ITS#4237: don't update sc_prev after a callback has been freed

diff --git a/CHANGES b/CHANGES
index e4e06d5c6ec50c7ec264cf73974c4ad495d8b5b3..4e142ce8c35959d183a7c0a390699f998f10de3a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
 OpenLDAP 2.3 Change Log
+       Fixed slapd sc_prev update after free bug (ITS#4237)
        Fixed slapd-meta sizelimit disclose issue (ITS#4213)
+       Fixed slapd assertion control restrictions
 
 OpenLDAP 2.3.13 Release
        Fixed libldap/liblutil MSG_ACCRIGHTSLEN bug (ITS#4206)

diff --git a/servers/slapd/result.c b/servers/slapd/result.c
index 29bdb2ff7e098d08624b5a96b9fbfa8a7a88d5ac..2636d51d6b769a522bd34763233437f9d14e70ae 100644 (file)
--- a/servers/slapd/result.c
+++ b/servers/slapd/result.c
@@ -308,11 +308,13 @@ send_ldap_response(
                for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
                        sc_next = op->o_callback->sc_next;
                        if ( op->o_callback->sc_response ) {
+                               slap_callback *sc2 = op->o_callback;
                                rc = op->o_callback->sc_response( op, rs );
-                               if ( op->o_callback != *sc_prev ) {
+                               if ( op->o_callback != sc2 ) {
                                        *sc_prev = op->o_callback;
                                }
                                if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+                               if ( op->o_callback != sc2 ) continue;
                        }
                        sc_prev = &op->o_callback->sc_next;
                }
@@ -461,11 +463,13 @@ clean2:;
                for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
                        sc_next = op->o_callback->sc_next;
                        if ( op->o_callback->sc_cleanup ) {
+                               slap_callback *sc2 = op->o_callback;
                                (void)op->o_callback->sc_cleanup( op, rs );
-                               if ( op->o_callback != *sc_prev ) {
+                               if ( op->o_callback != sc2 ) {
                                        *sc_prev = op->o_callback;
                                }
                                if ( !op->o_callback ) break;
+                               if ( op->o_callback != sc2 ) continue;
                        }
                        sc_prev = &op->o_callback->sc_next;
                }
@@ -718,11 +722,13 @@ slap_send_search_entry( Operation *op, SlapReply *rs )
                {
                        sc_next = op->o_callback->sc_next;
                        if ( op->o_callback->sc_response ) {
+                               slap_callback *sc2 = op->o_callback;
                                rc = op->o_callback->sc_response( op, rs );
-                               if ( op->o_callback != *sc_prev ) {
+                               if ( op->o_callback != sc2 ) {
                                        *sc_prev = op->o_callback;
                                }
                                if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+                               if ( op->o_callback != sc2 ) continue;
                        }
                        sc_prev = &op->o_callback->sc_next;
                }
@@ -1172,11 +1178,13 @@ error_return:;
                for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
                        sc_next = op->o_callback->sc_next;
                        if ( op->o_callback->sc_cleanup ) {
+                               slap_callback *sc2 = op->o_callback;
                                (void)op->o_callback->sc_cleanup( op, rs );
-                               if ( op->o_callback != *sc_prev ) {
+                               if ( op->o_callback != sc2 ) {
                                        *sc_prev = op->o_callback;
                                }
                                if ( !op->o_callback ) break;
+                               if ( op->o_callback != sc2 ) continue;
                        }
                        sc_prev = &op->o_callback->sc_next;
                }
@@ -1230,11 +1238,13 @@ slap_send_search_reference( Operation *op, SlapReply *rs )
                for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
                        sc_next = op->o_callback->sc_next;
                        if ( op->o_callback->sc_response ) {
+                               slap_callback *sc2 = op->o_callback;
                                rc = op->o_callback->sc_response( op, rs );
-                               if ( op->o_callback != *sc_prev ) {
+                               if ( op->o_callback != sc2 ) {
                                        *sc_prev = op->o_callback;
                                }
                                if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+                               if ( op->o_callback != sc2 ) continue;
                        }
                        sc_prev = &op->o_callback->sc_next;
                }
@@ -1371,11 +1381,13 @@ rel:
                for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
                        sc_next = op->o_callback->sc_next;
                        if ( op->o_callback->sc_cleanup ) {
+                               slap_callback *sc2 = op->o_callback;
                                (void)op->o_callback->sc_cleanup( op, rs );
-                               if ( op->o_callback != *sc_prev ) {
+                               if ( op->o_callback != sc2 ) {
                                        *sc_prev = op->o_callback;
                                }
                                if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+                               if ( op->o_callback != sc2 ) continue;
                        }
                        sc_prev = &op->o_callback->sc_next;
                }