ITS#2549, init memctx to NULL. Also reset ber memctx to NULL when freeing.

diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c
index 90ba3505dbf212507e3f4786577ed5917b329500..1c5281e34064fea235c35fb600c869c0ee404c54 100644 (file)
--- a/servers/slapd/connection.c
+++ b/servers/slapd/connection.c
@@ -892,7 +892,7 @@ connection_operation( void *ctx, void *arg_v )
        ber_tag_t oldtag = tag;
 #endif /* SLAPD_MONITOR */
        Connection *conn = op->o_conn;
-       void *memctx;
+       void *memctx = NULL;
        ber_len_t memsiz;
 
        ldap_pvt_thread_mutex_lock( &num_ops_mutex );
@@ -930,6 +930,10 @@ connection_operation( void *ctx, void *arg_v )
        op->o_tmpmemctx = memctx;
        op->o_tmpmfuncs = &sl_mfuncs;
        if ( tag != LDAP_REQ_ADD && tag != LDAP_REQ_MODIFY ) {
+               /* Note - the ber and its buffer are already allocated from
+                * regular memory; this only affects subsequent mallocs that
+                * ber_scanf may invoke.
+                */
                ber_set_option( op->o_ber, LBER_OPT_BER_MEMCTX, memctx );
        }
 

diff --git a/servers/slapd/operation.c b/servers/slapd/operation.c
index 95e28288b5882ab35f5b0b1596b94d8f410d9107..537263b7d54c0a98b9c6600397bd4099aea20646 100644 (file)
--- a/servers/slapd/operation.c
+++ b/servers/slapd/operation.c
@@ -45,6 +45,10 @@ slap_op_free( Operation *op )
        assert( LDAP_STAILQ_NEXT(op, o_next) == NULL );
 
        if ( op->o_ber != NULL ) {
+               /* Note - the ber and its buffer are in regular memory,
+                * so make sure not to use sl_free here.
+                */
+               ber_set_option( op->o_ber, LBER_OPT_BER_MEMCTX, NULL );
                ber_free( op->o_ber, 1 );
        }
        if ( op->o_dn.bv_val != NULL ) {