ITS#7588 fix double-free for sorted paged search

[openldap] / servers / slapd / oc.c

diff --git a/servers/slapd/oc.c b/servers/slapd/oc.c
index ef52fc869585909492cb384eda46dde365cf6814..b3d2d8a37c50483fe11fc1c307dc5849cb16f223 100644 (file)
--- a/servers/slapd/oc.c
+++ b/servers/slapd/oc.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2013 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,16 +37,16 @@ int is_object_subclass(
                sup->soc_oid, sub->soc_oid, sup == sub );
 #endif
 
-       if( sup == sub ) {
+       if ( sup == sub ) {
                return 1;
        }
 
-       if( sub->soc_sups == NULL ) {
+       if ( sub->soc_sups == NULL ) {
                return 0;
        }
 
-       for( i=0; sub->soc_sups[i] != NULL; i++ ) {
-               if( is_object_subclass( sup, sub->soc_sups[i] ) ) {
+       for ( i = 0; sub->soc_sups[i] != NULL; i++ ) {
+               if ( is_object_subclass( sup, sub->soc_sups[i] ) ) {
                        return 1;
                }
        }
@@ -71,11 +71,11 @@ int is_entry_objectclass(
        assert( !( e == NULL || oc == NULL ) );
        assert( ( flags & SLAP_OCF_MASK ) != SLAP_OCF_MASK );
 
-       if( e == NULL || oc == NULL ) {
+       if ( e == NULL || oc == NULL ) {
                return 0;
        }
 
-       if( flags == SLAP_OCF_SET_FLAGS && ( e->e_ocflags & SLAP_OC__END ) )
+       if ( flags == SLAP_OCF_SET_FLAGS && ( e->e_ocflags & SLAP_OC__END ) )
        {
                /* flags are set, use them */
                return (e->e_ocflags & oc->soc_flags & SLAP_OC__MASK) != 0;
@@ -85,17 +85,20 @@ int is_entry_objectclass(
         * find objectClass attribute
         */
        attr = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
-       if( attr == NULL ) {
+       if ( attr == NULL ) {
                /* no objectClass attribute */
                Debug( LDAP_DEBUG_ANY, "is_entry_objectclass(\"%s\", \"%s\") "
                        "no objectClass attribute\n",
                        e->e_dn == NULL ? "" : e->e_dn,
                        oc->soc_oclass.oc_oid, 0 );
 
+               /* mark flags as set */
+               e->e_ocflags |= SLAP_OC__END;
+
                return 0;
        }
 
-       for( bv=attr->a_vals; bv->bv_val; bv++ ) {
+       for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
                ObjectClass *objectClass = oc_bvfind( bv );
 
                if ( objectClass == NULL ) {
@@ -132,7 +135,7 @@ struct oindexrec {
 
 static Avlnode *oc_index = NULL;
 static Avlnode *oc_cache = NULL;
-static LDAP_STAILQ_HEAD(OCList, slap_object_class) oc_list
+static LDAP_STAILQ_HEAD(OCList, ObjectClass) oc_list
        = LDAP_STAILQ_HEAD_INITIALIZER(oc_list);
 
 ObjectClass *oc_sys_tail;
@@ -193,7 +196,7 @@ oc_bvfind( struct berval *ocname )
        return( NULL );
 }
 
-static LDAP_STAILQ_HEAD(OCUList, slap_object_class) oc_undef_list
+static LDAP_STAILQ_HEAD(OCUList, ObjectClass) oc_undef_list
        = LDAP_STAILQ_HEAD_INITIALIZER(oc_undef_list);
 
 ObjectClass *
@@ -227,6 +230,10 @@ oc_bvfind_undef( struct berval *ocname )
        oc->soc_cname.bv_len = ocname->bv_len;
        oc->soc_cname.bv_val = (char *)&oc[ 1 ];
        AC_MEMCPY( oc->soc_cname.bv_val, ocname->bv_val, ocname->bv_len );
+       oc->soc_cname.bv_val[ oc->soc_cname.bv_len ] = '\0';
+
+       /* canonical to upper case */
+       ldap_pvt_str2upper( oc->soc_cname.bv_val );
 
        LDAP_STAILQ_NEXT( oc, soc_next ) = NULL;
        ldap_pvt_thread_mutex_lock( &oc_undef_mutex );
@@ -393,6 +400,8 @@ oc_delete_names( ObjectClass *oc )
 {
        char                    **names = oc->soc_names;
 
+       if (!names) return;
+
        while (*names) {
                struct oindexrec        tmpoir, *oir;
 
@@ -414,7 +423,7 @@ oc_delete( ObjectClass *oc )
 {
        oc->soc_flags |= SLAP_OC_DELETED;
 
-       LDAP_STAILQ_REMOVE(&oc_list,oc,slap_object_class,soc_next);
+       LDAP_STAILQ_REMOVE(&oc_list, oc, ObjectClass, soc_next);
 
        oc_delete_names( oc );
 }
@@ -502,6 +511,10 @@ oc_next( ObjectClass **oc )
        }
 #endif
 
+       if ( *oc == NULL ) {
+               return 0;
+       }
+
        *oc = LDAP_STAILQ_NEXT(*oc,soc_next);
 
        return (*oc != NULL);
@@ -626,6 +639,8 @@ oc_insert(
                assert( oc_bvfind( &oir->oir_name ) != NULL );
        }
 
+       assert( soc != NULL );
+
        if ( (names = soc->soc_names) ) {
                while ( *names ) {
                        oir = (struct oindexrec *)
@@ -634,9 +649,6 @@ oc_insert(
                        oir->oir_name.bv_len = strlen( *names );
                        oir->oir_oc = soc;
 
-                       assert( oir->oir_name.bv_val != NULL );
-                       assert( oir->oir_oc != NULL );
-
                        if ( avl_insert( &oc_index, (caddr_t) oir,
                                oc_index_cmp, avl_dup_error ) )
                        {
@@ -796,6 +808,10 @@ done:;
                        ch_free( soc->soc_allowed );
                }
 
+               if ( soc->soc_oidmacro ) {
+                       ch_free( soc->soc_oidmacro );
+               }
+
                ch_free( soc );
 
        } else if ( rsoc ) {
@@ -892,7 +908,7 @@ oc_schema_info( Entry *e )
 }
 
 int
-register_oc( char *def, ObjectClass **soc, int dupok )
+register_oc( const char *def, ObjectClass **soc, int dupok )
 {
        LDAPObjectClass *oc;
        int code;