Changeset 988 for vendor/current/libcli/ldap

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/libcli/ldap

Files:

• ldap_message.c (modified) (57 diffs)
• ldap_message.h (modified) (3 diffs)
• ldap_ndr.c (modified) (1 diff)
• wscript_build (modified) (1 diff)

vendor/current/libcli/ldap/ldap_message.c

@@ -230 +230 @@
         case LDB_OP_AND:
         case LDB_OP_OR:
-                asn1_push_tag(data, ASN1_CONTEXT(tree->operation==LDB_OP_AND?0:1));
+                if (!asn1_push_tag(data, ASN1_CONTEXT(tree->operation==LDB_OP_AND?0:1))) return false;
                 for (i=0; i<tree->u.list.num_elements; i++) {
                         if (!ldap_push_filter(data, tree->u.list.elements[i])) {
@@ -236 +236 @@
                         }
                 }
-                asn1_pop_tag(data);
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
         case LDB_OP_NOT:
-                asn1_push_tag(data, ASN1_CONTEXT(2));
+                if (!asn1_push_tag(data, ASN1_CONTEXT(2))) return false;
                 if (!ldap_push_filter(data, tree->u.isnot.child)) {
                         return false;
                 }
-                asn1_pop_tag(data);
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
         case LDB_OP_EQUALITY:
                 /* equality test */
-                asn1_push_tag(data, ASN1_CONTEXT(3));
-                asn1_write_OctetString(data, tree->u.equality.attr,
-                                      strlen(tree->u.equality.attr));
-                asn1_write_OctetString(data, tree->u.equality.value.data,
-                                      tree->u.equality.value.length);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_CONTEXT(3))) return false;
+                if (!asn1_write_OctetString(data, tree->u.equality.attr,
+                                      strlen(tree->u.equality.attr))) return false;
+                if (!asn1_write_OctetString(data, tree->u.equality.value.data,
+                                      tree->u.equality.value.length)) return false;
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
@@ -267 +267 @@
                                   final   [2] LDAPString } }
                 */
-                asn1_push_tag(data, ASN1_CONTEXT(4));
-                asn1_write_OctetString(data, tree->u.substring.attr, strlen(tree->u.substring.attr));
-                asn1_push_tag(data, ASN1_SEQUENCE(0));
-                i = 0;
-                if ( ! tree->u.substring.start_with_wildcard) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
-                        asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i]);
-                        asn1_pop_tag(data);
-                        i++;
-                }
-                while (tree->u.substring.chunks[i]) {
-                        int ctx;
-
-                        if (( ! tree->u.substring.chunks[i + 1]) &&
-                            (tree->u.substring.end_with_wildcard == 0)) {
-                                ctx = 2;
-                        } else {
-                                ctx = 1;
-                        }
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(ctx));
-                        asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i]);
-                        asn1_pop_tag(data);
-                        i++;
-                }
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_CONTEXT(4))) return false;
+                if (!asn1_write_OctetString(data, tree->u.substring.attr, strlen(tree->u.substring.attr))) return false;
+                if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) return false;
+
+                if (tree->u.substring.chunks && tree->u.substring.chunks[0]) {
+                        i = 0;
+                        if (!tree->u.substring.start_with_wildcard) {
+                                if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) return false;
+                                if (!asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i])) return false;
+                                if (!asn1_pop_tag(data)) return false;
+                                i++;
+                        }
+                        while (tree->u.substring.chunks[i]) {
+                                int ctx;
+
+                                if (( ! tree->u.substring.chunks[i + 1]) &&
+                                    (tree->u.substring.end_with_wildcard == 0)) {
+                                        ctx = 2;
+                                } else {
+                                        ctx = 1;
+                                }
+                                if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(ctx))) return false;
+                                if (!asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i])) return false;
+                                if (!asn1_pop_tag(data)) return false;
+                                i++;
+                        }
+                }
+                if (!asn1_pop_tag(data)) return false;
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
         case LDB_OP_GREATER:
                 /* greaterOrEqual test */
-                asn1_push_tag(data, ASN1_CONTEXT(5));
-                asn1_write_OctetString(data, tree->u.comparison.attr,
-                                      strlen(tree->u.comparison.attr));
-                asn1_write_OctetString(data, tree->u.comparison.value.data,
-                                      tree->u.comparison.value.length);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_CONTEXT(5))) return false;
+                if (!asn1_write_OctetString(data, tree->u.comparison.attr,
+                                      strlen(tree->u.comparison.attr))) return false;
+                if (!asn1_write_OctetString(data, tree->u.comparison.value.data,
+                                      tree->u.comparison.value.length)) return false;
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
         case LDB_OP_LESS:
                 /* lessOrEqual test */
-                asn1_push_tag(data, ASN1_CONTEXT(6));
-                asn1_write_OctetString(data, tree->u.comparison.attr,
-                                      strlen(tree->u.comparison.attr));
-                asn1_write_OctetString(data, tree->u.comparison.value.data,
-                                      tree->u.comparison.value.length);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_CONTEXT(6))) return false;
+                if (!asn1_write_OctetString(data, tree->u.comparison.attr,
+                                      strlen(tree->u.comparison.attr))) return false;
+                if (!asn1_write_OctetString(data, tree->u.comparison.value.data,
+                                      tree->u.comparison.value.length)) return false;
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
         case LDB_OP_PRESENT:
                 /* present test */
-                asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(7));
-                asn1_write_LDAPString(data, tree->u.present.attr);
-                asn1_pop_tag(data);
-                return !data->has_error;
+                if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(7))) return false;
+                if (!asn1_write_LDAPString(data, tree->u.present.attr)) return false;
+                if (!asn1_pop_tag(data)) return false;
+                return !asn1_has_error(data);
 
         case LDB_OP_APPROX:
                 /* approx test */
-                asn1_push_tag(data, ASN1_CONTEXT(8));
-                asn1_write_OctetString(data, tree->u.comparison.attr,
-                                      strlen(tree->u.comparison.attr));
-                asn1_write_OctetString(data, tree->u.comparison.value.data,
-                                      tree->u.comparison.value.length);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_CONTEXT(8))) return false;
+                if (!asn1_write_OctetString(data, tree->u.comparison.attr,
+                                      strlen(tree->u.comparison.attr))) return false;
+                if (!asn1_write_OctetString(data, tree->u.comparison.value.data,
+                                      tree->u.comparison.value.length)) return false;
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
@@ -341 +344 @@
                   }
                 */
-                asn1_push_tag(data, ASN1_CONTEXT(9));
+                if (!asn1_push_tag(data, ASN1_CONTEXT(9))) return false;
                 if (tree->u.extended.rule_id) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1));
-                        asn1_write_LDAPString(data, tree->u.extended.rule_id);
-                        asn1_pop_tag(data);
+                        if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1))) return false;
+                        if (!asn1_write_LDAPString(data, tree->u.extended.rule_id)) return false;
+                        if (!asn1_pop_tag(data)) return false;
                 }
                 if (tree->u.extended.attr) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(2));
-                        asn1_write_LDAPString(data, tree->u.extended.attr);
-                        asn1_pop_tag(data);
-                }
-                asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(3));
-                asn1_write_DATA_BLOB_LDAPString(data, &tree->u.extended.value);
-                asn1_pop_tag(data);
-                asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(4));
-                asn1_write_uint8(data, tree->u.extended.dnAttributes);
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
+                        if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(2))) return false;
+                        if (!asn1_write_LDAPString(data, tree->u.extended.attr)) return false;
+                        if (!asn1_pop_tag(data)) return false;
+                }
+                if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(3))) return false;
+                if (!asn1_write_DATA_BLOB_LDAPString(data, &tree->u.extended.value)) return false;
+                if (!asn1_pop_tag(data)) return false;
+                if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(4))) return false;
+                if (!asn1_write_uint8(data, tree->u.extended.dnAttributes)) return false;
+                if (!asn1_pop_tag(data)) return false;
+                if (!asn1_pop_tag(data)) return false;
                 break;
 
@@ -364 +367 @@
                 return false;
         }
-        return !data->has_error;
-}
-
-static void ldap_encode_response(struct asn1_data *data, struct ldap_Result *result)
-{
-        asn1_write_enumerated(data, result->resultcode);
-        asn1_write_OctetString(data, result->dn,
-                               (result->dn) ? strlen(result->dn) : 0);
-        asn1_write_OctetString(data, result->errormessage,
+        return !asn1_has_error(data);
+}
+
+static bool ldap_encode_response(struct asn1_data *data, struct ldap_Result *result)
+{
+        if (!asn1_write_enumerated(data, result->resultcode)) return false;
+        if (!asn1_write_OctetString(data, result->dn,
+                               (result->dn) ? strlen(result->dn) : 0)) return false;
+        if (!asn1_write_OctetString(data, result->errormessage,
                                (result->errormessage) ?
-                               strlen(result->errormessage) : 0);
+                               strlen(result->errormessage) : 0)) return false;
         if (result->referral) {
-                asn1_push_tag(data, ASN1_CONTEXT(3));
-                asn1_write_OctetString(data, result->referral,
-                                       strlen(result->referral));
-                asn1_pop_tag(data);
-        }
+                if (!asn1_push_tag(data, ASN1_CONTEXT(3))) return false;
+                if (!asn1_write_OctetString(data, result->referral,
+                                       strlen(result->referral))) return false;
+                if (!asn1_pop_tag(data)) return false;
+        }
+        return true;
 }
 
@@ -392 +396 @@
         if (!data) return false;
 
-        asn1_push_tag(data, ASN1_SEQUENCE(0));
-        asn1_write_Integer(data, msg->messageid);
+        if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
+        if (!asn1_write_Integer(data, msg->messageid)) goto err;
 
         switch (msg->type) {
         case LDAP_TAG_BindRequest: {
                 struct ldap_BindRequest *r = &msg->r.BindRequest;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_Integer(data, r->version);
-                asn1_write_OctetString(data, r->dn,
-                                       (r->dn != NULL) ? strlen(r->dn) : 0);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_Integer(data, r->version)) goto err;
+                if (!asn1_write_OctetString(data, r->dn,
+                                       (r->dn != NULL) ? strlen(r->dn) : 0)) goto err;
 
                 switch (r->mechanism) {
                 case LDAP_AUTH_MECH_SIMPLE:
                         /* context, primitive */
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
-                        asn1_write(data, r->creds.password,
-                                   strlen(r->creds.password));
-                        asn1_pop_tag(data);
+                        if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto err;
+                        if (!asn1_write(data, r->creds.password,
+                                   strlen(r->creds.password))) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
                         break;
                 case LDAP_AUTH_MECH_SASL:
                         /* context, constructed */
-                        asn1_push_tag(data, ASN1_CONTEXT(3));
-                        asn1_write_OctetString(data, r->creds.SASL.mechanism,
-                                               strlen(r->creds.SASL.mechanism));
+                        if (!asn1_push_tag(data, ASN1_CONTEXT(3))) goto err;
+                        if (!asn1_write_OctetString(data, r->creds.SASL.mechanism,
+                                               strlen(r->creds.SASL.mechanism))) goto err;
                         if (r->creds.SASL.secblob) {
-                                asn1_write_OctetString(data, r->creds.SASL.secblob->data,
-                                                       r->creds.SASL.secblob->length);
-                        }
-                        asn1_pop_tag(data);
+                                if (!asn1_write_OctetString(data, r->creds.SASL.secblob->data,
+                                                       r->creds.SASL.secblob->length)) goto err;
+                        }
+                        if (!asn1_pop_tag(data)) goto err;
                         break;
                 default:
-                        return false;
-                }
-
-                asn1_pop_tag(data);
+                        goto err;
+                }
+
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_BindResponse: {
                 struct ldap_BindResponse *r = &msg->r.BindResponse;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, &r->response);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, &r->response)) goto err;
                 if (r->SASL.secblob) {
-                        asn1_write_ContextSimple(data, 7, r->SASL.secblob);
-                }
-                asn1_pop_tag(data);
+                        if (!asn1_write_ContextSimple(data, 7, r->SASL.secblob)) goto err;
+                }
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_UnbindRequest: {
 /*              struct ldap_UnbindRequest *r = &msg->r.UnbindRequest; */
-                asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type));
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type))) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_SearchRequest: {
                 struct ldap_SearchRequest *r = &msg->r.SearchRequest;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_OctetString(data, r->basedn, strlen(r->basedn));
-                asn1_write_enumerated(data, r->scope);
-                asn1_write_enumerated(data, r->deref);
-                asn1_write_Integer(data, r->sizelimit);
-                asn1_write_Integer(data, r->timelimit);
-                asn1_write_BOOLEAN(data, r->attributesonly);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_OctetString(data, r->basedn, strlen(r->basedn))) goto err;
+                if (!asn1_write_enumerated(data, r->scope)) goto err;
+                if (!asn1_write_enumerated(data, r->deref)) goto err;
+                if (!asn1_write_Integer(data, r->sizelimit)) goto err;
+                if (!asn1_write_Integer(data, r->timelimit)) goto err;
+                if (!asn1_write_BOOLEAN(data, r->attributesonly)) goto err;
 
                 if (!ldap_push_filter(data, r->tree)) {
-                        return false;
-                }
-
-                asn1_push_tag(data, ASN1_SEQUENCE(0));
+                        goto err;
+                }
+
+                if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
                 for (i=0; i<r->num_attributes; i++) {
-                        asn1_write_OctetString(data, r->attributes[i],
-                                               strlen(r->attributes[i]));
-                }
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
+                        if (!asn1_write_OctetString(data, r->attributes[i],
+                                               strlen(r->attributes[i]))) goto err;
+                }
+                if (!asn1_pop_tag(data)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_SearchResultEntry: {
                 struct ldap_SearchResEntry *r = &msg->r.SearchResultEntry;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_OctetString(data, r->dn, strlen(r->dn));
-                asn1_push_tag(data, ASN1_SEQUENCE(0));
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
+                if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
                 for (i=0; i<r->num_attributes; i++) {
                         struct ldb_message_element *attr = &r->attributes[i];
-                        asn1_push_tag(data, ASN1_SEQUENCE(0));
-                        asn1_write_OctetString(data, attr->name,
-                                               strlen(attr->name));
-                        asn1_push_tag(data, ASN1_SEQUENCE(1));
+                        if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
+                        if (!asn1_write_OctetString(data, attr->name,
+                                               strlen(attr->name))) goto err;
+                        if (!asn1_push_tag(data, ASN1_SEQUENCE(1))) goto err;
                         for (j=0; j<attr->num_values; j++) {
-                                asn1_write_OctetString(data,
+                                if (!asn1_write_OctetString(data,
                                                        attr->values[j].data,
-                                                       attr->values[j].length);
-                        }
-                        asn1_pop_tag(data);
-                        asn1_pop_tag(data);
-                }
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
+                                                       attr->values[j].length)) goto err;
+                        }
+                        if (!asn1_pop_tag(data)) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
+                }
+                if (!asn1_pop_tag(data)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_SearchResultDone: {
                 struct ldap_Result *r = &msg->r.SearchResultDone;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, r);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, r)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_ModifyRequest: {
                 struct ldap_ModifyRequest *r = &msg->r.ModifyRequest;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_OctetString(data, r->dn, strlen(r->dn));
-                asn1_push_tag(data, ASN1_SEQUENCE(0));
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
+                if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
 
                 for (i=0; i<r->num_mods; i++) {
                         struct ldb_message_element *attrib = &r->mods[i].attrib;
-                        asn1_push_tag(data, ASN1_SEQUENCE(0));
-                        asn1_write_enumerated(data, r->mods[i].type);
-                        asn1_push_tag(data, ASN1_SEQUENCE(0));
-                        asn1_write_OctetString(data, attrib->name,
-                                               strlen(attrib->name));
-                        asn1_push_tag(data, ASN1_SET);
+                        if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
+                        if (!asn1_write_enumerated(data, r->mods[i].type)) goto err;
+                        if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
+                        if (!asn1_write_OctetString(data, attrib->name,
+                                               strlen(attrib->name))) goto err;
+                        if (!asn1_push_tag(data, ASN1_SET)) goto err;
                         for (j=0; j<attrib->num_values; j++) {
-                                asn1_write_OctetString(data,
+                                if (!asn1_write_OctetString(data,
                                                        attrib->values[j].data,
-                                                       attrib->values[j].length);
+                                                       attrib->values[j].length)) goto err;
         
                         }
-                        asn1_pop_tag(data);
-                        asn1_pop_tag(data);
-                        asn1_pop_tag(data);
+                        if (!asn1_pop_tag(data)) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
                 }
                 
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
+                if (!asn1_pop_tag(data)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_ModifyResponse: {
                 struct ldap_Result *r = &msg->r.ModifyResponse;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, r);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, r)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_AddRequest: {
                 struct ldap_AddRequest *r = &msg->r.AddRequest;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_OctetString(data, r->dn, strlen(r->dn));
-                asn1_push_tag(data, ASN1_SEQUENCE(0));
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
+                if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
 
                 for (i=0; i<r->num_attributes; i++) {
                         struct ldb_message_element *attrib = &r->attributes[i];
-                        asn1_push_tag(data, ASN1_SEQUENCE(0));
-                        asn1_write_OctetString(data, attrib->name,
-                                               strlen(attrib->name));
-                        asn1_push_tag(data, ASN1_SET);
+                        if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
+                        if (!asn1_write_OctetString(data, attrib->name,
+                                               strlen(attrib->name))) goto err;
+                        if (!asn1_push_tag(data, ASN1_SET)) goto err;
                         for (j=0; j<r->attributes[i].num_values; j++) {
-                                asn1_write_OctetString(data,
+                                if (!asn1_write_OctetString(data,
                                                        attrib->values[j].data,
-                                                       attrib->values[j].length);
-                        }
-                        asn1_pop_tag(data);
-                        asn1_pop_tag(data);
-                }
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
+                                                       attrib->values[j].length)) goto err;
+                        }
+                        if (!asn1_pop_tag(data)) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
+                }
+                if (!asn1_pop_tag(data)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_AddResponse: {
                 struct ldap_Result *r = &msg->r.AddResponse;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, r);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, r)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_DelRequest: {
                 struct ldap_DelRequest *r = &msg->r.DelRequest;
-                asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type));
-                asn1_write(data, r->dn, strlen(r->dn));
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type))) goto err;
+                if (!asn1_write(data, r->dn, strlen(r->dn))) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_DelResponse: {
                 struct ldap_Result *r = &msg->r.DelResponse;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, r);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, r)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_ModifyDNRequest: {
                 struct ldap_ModifyDNRequest *r = &msg->r.ModifyDNRequest;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_OctetString(data, r->dn, strlen(r->dn));
-                asn1_write_OctetString(data, r->newrdn, strlen(r->newrdn));
-                asn1_write_BOOLEAN(data, r->deleteolddn);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
+                if (!asn1_write_OctetString(data, r->newrdn, strlen(r->newrdn))) goto err;
+                if (!asn1_write_BOOLEAN(data, r->deleteolddn)) goto err;
                 if (r->newsuperior) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
-                        asn1_write(data, r->newsuperior,
-                                   strlen(r->newsuperior));
-                        asn1_pop_tag(data);
-                }
-                asn1_pop_tag(data);
+                        if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto err;
+                        if (!asn1_write(data, r->newsuperior,
+                                   strlen(r->newsuperior))) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
+                }
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_ModifyDNResponse: {
                 struct ldap_Result *r = &msg->r.ModifyDNResponse;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, r);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, r)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_CompareRequest: {
                 struct ldap_CompareRequest *r = &msg->r.CompareRequest;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_OctetString(data, r->dn, strlen(r->dn));
-                asn1_push_tag(data, ASN1_SEQUENCE(0));
-                asn1_write_OctetString(data, r->attribute,
-                                       strlen(r->attribute));
-                asn1_write_OctetString(data, r->value.data,
-                                       r->value.length);
-                asn1_pop_tag(data);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
+                if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
+                if (!asn1_write_OctetString(data, r->attribute,
+                                       strlen(r->attribute))) goto err;
+                if (!asn1_write_OctetString(data, r->value.data,
+                                       r->value.length)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_CompareResponse: {
                 struct ldap_Result *r = &msg->r.ModifyDNResponse;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, r);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, r)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_AbandonRequest: {
                 struct ldap_AbandonRequest *r = &msg->r.AbandonRequest;
-                asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type));
-                asn1_write_implicit_Integer(data, r->messageid);
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type))) goto err;
+                if (!asn1_write_implicit_Integer(data, r->messageid)) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_SearchResultReference: {
                 struct ldap_SearchResRef *r = &msg->r.SearchResultReference;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_write_OctetString(data, r->referral, strlen(r->referral));
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_write_OctetString(data, r->referral, strlen(r->referral))) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_ExtendedRequest: {
                 struct ldap_ExtendedRequest *r = &msg->r.ExtendedRequest;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0));
-                asn1_write(data, r->oid, strlen(r->oid));
-                asn1_pop_tag(data);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto err;
+                if (!asn1_write(data, r->oid, strlen(r->oid))) goto err;
+                if (!asn1_pop_tag(data)) goto err;
                 if (r->value) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1));
-                        asn1_write(data, r->value->data, r->value->length);
-                        asn1_pop_tag(data);
-                }
-                asn1_pop_tag(data);
+                        if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1))) goto err;
+                        if (!asn1_write(data, r->value->data, r->value->length)) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
+                }
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         case LDAP_TAG_ExtendedResponse: {
                 struct ldap_ExtendedResponse *r = &msg->r.ExtendedResponse;
-                asn1_push_tag(data, ASN1_APPLICATION(msg->type));
-                ldap_encode_response(data, &r->response);
+                if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
+                if (!ldap_encode_response(data, &r->response)) goto err;
                 if (r->oid) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(10));
-                        asn1_write(data, r->oid, strlen(r->oid));
-                        asn1_pop_tag(data);
+                        if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(10))) goto err;
+                        if (!asn1_write(data, r->oid, strlen(r->oid))) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
                 }
                 if (r->value) {
-                        asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(11));
-                        asn1_write(data, r->value->data, r->value->length);
-                        asn1_pop_tag(data);
-                }
-                asn1_pop_tag(data);
+                        if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(11))) goto err;
+                        if (!asn1_write(data, r->value->data, r->value->length)) goto err;
+                        if (!asn1_pop_tag(data)) goto err;
+                }
+                if (!asn1_pop_tag(data)) goto err;
                 break;
         }
         default:
-                return false;
+                goto err;
         }
 
         if (msg->controls != NULL) {
-                asn1_push_tag(data, ASN1_CONTEXT(0));
+                if (!asn1_push_tag(data, ASN1_CONTEXT(0))) goto err;
                 
                 for (i = 0; msg->controls[i] != NULL; i++) {
@@ -677 +681 @@
                                                  control_handlers,
                                                  msg->controls[i])) {
-                                DEBUG(1,("Unable to encode control %s\n",
+                                DEBUG(0,("Unable to encode control %s\n",
                                          msg->controls[i]->oid));
-                                return false;
-                        }
-                }
-
-                asn1_pop_tag(data);
-        }
-
-        asn1_pop_tag(data);
-
-        if (data->has_error) {
-                asn1_free(data);
-                return false;
-        }
-
-        *result = data_blob_talloc(mem_ctx, data->data, data->length);
+                                goto err;
+                        }
+                }
+
+                if (!asn1_pop_tag(data)) goto err;
+        }
+
+        if (!asn1_pop_tag(data)) goto err;
+
+        if (!asn1_extract_blob(data, mem_ctx, result)) {
+                goto err;
+        }
+
         asn1_free(data);
+
         return true;
+
+  err:
+
+        asn1_free(data);
+        return false;
 }
 
@@ -702 +710 @@
 {
         char *result = talloc_array(mem_ctx, char, blob.length+1);
+        if (result == NULL) {
+                return NULL;
+        }
         memcpy(result, blob.data, blob.length);
         result[blob.length] = '\0';
@@ -716 +727 @@
         *result = blob2string_talloc(mem_ctx, string);
         data_blob_free(&string);
-        return true;
-}
-
-static void ldap_decode_response(TALLOC_CTX *mem_ctx,
+        return *result ? true : false;
+}
+
+static bool ldap_decode_response(TALLOC_CTX *mem_ctx,
                                  struct asn1_data *data,
                                  struct ldap_Result *result)
 {
-        asn1_read_enumerated(data, &result->resultcode);
-        asn1_read_OctetString_talloc(mem_ctx, data, &result->dn);
-        asn1_read_OctetString_talloc(mem_ctx, data, &result->errormessage);
+        if (!asn1_read_enumerated(data, &result->resultcode)) return false;
+        if (!asn1_read_OctetString_talloc(mem_ctx, data, &result->dn)) return false;
+        if (!asn1_read_OctetString_talloc(mem_ctx, data, &result->errormessage)) return false;
         if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
-                asn1_start_tag(data, ASN1_CONTEXT(3));
-                asn1_read_OctetString_talloc(mem_ctx, data, &result->referral);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, ASN1_CONTEXT(3))) return false;
+                if (!asn1_read_OctetString_talloc(mem_ctx, data, &result->referral)) return false;
+                if (!asn1_end_tag(data)) return false;
         } else {
                 result->referral = NULL;
         }
+        return true;
 }
 
@@ -754 +766 @@
         chunks[chunk_num]->length = strlen(value);
 
-        chunks[chunk_num + 1] = '\0';
+        chunks[chunk_num + 1] = NULL;
 
         return chunks;
@@ -833 +845 @@
                 DATA_BLOB value;
 
-                asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
-                asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-                asn1_read_OctetString(data, mem_ctx, &value);
-                asn1_end_tag(data);
-                if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
+                if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
+                if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
+                if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
+                if (!asn1_end_tag(data)) goto failed;
+                if (asn1_has_error(data) || (attrib == NULL) ||
+                    (value.data == NULL)) {
                         goto failed;
                 }
@@ -863 +876 @@
                 ret->operation = LDB_OP_SUBSTRING;
                 ret->u.substring.attr = talloc_strndup(ret, (char *)attr.data, attr.length);
+                if (ret->u.substring.attr == NULL) {
+                        goto failed;
+                }
                 ret->u.substring.chunks = NULL;
                 ret->u.substring.start_with_wildcard = 1;
@@ -872 +888 @@
 
                 while (asn1_tag_remaining(data)) {
-                        asn1_peek_uint8(data, &subs_tag);
+                        if (!asn1_peek_uint8(data, &subs_tag)) goto failed;
                         subs_tag &= 0x1f;       /* strip off the asn1 stuff */
                         if (subs_tag > 2) goto failed;
 
-                        asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(subs_tag));
-                        asn1_read_LDAPString(data, mem_ctx, &value);
-                        asn1_end_tag(data);
+                        if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(subs_tag))) goto failed;
+                        if (!asn1_read_LDAPString(data, mem_ctx, &value)) goto failed;
+                        if (!asn1_end_tag(data)) goto failed;
 
                         switch (subs_tag) {
@@ -945 +961 @@
                 DATA_BLOB value;
 
-                asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
-                asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-                asn1_read_OctetString(data, mem_ctx, &value);
-                asn1_end_tag(data);
-                if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
+                if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
+                if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
+                if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
+                if (!asn1_end_tag(data)) goto failed;
+                if (asn1_has_error(data) || (attrib == NULL) ||
+                    (value.data == NULL)) {
                         goto failed;
                 }
@@ -964 +981 @@
                 DATA_BLOB value;
 
-                asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
-                asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-                asn1_read_OctetString(data, mem_ctx, &value);
-                asn1_end_tag(data);
-                if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
+                if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
+                if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
+                if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
+                if (!asn1_end_tag(data)) goto failed;
+                if (asn1_has_error(data) || (attrib == NULL) ||
+                    (value.data == NULL)) {
                         goto failed;
                 }
@@ -1002 +1020 @@
                 DATA_BLOB value;
 
-                asn1_start_tag(data, ASN1_CONTEXT(filter_tag));
-                asn1_read_OctetString_talloc(mem_ctx, data, &attrib);
-                asn1_read_OctetString(data, mem_ctx, &value);
-                asn1_end_tag(data);
-                if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) {
+                if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
+                if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
+                if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
+                if (!asn1_end_tag(data)) goto failed;
+                if (asn1_has_error(data) || (attrib == NULL) ||
+                    (value.data == NULL)) {
                         goto failed;
                 }
@@ -1028 +1047 @@
                 /* either oid or type must be defined */
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(1))) { /* optional */
-                        asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(1));
-                        asn1_read_LDAPString(data, ret, &oid);
-                        asn1_end_tag(data);
+                        if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(1))) goto failed;
+                        if (!asn1_read_LDAPString(data, ret, &oid)) goto failed;
+                        if (!asn1_end_tag(data)) goto failed;
                 }
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(2))) {      /* optional  */
-                        asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(2));
-                        asn1_read_LDAPString(data, ret, &attr);
-                        asn1_end_tag(data);
-                }
-                asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(3));
-                asn1_read_LDAPString(data, ret, &value);
-                asn1_end_tag(data);
+                        if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(2))) goto failed;
+                        if (!asn1_read_LDAPString(data, ret, &attr)) goto failed;
+                        if (!asn1_end_tag(data)) goto failed;
+                }
+                if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(3))) goto failed;
+                if (!asn1_read_LDAPString(data, ret, &value)) goto failed;
+                if (!asn1_end_tag(data)) goto failed;
                 /* dnAttributes is marked as BOOLEAN DEFAULT FALSE
                    it is not marked as OPTIONAL but openldap tools
@@ -1047 +1066 @@
                    boolean value to be set */
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(4))) {
-                        asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(4));
-                        asn1_read_uint8(data, &dnAttributes);
-                        asn1_end_tag(data);
+                        if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(4))) goto failed;
+                        if (!asn1_read_uint8(data, &dnAttributes)) goto failed;
+                        if (!asn1_end_tag(data)) goto failed;
                 } else {
                         dnAttributes = 0;
@@ -1068 +1087 @@
                         } else {
                                 ret->u.extended.attr = talloc_strdup(ret, "*");
+                                if (ret->u.extended.attr == NULL) {
+                                        goto failed;
+                                }
                         }
                         ret->u.extended.rule_id      = talloc_steal(ret, oid);
@@ -1097 +1119 @@
 
 /* Decode a single LDAP attribute, possibly containing multiple values */
-static void ldap_decode_attrib(TALLOC_CTX *mem_ctx, struct asn1_data *data,
+static bool ldap_decode_attrib(TALLOC_CTX *mem_ctx, struct asn1_data *data,
                                struct ldb_message_element *attrib)
 {
-        asn1_start_tag(data, ASN1_SEQUENCE(0));
-        asn1_read_OctetString_talloc(mem_ctx, data, &attrib->name);
-        asn1_start_tag(data, ASN1_SET);
+        if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) return false;
+        if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib->name)) return false;
+        if (!asn1_start_tag(data, ASN1_SET)) return false;
         while (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
                 DATA_BLOB blob;
-                asn1_read_OctetString(data, mem_ctx, &blob);
+                if (!asn1_read_OctetString(data, mem_ctx, &blob)) return false;
                 add_value_to_attrib(mem_ctx, &blob, attrib);
         }
-        asn1_end_tag(data);
-        asn1_end_tag(data);
-        
+        if (!asn1_end_tag(data)) return false;
+        return asn1_end_tag(data);
 }
 
 /* Decode a set of LDAP attributes, as found in the dereference control */
-void ldap_decode_attribs_bare(TALLOC_CTX *mem_ctx, struct asn1_data *data,
+bool ldap_decode_attribs_bare(TALLOC_CTX *mem_ctx, struct asn1_data *data,
                               struct ldb_message_element **attributes,
                               int *num_attributes)
@@ -1121 +1142 @@
                 struct ldb_message_element attrib;
                 ZERO_STRUCT(attrib);
-                ldap_decode_attrib(mem_ctx, data, &attrib);
+                if (!ldap_decode_attrib(mem_ctx, data, &attrib)) return false;
                 add_attrib_to_array_talloc(mem_ctx, &attrib,
                                            attributes, num_attributes);
         }
+        return true;
 }
 
 /* Decode a set of LDAP attributes, as found in a search entry */
-static void ldap_decode_attribs(TALLOC_CTX *mem_ctx, struct asn1_data *data,
+static bool ldap_decode_attribs(TALLOC_CTX *mem_ctx, struct asn1_data *data,
                                 struct ldb_message_element **attributes,
                                 int *num_attributes)
 {
-        asn1_start_tag(data, ASN1_SEQUENCE(0));
-        ldap_decode_attribs_bare(mem_ctx, data, 
-                                 attributes, num_attributes);
-        asn1_end_tag(data);
+        if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) return false;
+        if (!ldap_decode_attribs_bare(mem_ctx, data,
+                                 attributes, num_attributes)) return false;
+        return asn1_end_tag(data);
 }
 
@@ -1146 +1168 @@
         uint8_t tag;
 
-        asn1_start_tag(data, ASN1_SEQUENCE(0));
-        asn1_read_Integer(data, &msg->messageid);
-
-        if (!asn1_peek_uint8(data, &tag))
-                return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+        if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
+        if (!asn1_read_Integer(data, &msg->messageid)) goto prot_err;
+
+        if (!asn1_peek_uint8(data, &tag)) goto prot_err;
 
         switch(tag) {
@@ -1157 +1178 @@
                 struct ldap_BindRequest *r = &msg->r.BindRequest;
                 msg->type = LDAP_TAG_BindRequest;
-                asn1_start_tag(data, tag);
-                asn1_read_Integer(data, &r->version);
-                asn1_read_OctetString_talloc(msg, data, &r->dn);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!asn1_read_Integer(data, &r->version)) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(0))) {
                         int pwlen;
                         r->creds.password = "";
                         r->mechanism = LDAP_AUTH_MECH_SIMPLE;
-                        asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0));
+                        if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto prot_err;
                         pwlen = asn1_tag_remaining(data);
                         if (pwlen == -1) {
-                                return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+                                goto prot_err;
                         }
                         if (pwlen != 0) {
@@ -1174 +1195 @@
                                         return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
                                 }
-                                asn1_read(data, pw, pwlen);
+                                if (!asn1_read(data, pw, pwlen)) goto prot_err;
                                 pw[pwlen] = '\0';
                                 r->creds.password = pw;
                         }
-                        asn1_end_tag(data);
+                        if (!asn1_end_tag(data)) goto prot_err;
                 } else if (asn1_peek_tag(data, ASN1_CONTEXT(3))){
-                        asn1_start_tag(data, ASN1_CONTEXT(3));
+                        if (!asn1_start_tag(data, ASN1_CONTEXT(3))) goto prot_err;
                         r->mechanism = LDAP_AUTH_MECH_SASL;
-                        asn1_read_OctetString_talloc(msg, data, &r->creds.SASL.mechanism);
+                        if (!asn1_read_OctetString_talloc(msg, data, &r->creds.SASL.mechanism)) goto prot_err;
                         if (asn1_peek_tag(data, ASN1_OCTET_STRING)) { /* optional */
                                 DATA_BLOB tmp_blob = data_blob(NULL, 0);
-                                asn1_read_OctetString(data, msg, &tmp_blob);
+                                if (!asn1_read_OctetString(data, msg, &tmp_blob)) goto prot_err;
                                 r->creds.SASL.secblob = talloc(msg, DATA_BLOB);
                                 if (!r->creds.SASL.secblob) {
@@ -1196 +1217 @@
                                 r->creds.SASL.secblob = NULL;
                         }
-                        asn1_end_tag(data);
+                        if (!asn1_end_tag(data)) goto prot_err;
                 } else {
                         /* Neither Simple nor SASL bind */
-                        return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
-                }
-                asn1_end_tag(data);
+                        goto prot_err;
+                }
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1208 +1229 @@
                 struct ldap_BindResponse *r = &msg->r.BindResponse;
                 msg->type = LDAP_TAG_BindResponse;
-                asn1_start_tag(data, tag);
-                ldap_decode_response(msg, data, &r->response);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, &r->response)) goto prot_err;
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(7))) {
                         DATA_BLOB tmp_blob = data_blob(NULL, 0);
-                        asn1_read_ContextSimple(data, 7, &tmp_blob);
+                        if (!asn1_read_ContextSimple(data, 7, &tmp_blob)) goto prot_err;
                         r->SASL.secblob = talloc(msg, DATA_BLOB);
                         if (!r->SASL.secblob) {
@@ -1223 +1244 @@
                         r->SASL.secblob = NULL;
                 }
-                asn1_end_tag(data);
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1229 +1250 @@
         case ASN1_APPLICATION_SIMPLE(LDAP_TAG_UnbindRequest): {
                 msg->type = LDAP_TAG_UnbindRequest;
-                asn1_start_tag(data, tag);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1239 +1260 @@
                 const char **attrs = NULL;
                 msg->type = LDAP_TAG_SearchRequest;
-                asn1_start_tag(data, tag);
-                asn1_read_OctetString_talloc(msg, data, &r->basedn);
-                asn1_read_enumerated(data, (int *)(void *)&(r->scope));
-                asn1_read_enumerated(data, (int *)(void *)&(r->deref));
-                asn1_read_Integer(data, &sizelimit);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->basedn)) goto prot_err;
+                if (!asn1_read_enumerated(data, (int *)(void *)&(r->scope))) goto prot_err;
+                if (!asn1_read_enumerated(data, (int *)(void *)&(r->deref))) goto prot_err;
+                if (!asn1_read_Integer(data, &sizelimit)) goto prot_err;
                 r->sizelimit = sizelimit;
-                asn1_read_Integer(data, &timelimit);
+                if (!asn1_read_Integer(data, &timelimit)) goto prot_err;
                 r->timelimit = timelimit;
-                asn1_read_BOOLEAN(data, &r->attributesonly);
+                if (!asn1_read_BOOLEAN(data, &r->attributesonly)) goto prot_err;
 
                 r->tree = ldap_decode_filter_tree(msg, data);
                 if (r->tree == NULL) {
-                        return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
-                }
-
-                asn1_start_tag(data, ASN1_SEQUENCE(0));
+                        goto prot_err;
+                }
+
+                if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
 
                 r->num_attributes = 0;
                 r->attributes = NULL;
 
-                while (asn1_tag_remaining(data) > 0) {                                  
+                while (asn1_tag_remaining(data) > 0) {
 
                         const char *attr;
                         if (!asn1_read_OctetString_talloc(msg, data,
                                                           &attr))
-                                return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+                                goto prot_err;
                         if (!add_string_to_array(msg, attr,
                                                  &attrs,
                                                  &r->num_attributes))
-                                return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+                                goto prot_err;
                 }
                 r->attributes = attrs;
 
-                asn1_end_tag(data);
-                asn1_end_tag(data);
+                if (!asn1_end_tag(data)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1282 +1303 @@
                 r->attributes = NULL;
                 r->num_attributes = 0;
-                asn1_start_tag(data, tag);
-                asn1_read_OctetString_talloc(msg, data, &r->dn);
-                ldap_decode_attribs(msg, data, &r->attributes,
-                                    &r->num_attributes);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
+                if (!ldap_decode_attribs(msg, data, &r->attributes,
+                                    &r->num_attributes)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1293 +1314 @@
                 struct ldap_Result *r = &msg->r.SearchResultDone;
                 msg->type = LDAP_TAG_SearchResultDone;
-                asn1_start_tag(data, tag);
-                ldap_decode_response(msg, data, r);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, r)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1302 +1323 @@
                 struct ldap_SearchResRef *r = &msg->r.SearchResultReference;
                 msg->type = LDAP_TAG_SearchResultReference;
-                asn1_start_tag(data, tag);
-                asn1_read_OctetString_talloc(msg, data, &r->referral);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->referral)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1311 +1332 @@
                 struct ldap_ModifyRequest *r = &msg->r.ModifyRequest;
                 msg->type = LDAP_TAG_ModifyRequest;
-                asn1_start_tag(data, ASN1_APPLICATION(LDAP_TAG_ModifyRequest));
-                asn1_read_OctetString_talloc(msg, data, &r->dn);
-                asn1_start_tag(data, ASN1_SEQUENCE(0));
+                if (!asn1_start_tag(data, ASN1_APPLICATION(LDAP_TAG_ModifyRequest))) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
+                if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
 
                 r->num_mods = 0;
@@ -1322 +1343 @@
                         int v;
                         ZERO_STRUCT(mod);
-                        asn1_start_tag(data, ASN1_SEQUENCE(0));
-                        asn1_read_enumerated(data, &v);
+                        if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
+                        if (!asn1_read_enumerated(data, &v)) goto prot_err;
                         mod.type = v;
-                        ldap_decode_attrib(msg, data, &mod.attrib);
-                        asn1_end_tag(data);
+                        if (!ldap_decode_attrib(msg, data, &mod.attrib)) goto prot_err;
+                        if (!asn1_end_tag(data)) goto prot_err;
                         if (!add_mod_to_array_talloc(msg, &mod,
                                                      &r->mods, &r->num_mods)) {
@@ -1333 +1354 @@
                 }
 
-                asn1_end_tag(data);
-                asn1_end_tag(data);
+                if (!asn1_end_tag(data)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1341 +1362 @@
                 struct ldap_Result *r = &msg->r.ModifyResponse;
                 msg->type = LDAP_TAG_ModifyResponse;
-                asn1_start_tag(data, tag);
-                ldap_decode_response(msg, data, r);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, r)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1350 +1371 @@
                 struct ldap_AddRequest *r = &msg->r.AddRequest;
                 msg->type = LDAP_TAG_AddRequest;
-                asn1_start_tag(data, tag);
-                asn1_read_OctetString_talloc(msg, data, &r->dn);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
 
                 r->attributes = NULL;
                 r->num_attributes = 0;
-                ldap_decode_attribs(msg, data, &r->attributes,
-                                    &r->num_attributes);
-
-                asn1_end_tag(data);
+                if (!ldap_decode_attribs(msg, data, &r->attributes,
+                                    &r->num_attributes)) goto prot_err;
+
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1365 +1386 @@
                 struct ldap_Result *r = &msg->r.AddResponse;
                 msg->type = LDAP_TAG_AddResponse;
-                asn1_start_tag(data, tag);
-                ldap_decode_response(msg, data, r);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, r)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1376 +1397 @@
                 char *dn;
                 msg->type = LDAP_TAG_DelRequest;
-                asn1_start_tag(data,
-                               ASN1_APPLICATION_SIMPLE(LDAP_TAG_DelRequest));
+                if (!asn1_start_tag(data,
+                               ASN1_APPLICATION_SIMPLE(LDAP_TAG_DelRequest))) goto prot_err;
                 len = asn1_tag_remaining(data);
                 if (len == -1) {
-                        return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+                        goto prot_err;
                 }
                 dn = talloc_array(msg, char, len+1);
                 if (dn == NULL)
                         break;
-                asn1_read(data, dn, len);
+                if (!asn1_read(data, dn, len)) goto prot_err;
                 dn[len] = '\0';
                 r->dn = dn;
-                asn1_end_tag(data);
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1395 +1416 @@
                 struct ldap_Result *r = &msg->r.DelResponse;
                 msg->type = LDAP_TAG_DelResponse;
-                asn1_start_tag(data, tag);
-                ldap_decode_response(msg, data, r);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, r)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1404 +1425 @@
                 struct ldap_ModifyDNRequest *r = &msg->r.ModifyDNRequest;
                 msg->type = LDAP_TAG_ModifyDNRequest;
-                asn1_start_tag(data,
-                               ASN1_APPLICATION(LDAP_TAG_ModifyDNRequest));
-                asn1_read_OctetString_talloc(msg, data, &r->dn);
-                asn1_read_OctetString_talloc(msg, data, &r->newrdn);
-                asn1_read_BOOLEAN(data, &r->deleteolddn);
+                if (!asn1_start_tag(data,
+                               ASN1_APPLICATION(LDAP_TAG_ModifyDNRequest))) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->newrdn)) goto prot_err;
+                if (!asn1_read_BOOLEAN(data, &r->deleteolddn)) goto prot_err;
                 r->newsuperior = NULL;
                 if (asn1_tag_remaining(data) > 0) {
                         int len;
                         char *newsup;
-                        asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0));
+                        if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto prot_err;
                         len = asn1_tag_remaining(data);
                         if (len == -1) {
-                                return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+                                goto prot_err;
                         }
                         newsup = talloc_array(msg, char, len+1);
@@ -1422 +1443 @@
                                 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
                         }
-                        asn1_read(data, newsup, len);
+                        if (!asn1_read(data, newsup, len)) goto prot_err;
                         newsup[len] = '\0';
                         r->newsuperior = newsup;
-                        asn1_end_tag(data);
-                }
-                asn1_end_tag(data);
+                        if (!asn1_end_tag(data)) goto prot_err;
+                }
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1434 +1455 @@
                 struct ldap_Result *r = &msg->r.ModifyDNResponse;
                 msg->type = LDAP_TAG_ModifyDNResponse;
-                asn1_start_tag(data, tag);
-                ldap_decode_response(msg, data, r);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, r)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1443 +1464 @@
                 struct ldap_CompareRequest *r = &msg->r.CompareRequest;
                 msg->type = LDAP_TAG_CompareRequest;
-                asn1_start_tag(data,
-                               ASN1_APPLICATION(LDAP_TAG_CompareRequest));
-                asn1_read_OctetString_talloc(msg, data, &r->dn);
-                asn1_start_tag(data, ASN1_SEQUENCE(0));
-                asn1_read_OctetString_talloc(msg, data, &r->attribute);
-                asn1_read_OctetString(data, msg, &r->value);
+                if (!asn1_start_tag(data,
+                               ASN1_APPLICATION(LDAP_TAG_CompareRequest))) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
+                if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
+                if (!asn1_read_OctetString_talloc(msg, data, &r->attribute)) goto prot_err;
+                if (!asn1_read_OctetString(data, msg, &r->value)) goto prot_err;
                 if (r->value.data) {
                         talloc_steal(msg, r->value.data);
                 }
-                asn1_end_tag(data);
-                asn1_end_tag(data);
+                if (!asn1_end_tag(data)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1460 +1481 @@
                 struct ldap_Result *r = &msg->r.CompareResponse;
                 msg->type = LDAP_TAG_CompareResponse;
-                asn1_start_tag(data, tag);
-                ldap_decode_response(msg, data, r);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, r)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1469 +1490 @@
                 struct ldap_AbandonRequest *r = &msg->r.AbandonRequest;
                 msg->type = LDAP_TAG_AbandonRequest;
-                asn1_start_tag(data, tag);
-                asn1_read_implicit_Integer(data, &r->messageid);
-                asn1_end_tag(data);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!asn1_read_implicit_Integer(data, &r->messageid)) goto prot_err;
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1480 +1501 @@
 
                 msg->type = LDAP_TAG_ExtendedRequest;
-                asn1_start_tag(data,tag);
+                if (!asn1_start_tag(data,tag)) goto prot_err;
                 if (!asn1_read_ContextSimple(data, 0, &tmp_blob)) {
-                        return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+                        goto prot_err;
                 }
                 r->oid = blob2string_talloc(msg, tmp_blob);
@@ -1491 +1512 @@
 
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(1))) {
-                        asn1_read_ContextSimple(data, 1, &tmp_blob);
+                        if (!asn1_read_ContextSimple(data, 1, &tmp_blob)) goto prot_err;
                         r->value = talloc(msg, DATA_BLOB);
                         if (!r->value) {
@@ -1502 +1523 @@
                 }
 
-                asn1_end_tag(data);
+                if (!asn1_end_tag(data)) goto prot_err;
                 break;
         }
@@ -1511 +1532 @@
 
                 msg->type = LDAP_TAG_ExtendedResponse;
-                asn1_start_tag(data, tag);              
-                ldap_decode_response(msg, data, &r->response);
+                if (!asn1_start_tag(data, tag)) goto prot_err;
+                if (!ldap_decode_response(msg, data, &r->response)) goto prot_err;
 
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(10))) {
-                        asn1_read_ContextSimple(data, 1, &tmp_blob);
+                        if (!asn1_read_ContextSimple(data, 1, &tmp_blob)) goto prot_err;
                         r->oid = blob2string_talloc(msg, tmp_blob);
                         data_blob_free(&tmp_blob);
@@ -1526 +1547 @@
 
                 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(11))) {
-                        asn1_read_ContextSimple(data, 1, &tmp_blob);
+                        if (!asn1_read_ContextSimple(data, 1, &tmp_blob)) goto prot_err;
                         r->value = talloc(msg, DATA_BLOB);
                         if (!r->value) {
@@ -1537 +1558 @@
                 }
 
-                asn1_end_tag(data);
-                break;
-        }
-        default: 
-                return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+                if (!asn1_end_tag(data)) goto prot_err;
+                break;
+        }
+        default:
+                goto prot_err;
         }
 
@@ -1552 +1573 @@
                 bool *decoded = NULL;
 
-                asn1_start_tag(data, ASN1_CONTEXT(0));
+                if (!asn1_start_tag(data, ASN1_CONTEXT(0))) goto prot_err;
 
                 while (asn1_peek_tag(data, ASN1_SEQUENCE(0))) {
@@ -1573 +1594 @@
                         }
 
-                        if (!ldap_decode_control_wrapper(ctrl, data, ctrl[i], &value)) {
-                                return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
-                        }
-                        
-                        if (!ldap_decode_control_value(ctrl, value,
+                        if (!ldap_decode_control_wrapper(ctrl[i], data, ctrl[i], &value)) {
+                                goto prot_err;
+                        }
+
+                        if (!ldap_decode_control_value(ctrl[i], value,
                                                        control_handlers,
                                                        ctrl[i])) {
@@ -1601 +1622 @@
                 msg->controls_decoded = decoded;
 
-                asn1_end_tag(data);
-        }
-
-        asn1_end_tag(data);
-        if ((data->has_error) || (data->nesting != NULL)) {
+                if (!asn1_end_tag(data)) goto prot_err;
+        }
+
+        if (!asn1_end_tag(data)) goto prot_err;
+        if (asn1_has_error(data) || asn1_has_nesting(data)) {
                 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
         }
         return NT_STATUS_OK;
+
+  prot_err:
+
+        return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
 }
 
@@ -1618 +1643 @@
 NTSTATUS ldap_full_packet(void *private_data, DATA_BLOB blob, size_t *packet_size)
 {
+        int ret;
+
         if (blob.length < 6) {
                 /*
@@ -1625 +1652 @@
                 return STATUS_MORE_ENTRIES;
         }
-        return asn1_peek_full_tag(blob, ASN1_SEQUENCE(0), packet_size);
-}
+
+        ret = asn1_peek_full_tag(blob, ASN1_SEQUENCE(0), packet_size);
+        if (ret != 0) {
+                return map_nt_error_from_unix_common(ret);
+        }
+        return NT_STATUS_OK;
+}

vendor/current/libcli/ldap/ldap_message.h

@@ -23 +23 @@
 
 #include "../libcli/ldap/ldap_errors.h"
-#if _SAMBA_BUILD_ == 3
-#include "lib/ldb_compat.h"
-#else
 #include <ldb.h>
-#endif
 
 enum ldap_request_tag {
@@ -109 +105 @@
         bool attributesonly;
         struct ldb_parse_tree *tree;
-        int num_attributes;
+        size_t num_attributes;
         const char * const *attributes;
 };
@@ -233 +229 @@
                                   const char **result);
 
-void ldap_decode_attribs_bare(TALLOC_CTX *mem_ctx, struct asn1_data *data,
+bool ldap_decode_attribs_bare(TALLOC_CTX *mem_ctx, struct asn1_data *data,
                               struct ldb_message_element **attributes,
                               int *num_attributes);

vendor/current/libcli/ldap/ldap_ndr.c

@@ -22 +22 @@
 
 #include "includes.h"
-#if _SAMBA_BUILD_ == 3
-#include "lib/ldb_compat.h"
-#else
 #include <ldb.h>
-#endif
 #include "librpc/gen_ndr/ndr_security.h"
 #include "librpc/gen_ndr/ndr_misc.h"

vendor/current/libcli/ldap/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
 
-bld.SAMBA_SUBSYSTEM('LIBCLI_LDAP_MESSAGE',
-        source='ldap_message.c',
-        public_deps='errors talloc ldb',
-        public_headers='ldap_message.h ldap_errors.h',
-        deps='samba-util ASN1_UTIL'
-        )
-
-
-bld.SAMBA_SUBSYSTEM('LIBCLI_LDAP_NDR',
-        source='ldap_ndr.c',
-        public_deps='errors talloc',
-        public_headers='ldap_ndr.h',
-        deps='samba-util ldb NDR_SECURITY tevent'
-        )
-
+bld.SAMBA_LIBRARY('cli-ldap-common',
+                  source='ldap_message.c ldap_ndr.c',
+                  public_deps='samba-errors talloc ldb',
+                  private_headers='ldap_message.h ldap_errors.h ldap_ndr.h',
+                  deps='samba-util asn1util NDR_SECURITY tevent',
+                  private_library=True)