ldap_controls_dup() writes beyond allocated memory (ITS#1898)

[dsteck@novell.com]

Full_Name: David Steck
Version: OPENLDAP_REL_ENG_2_1_2
OS: Windows
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (137.65.133.66)


ldap_controls_dup() allocates an array of LDAPControl pointers.
It doesn't allocate one for the NULL pointer at the end, but writes to it.

Simple patch in libraries\libldap\controls.c:

294c294
<       new = (LDAPControl **) LDAP_MALLOC( i * sizeof(LDAPControl *) );
---
>       new = (LDAPControl **) LDAP_MALLOC( (i+1) * sizeof(LDAPControl *) );