ITS#7906 fix ppolicy_connection_destroy

It can still run after ppolicy_close has freed the connection table

diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index f8b73356e617320141819e613266bb44b577f61c..d6b8ac2d1a59dabcb467499efecf8fab42c0ca28 100644 (file)
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -1273,7 +1273,7 @@ ppolicy_bind( Operation *op, SlapReply *rs )
 static int
 ppolicy_connection_destroy( BackendDB *bd, Connection *conn )
 {
-       if ( !BER_BVISEMPTY( &pwcons[conn->c_conn_idx].dn )) {
+       if ( pwcons && !BER_BVISEMPTY( &pwcons[conn->c_conn_idx].dn )) {
                ch_free( pwcons[conn->c_conn_idx].dn.bv_val );
                BER_BVZERO( &pwcons[conn->c_conn_idx].dn );
        }
@@ -2334,9 +2334,10 @@ ppolicy_close(
        /* Perhaps backover should provide bi_destroy hooks... */
        ov_count--;
        if ( ov_count <=0 && pwcons ) {
-               pwcons--;
-               free( pwcons );
+               pw_conn *pwc = pwcons;
                pwcons = NULL;
+               pwc--;
+               ch_free( pwc );
        }
        free( pi->def_policy.bv_val );
        free( pi );