2 files changed, 20 insertions, 0 deletions
diff --git a/source4/lib/ldb/tools/ldbedit.c b/source4/lib/ldb/tools/ldbedit.c
index 36d054e563..aaf6d80352 100644
--- a/source4/lib/ldb/tools/ldbedit.c
+++ b/source4/lib/ldb/tools/ldbedit.c
@@ -281,6 +281,21 @@ static int do_edit(struct ldb_context *ldb, struct ldb_message **msgs1,
 		msgs2[count2++] = ldif->msg;
 	}
 
+	/* the feof() test works here, even for the last line of the
+	 * file, as we parse ldif files character by character, and
+	 * feof() is only true if we have failed to read a character
+	 * from the file. So if the last line is bad, we don't get
+	 * feof() set, so we know the record was bad. Only if we
+	 * attempt to go to the next record will we get feof() and
+	 * thus consider that the ldif has ended without errors
+	 */
+	if (!feof(f)) {
+		fprintf(stderr, "Error parsing ldif - aborting\n");
+		fclose(f);
+		unlink(file_template);
+		return -1;
+	}
+
 	fclose(f);
 	unlink(file_template);
 
diff --git a/source4/lib/ldb/tools/ldbmodify.c b/source4/lib/ldb/tools/ldbmodify.c
index 1484bbf655..1374765f57 100644
--- a/source4/lib/ldb/tools/ldbmodify.c
+++ b/source4/lib/ldb/tools/ldbmodify.c
@@ -87,6 +87,11 @@ static int process_file(struct ldb_context *ldb, FILE *f, unsigned int *count)
 		ldb_ldif_read_free(ldb, ldif);
 	}
 
+	if (!feof(f)) {
+		fprintf(stderr, "Failed to parse ldif\n");
+		return -1;
+	}
+
 	return ret;
 }