1 files changed, 9 insertions, 0 deletions

diff --git a/usr.sbin/ypldap/ber.c b/usr.sbin/ypldap/ber.c
index 540df69ae760..f73ecef86641 100644
--- a/usr.sbin/ypldap/ber.c
+++ b/usr.sbin/ypldap/ber.c
@@ -1083,6 +1083,15 @@ ber_read_element(struct ber *ber, struct ber_element *elm)
 	DPRINTF("ber read element size %zd\n", len);
 	totlen += r + len;
 
+	/*
+	 * If using an external buffer and the total size of the element
+	 * is larger, then the external buffer don't bother to continue.
+	 */
+	if (ber->fd == -1 && len > ber->br_rend - ber->br_rptr) {
+		errno = ECANCELED;
+		return -1;
+	}
+
 	elm->be_type = type;
 	elm->be_len = len;
 	elm->be_class = class;