ITS#12 realBase was being freed before use. The offending free()

call has been removed and additional code added to properly free
realBase variable.  Also fixed leaking of the matched variable.

diff --git a/servers/slapd/back-ldbm/search.c b/servers/slapd/back-ldbm/search.c
index 959411b2359eca66ec18f429ce543097b27b22cd..99bebd224817ab11e083c7b7b37317e2c855e611 100644 (file)
--- a/servers/slapd/back-ldbm/search.c
+++ b/servers/slapd/back-ldbm/search.c
@@ -79,7 +79,6 @@ ldbm_back_search(
        switch ( deref ) {
        case LDAP_DEREF_FINDING:
        case LDAP_DEREF_ALWAYS:
-               free (realBase);
                realBase = derefDN ( be, conn, op, base );
                break;
        default:
@@ -110,6 +109,9 @@ ldbm_back_search(
        default:
                send_ldap_result( conn, op, LDAP_PROTOCOL_ERROR, "",
                    "Bad scope" );
+               if( realBase != NULL) {
+                       free( realBase );
+               }
                return( -1 );
        }
 
@@ -119,9 +121,16 @@ ldbm_back_search(
                if ( matched != NULL ) {
                        free( matched );
                }
+               if( realBase != NULL) {
+                       free( realBase );
+               }
                return( -1 );
        }
 
+       if ( matched != NULL ) {
+               free( matched );
+       }
+
        rmaxsize = 0;
        nrefs = 0;
        rbuf = rcur = NULL;
@@ -136,6 +145,9 @@ ldbm_back_search(
                        pthread_mutex_unlock( &op->o_abandonmutex );
                        idl_free( candidates );
                        free( rbuf );
+                       if( realBase != NULL) {
+                               free( realBase );
+                       }
                        return( 0 );
                }
                pthread_mutex_unlock( &op->o_abandonmutex );
@@ -150,6 +162,9 @@ ldbm_back_search(
                            NULL, nentries );
                        idl_free( candidates );
                        free( rbuf );
+                       if( realBase != NULL) {
+                               free( realBase );
+                       }
                        return( 0 );
                }
                pthread_mutex_unlock( &currenttime_mutex );
@@ -274,6 +289,10 @@ ldbm_back_search(
        }
        free( rbuf );
 
+       if( realBase != NULL) {
+               free( realBase );
+       }
+
        return( 0 );
 }