4 byte long length fields are being generated because we're calling ber_alloc() instead of ber_alloc_t(LBER_USE_DER). Discovered by careful perusal of the source and <http://www.mozilla.org/directory/ietf-docs/draft-ietf-ldapext-ldap-c-api-05.txt>. Patch forthcoming.
Created attachment 196049 [details] [diff] [review] change allocation code, v1
Without this fix, LDAP controls generated by the nsILDAPControl code a while ago are invalid. Fortunately, the fix is essentially zero risk, since noone yet depends on these interfaces except for a single customer extension for Thunderbird that Ive done some work on.
Comment on attachment 196049 [details] [diff] [review] change allocation code, v1 approving for the branch. Thanks Dan.
Checked in on the branch.