From: Hallvard Furuseth <hallvard@openldap.org>
Date: Thu, 10 Apr 2008 12:54:11 +0000 (+0000)
Subject: ITS#5340 fixes:
X-Git-Tag: OPENLDAP_REL_ENG_2_4_9~20^2~26
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=0669adf635b64175c1e86580201ca623a4416aaa;p=openldap

ITS#5340 fixes:
slap_send_ldap_result() when rs->sr_flags & REP_REF_MUSTBEFREED:
- Do not return with rs->sr_ref == <freed data>, set it to NULL instead.
- Plug memory leak when op->o_domain_scope || op->o_protocol<LDAP_VERSION3.
send_ldap_response():
- Paranoia: Reset REP_MATCHED_MUSTBEFREED and REP_REF_MUSTBEFREED,
  in case the caller reuses the SlapReply without resetting the flags.
---

diff --git a/servers/slapd/result.c b/servers/slapd/result.c
index 795c9272ca..f81ca9f482 100644
--- a/servers/slapd/result.c
+++ b/servers/slapd/result.c
@@ -522,14 +522,20 @@ clean2:;
 		(void)slap_cleanup_play( op, rs );
 	}
 
-	if ( rs->sr_matched && rs->sr_flags & REP_MATCHED_MUSTBEFREED ) {
-		free( (char *)rs->sr_matched );
-		rs->sr_matched = NULL;
+	if ( rs->sr_flags & REP_MATCHED_MUSTBEFREED ) {
+		rs->sr_flags ^= REP_MATCHED_MUSTBEFREED; /* paranoia */
+		if ( rs->sr_matched ) {
+			free( (char *)rs->sr_matched );
+			rs->sr_matched = NULL;
+		}
 	}
 
-	if ( rs->sr_ref && rs->sr_flags & REP_REF_MUSTBEFREED ) {
-		ber_bvarray_free( rs->sr_ref );
-		rs->sr_ref = NULL;
+	if ( rs->sr_flags & REP_REF_MUSTBEFREED ) {
+		rs->sr_flags ^= REP_REF_MUSTBEFREED; /* paranoia */
+		if ( rs->sr_ref ) {
+			ber_bvarray_free( rs->sr_ref );
+			rs->sr_ref = NULL;
+		}
 	}
 
 	return rc;
@@ -625,6 +631,14 @@ slap_send_ldap_result( Operation *op, SlapReply *rs )
 	rs->sr_msgid = (rs->sr_tag != LBER_SEQUENCE) ? op->o_msgid : 0;
 
 abandon:
+	if ( rs->sr_flags & REP_REF_MUSTBEFREED ) {
+		if ( rs->sr_ref == NULL ) {
+			rs->sr_flags ^= REP_REF_MUSTBEFREED;
+			ber_bvarray_free( oref );
+		}
+		oref = NULL; /* send_ldap_response() will free rs->sr_ref if != NULL */
+	}
+
 	if ( send_ldap_response( op, rs ) == SLAP_CB_CONTINUE ) {
 		if ( op->o_tag == LDAP_REQ_SEARCH ) {
 			char nbuf[64];