ITS#5862

diff --git a/CHANGES b/CHANGES
index 602547a66e877502a94b04b81d73d705205cf380..fa823a0df5bf4bd8773ffb19e07afe649e1e2644 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -28,6 +28,7 @@ OpenLDAP 2.4.24 Engineering
        Fixed ldapsearch segfault with deref (ITS#6638)
        Fixed ldapsearch multiple controls parsing (ITS#6651)
        Fixed slapd acl parsing overflow (ITS#6611)
+       Fixed slapd assert control (ITS#5862)
        Fixed slapd support for BDB 5.0+ (ITS#6698)
        Fixed slapd config leak with olcDbDirectory (ITS#6634)
        Fixed slapd connectionless warnings (ITS#6747)

diff --git a/servers/slapd/search.c b/servers/slapd/search.c
index 88e44e3c45baaf5c646f3733c57feaa5de9f4558..db434ff3ef0615bf3730f65a2a061f02b13ff138 100644 (file)
--- a/servers/slapd/search.c
+++ b/servers/slapd/search.c
@@ -274,6 +274,12 @@ fe_op_search( Operation *op, SlapReply *rs )
                        goto return_results;
 
                } else if ( entry != NULL ) {
+                       if ( get_assert( op ) &&
+                               ( test_filter( op, entry, get_assertion( op )) != LDAP_COMPARE_TRUE )) {
+                               rs->sr_err = LDAP_ASSERTION_FAILED;
+                               goto fail1;
+                       }
+
                        rs->sr_err = test_filter( op, entry, op->ors_filter );
 
                        if( rs->sr_err == LDAP_COMPARE_TRUE ) {
@@ -292,9 +298,9 @@ fe_op_search( Operation *op, SlapReply *rs )
                                rs->sr_entry = NULL;
                                rs->sr_operational_attrs = NULL;
                        }
-                       entry_free( entry );
-
                        rs->sr_err = LDAP_SUCCESS;
+fail1:
+                       entry_free( entry );
                        send_ldap_result( op, rs );
                        goto return_results;
                }