Fix null byte in LDAP bindings

diff --git a/ext/ldap/ldap.c b/ext/ldap/ldap.c
index f5583cd8c02c46a11ad45036a1b5d480ac8f3ece..50055a25a75313ae40a9be6652244b695df0b8d0 100644 (file)
--- a/ext/ldap/ldap.c
+++ b/ext/ldap/ldap.c
@@ -405,6 +405,16 @@ PHP_FUNCTION(ldap_bind)
                RETURN_FALSE;
        }
 
+       if (ldap_bind_dn != NULL && memchr(ldap_bind_dn, '\0', ldap_bind_dnlen) != NULL) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "DN contains a null byte");
+               RETURN_FALSE;
+       }
+
+       if (ldap_bind_pw != NULL && memchr(ldap_bind_pw, '\0', ldap_bind_pwlen) != NULL) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Password contains a null byte");
+               RETURN_FALSE;
+       }
+
        ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link);
 
        if ((rc = ldap_bind_s(ld->link, ldap_bind_dn, ldap_bind_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) {