ITS#3914 bug was very close to that leak: rwm_dnattr_rewrite() already freed the...

diff --git a/servers/slapd/overlays/rwm.c b/servers/slapd/overlays/rwm.c
index 19c18add906687ad16e8a7f03d43b1fc54743124..ebe9815438794af469b9c0120ba30b9f642120ae 100644 (file)
--- a/servers/slapd/overlays/rwm.c
+++ b/servers/slapd/overlays/rwm.c
@@ -368,7 +368,10 @@ rwm_op_compare( Operation *op, SlapReply *rs )
                        }
 
                        if ( mapped_vals[ 0 ].bv_val != op->orc_ava->aa_value.bv_val ) {
-                               ber_bvreplace_x( &op->orc_ava->aa_value, &mapped_vals[0],
+                               /* NOTE: if we get here, rwm_dnattr_rewrite()
+                                * already freed the old value, so now 
+                                * it's invalid */
+                               ber_dupbv_x( &op->orc_ava->aa_value, &mapped_vals[0],
                                                op->o_tmpmemctx );
                                ber_memfree_x( mapped_vals[ 0 ].bv_val, NULL );
                        }