LDAPworld P10: SLAPD Index corruption

diff --git a/servers/slapd/back-ldbm/index.c b/servers/slapd/back-ldbm/index.c
index 3d75a091d3166f497ebbc9fa9a58bbff92521014..fd13d7ec079a45b6b5515def0d1afba3ebb8db8f 100644 (file)
--- a/servers/slapd/back-ldbm/index.c
+++ b/servers/slapd/back-ldbm/index.c
@@ -3,7 +3,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <sys/types.h>
-#include <sys/socket.h>
 #include "slap.h"
 #include "back-ldbm.h"
 
@@ -130,25 +129,26 @@ index_read(
        realval = val;
        tmpval = NULL;
        if ( prefix != '\0' ) {
-               int     len;
+              int     len = strlen( val );
 
-               if ( (len = strlen( val )) < sizeof(buf) ) {
-                       buf[0] = prefix;
-                       strcpy( &buf[1], val );
+              if ( (len + 2) < sizeof(buf) ) {
                        realval = buf;
                } else {
                        /* value + prefix + null */
                        tmpval = (char *) ch_malloc( len + 2 );
-                       tmpval[0] = prefix;
-                       strcat( &tmpval[1], val );
                        realval = tmpval;
                }
+              realval[0] = prefix;
+              strcpy( &realval[1], val );
        }
 
        key.dptr = realval;
        key.dsize = strlen( realval ) + 1;
 
        idl = idl_fetch( be, db, key );
+      if ( tmpval != NULL ) {
+              free( tmpval );
+      }
 
        ldbm_cache_close( be, db );
 
@@ -181,19 +181,17 @@ add_value(
        tmpval = NULL;
        idl = NULL;
        if ( prefix != '\0' ) {
-               int     len;
+              int     len = strlen( val );
 
-               if ( (len = strlen( val )) < sizeof(buf) ) {
-                       buf[0] = prefix;
-                       strcpy( &buf[1], val );
+              if ( (len + 2) < sizeof(buf) ) {
                        realval = buf;
                } else {
                        /* value + prefix + null */
                        tmpval = (char *) ch_malloc( len + 2 );
-                       tmpval[0] = prefix;
-                       strcat( &tmpval[1], val );
                        realval = tmpval;
                }
+              realval[0] = prefix;
+              strcpy( &realval[1], val );
        }
 
        key.dptr = realval;