib/openldap.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/ldap.c b/lib/ldap.c index b4b107a572..7d5441b5a5 100644 --- a/lib/ldap.c +++ b/lib/ldap.c @@ -238,8 +238,10 @@ static bool ldap_value_needs_base64(const char *attr, size_t attr_len, if((attr_len > 7) && curl_strequal(";binary", attr + attr_len - 7)) return TRUE; - /* check for leading or trailing whitespace */ - if(val->bv_len && (ISBLANK(val->bv_val[0]) || + /* check for a leading ':' or '<' (not a SAFE-INIT-CHAR per RFC 2849) or + leading or trailing whitespace */ + if(val->bv_len && ((val->bv_val[0] == ':') || (val->bv_val[0] == '<') || + ISBLANK(val->bv_val[0]) || ISBLANK(val->bv_val[val->bv_len - 1]))) return TRUE; diff --git a/lib/openldap.c b/lib/openldap.c index 6c15734d29..5ae3bb11c0 100644 --- a/lib/openldap.c +++ b/lib/openldap.c @@ -1206,9 +1206,11 @@ static CURLcode oldap_recv(struct Curl_easy *data, int sockindex, char *buf, break; if(!binary) { - /* check for leading or trailing whitespace */ + /* check for a leading ':' or '<' (not a SAFE-INIT-CHAR per RFC + 2849) or leading or trailing whitespace */ if(bvals[i].bv_len && - (ISBLANK(bvals[i].bv_val[0]) || + ((bvals[i].bv_val[0] == ':') || (bvals[i].bv_val[0] == '<') || + ISBLANK(bvals[i].bv_val[0]) || ISBLANK(bvals[i].bv_val[bvals[i].bv_len - 1]))) binval = TRUE; else {