reset o_next pointer before freeing the operation (otherwise an assertion

failure in slap_op_free is possible)

diff --git a/servers/slapd/abandon.c b/servers/slapd/abandon.c
index bc37a00f61accd6d85ab6b38f080c090d6e80879..d6f8181933c88df7fa1c93fd5ef7657e93a25fef 100644 (file)
--- a/servers/slapd/abandon.c
+++ b/servers/slapd/abandon.c
@@ -103,6 +103,7 @@ do_abandon( Operation *op, SlapReply *rs )
                if ( o->o_msgid == id ) {
                        LDAP_STAILQ_REMOVE( &op->o_conn->c_pending_ops,
                                o, slap_op, o_next );
+                       LDAP_STAILQ_NEXT(o, o_next) = NULL;
                        op->o_conn->c_n_ops_pending--;
                        slap_op_free( o );
                        goto done;

diff --git a/servers/slapd/cancel.c b/servers/slapd/cancel.c
index 005dbba0b27e75f9983610d06a8077257a1705fc..b1d8023e823feb4fcbd9a1879738bf428cdcb8a0 100644 (file)
--- a/servers/slapd/cancel.c
+++ b/servers/slapd/cancel.c
@@ -66,6 +66,7 @@ int cancel_extop( Operation *op, SlapReply *rs )
        LDAP_STAILQ_FOREACH( o, &op->o_conn->c_pending_ops, o_next ) {
                if ( o->o_msgid == opid ) {
                        LDAP_STAILQ_REMOVE( &op->o_conn->c_pending_ops, o, slap_op, o_next );
+                       LDAP_STAILQ_NEXT(o, o_next) = NULL;
                        op->o_conn->c_n_ops_pending--;
                        slap_op_free( o );
                        found = 1;