ITS#5813: limits with empty dn mostly do not work

--- limits.c	2008-11-16 08:14:16.000000000 +0100
+++ limits.c	2008-11-16 06:38:12.000000000 +0100
@@ -129,11 +129,11 @@
 		case SLAP_LIMITS_SUBTREE:
 		case SLAP_LIMITS_CHILDREN: {
-			ber_len_t d;
+			ber_len_t d, pat_len = lm[0]->lm_pat.bv_len;
 			
 			/* ndn shorter than lm_pat */
-			if ( ndn->bv_len < lm[0]->lm_pat.bv_len ) {
+			if ( ndn->bv_len < pat_len ) {
 				break;
 			}
-			d = ndn->bv_len - lm[0]->lm_pat.bv_len;
+			d = ndn->bv_len - pat_len;
 
 			if ( d == 0 ) {
@@ -143,6 +143,6 @@
 				}
 			} else {
-				/* check for unescaped rdn separator */
-				if ( !DN_SEPARATOR( ndn->bv_val[d - 1] ) ) {
+				/* check for unescaped rdn separator unless empty lm_pat */
+				if ( !DN_SEPARATOR( ndn->bv_val[d - 1] ) && pat_len != 0 ) {
 					break;
 				}
@@ -156,5 +156,5 @@
 			/* in case of ONE, require exactly one rdn below lm_pat */
 			if ( style == SLAP_LIMITS_ONE ) {
-				if ( dn_rdnlen( NULL, ndn ) != d - 1 ) {
+				if ( dn_rdnlen( NULL, ndn ) < d - 1 ) {
 					break;
 				}
@@ -478,8 +478,16 @@
 				pattern = NULL;
 
-			} else if ( (flags & SLAP_LIMITS_MASK) == SLAP_LIMITS_REGEX
-					&& strcmp( pattern, ".*" ) == 0 ) {
-				flags = SLAP_LIMITS_ANY;
-				pattern = NULL;
+			} else if ( (flags & SLAP_LIMITS_MASK) == SLAP_LIMITS_REGEX ) {
+				if ( strcmp( pattern, ".*" ) == 0 ) {
+					flags = SLAP_LIMITS_ANY;
+					pattern = NULL;
+				}
+
+			} else if ( *pattern == '\0' && (flags & SLAP_LIMITS_TYPE_MASK)
+					== SLAP_LIMITS_TYPE_SELF ) {
+				Debug( LDAP_DEBUG_ANY,
+					"%s : line %d: empty dn.self in limits not supported\n",
+					fname, lineno, 0 );
+				return( -1 );
 			}
 		}