From 3e95d9ca62e442faa0f14eea9b5cb4d1068449f7 Mon Sep 17 00:00:00 2001
From: Armaan Sandhu <armaan.sandhu0504@gmail.com>
Date: Tue, 20 Oct 2026 21:23:27 -0400
Subject: [PATCH] parse_ldif: keep the full length when joining folded lines

When a folded LDIF line was appended to the saved portion, len was left as the length of the continuation alone. A second continuation was then saved with that short length and copied over the middle of the attribute, so a value folded over three or more lines was corrupted, e.g. "sudoCommand: /usr/bin/sys", " temctl rest", " art httpd" became "sudoCommandart httpd" and was rejected as an invalid LDIF attribute.

Add the saved length to len after the append, and add a cvtsudoers regression test.
---
 MANIFEST                                      |  2 ++
 plugins/sudoers/parse_ldif.c                  |  1 +
 .../sudoers/regress/cvtsudoers/test42.out.ok  |  2 ++
 plugins/sudoers/regress/cvtsudoers/test42.sh  | 20 +++++++++++++++++++
 4 files changed, 25 insertions(+)
 create mode 100644 plugins/sudoers/regress/cvtsudoers/test42.out.ok
 create mode 100644 plugins/sudoers/regress/cvtsudoers/test42.sh

diff --git a/MANIFEST b/MANIFEST
index a2f440049d..7ab33389e4 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -866,6 +866,8 @@ plugins/sudoers/regress/cvtsudoers/test40.out.ok
 plugins/sudoers/regress/cvtsudoers/test40.sh
 plugins/sudoers/regress/cvtsudoers/test41.out.ok
 plugins/sudoers/regress/cvtsudoers/test41.sh
+plugins/sudoers/regress/cvtsudoers/test42.out.ok
+plugins/sudoers/regress/cvtsudoers/test42.sh
 plugins/sudoers/regress/cvtsudoers/test5.out.ok
 plugins/sudoers/regress/cvtsudoers/test5.sh
 plugins/sudoers/regress/cvtsudoers/test6.out.ok
diff --git a/plugins/sudoers/parse_ldif.c b/plugins/sudoers/parse_ldif.c
index ecc7a26031..7169ac4358 100644
--- a/plugins/sudoers/parse_ldif.c
+++ b/plugins/sudoers/parse_ldif.c
@@ -654,6 +654,7 @@ sudoers_parse_ldif(struct sudoers_parse_tree *parse_tree,
 	    memcpy(tmp + savedlen, line, (size_t)len + 1);
 	    free(line);
 	    line = tmp;
+	    len += (ssize_t)savedlen;
 	    savedline = NULL;
 	}
 
diff --git a/plugins/sudoers/regress/cvtsudoers/test42.out.ok b/plugins/sudoers/regress/cvtsudoers/test42.out.ok
new file mode 100644
index 0000000000..80bdb8c2e5
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test42.out.ok
@@ -0,0 +1,2 @@
+# sudoRole millert
+millert ALL = /usr/bin/systemctl restart httpd, /usr/bin/ls
diff --git a/plugins/sudoers/regress/cvtsudoers/test42.sh b/plugins/sudoers/regress/cvtsudoers/test42.sh
new file mode 100644
index 0000000000..c2c437487c
--- /dev/null
+++ b/plugins/sudoers/regress/cvtsudoers/test42.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+#
+# Test an LDIF attribute folded over more than two lines.
+#
+
+: ${CVTSUDOERS=cvtsudoers}
+
+$CVTSUDOERS -c "" -i ldif -b "ou=SUDOers,dc=sudo,dc=ws" -f sudoers <<EOF
+dn: cn=millert,ou=SUDOers,dc=sudo,dc=ws
+objectClass: top
+objectClass: sudoRole
+cn: millert
+sudoUser: millert
+sudoHost: ALL
+sudoCommand: /usr/bin/sys
+ temctl rest
+ art httpd
+sudoCommand: /usr/bin/ls
+
+EOF