I did this

In lib/openldap.c and lib/ldap.c, an ldap entry is compared as so:

      binary = bv.bv_len > 7 &&
        !strncmp(bv.bv_val + bv.bv_len - 7, ";binary", 7);

https://www.rfc-editor.org/rfc/rfc4522.html states that:

The binary option is indicated with the attribute option string
"binary" in an attribute description. Note that, like all attribute
options, the string representing the binary option is case
insensitive.

In addition to this, the RFC also states that the other of the attribute option string is not important:

The order in which s
appear is irrelevant. That is, any two s that
consist of the same and same set of s are
equivalent.

curl will not pick up the binary attribute, unless it is ordered in the happy-path.

This bug was found with ZeroPath.

I expected the following

case-insensitive binary detection in ldap, unordered attribute scanning

curl/libcurl version

all

operating system

all