By using a multivalued nested RDN (e.g. attr: "cn=a+sn=b",dc=com" through function slapi_dn_normalize_ext(), an attacker is able to overruns the destination buffer of this function. Inside INQUOTEDVALUE, the parser tracks the nested AVs in subrdn_avs[] keyed by subtypestart. On the closing '"' the state
moves to B4SEPARATOR without finalizing that tracking. The next
outer separator then calls add_rdn_av(subtypestart, d, ...) with a
stale subtypestart and an advanced d, producing a berval that
overlaps a previously stored one. sort_rdn_avs() bubble-sorts these
entries; rdn_av_swap()'s in-place swap assumes "av1 immediately
precedes av2", and the overlap turns its memcpy into an
out-of-bounds write past the dest buffer