From: Kurt Zeilenga <kurt@openldap.org>
Date: Tue, 20 Dec 2005 17:13:22 +0000 (+0000)
Subject: ITS#4237: don't update sc_prev after a callback has been freed
X-Git-Tag: OPENLDAP_REL_ENG_2_3_14~53
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=32f19348da5faa4c3cfe6bbf2741108b2a936f86;p=openldap

ITS#4237: don't update sc_prev after a callback has been freed
---

diff --git a/CHANGES b/CHANGES
index e4e06d5c6e..4e142ce8c3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
 OpenLDAP 2.3 Change Log
+	Fixed slapd sc_prev update after free bug (ITS#4237)
 	Fixed slapd-meta sizelimit disclose issue (ITS#4213)
+	Fixed slapd assertion control restrictions
 
 OpenLDAP 2.3.13 Release
 	Fixed libldap/liblutil MSG_ACCRIGHTSLEN bug (ITS#4206)
diff --git a/servers/slapd/result.c b/servers/slapd/result.c
index 29bdb2ff7e..2636d51d6b 100644
--- a/servers/slapd/result.c
+++ b/servers/slapd/result.c
@@ -308,11 +308,13 @@ send_ldap_response(
 		for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
 			sc_next = op->o_callback->sc_next;
 			if ( op->o_callback->sc_response ) {
+				slap_callback *sc2 = op->o_callback;
 				rc = op->o_callback->sc_response( op, rs );
-				if ( op->o_callback != *sc_prev ) {
+				if ( op->o_callback != sc2 ) {
 					*sc_prev = op->o_callback;
 				}
 				if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+				if ( op->o_callback != sc2 ) continue;
 			}
 			sc_prev = &op->o_callback->sc_next;
 		}
@@ -461,11 +463,13 @@ clean2:;
 		for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
 			sc_next = op->o_callback->sc_next;
 			if ( op->o_callback->sc_cleanup ) {
+				slap_callback *sc2 = op->o_callback;
 				(void)op->o_callback->sc_cleanup( op, rs );
-				if ( op->o_callback != *sc_prev ) {
+				if ( op->o_callback != sc2 ) {
 					*sc_prev = op->o_callback;
 				}
 				if ( !op->o_callback ) break;
+				if ( op->o_callback != sc2 ) continue;
 			}
 			sc_prev = &op->o_callback->sc_next;
 		}
@@ -718,11 +722,13 @@ slap_send_search_entry( Operation *op, SlapReply *rs )
 		{
 			sc_next = op->o_callback->sc_next;
 			if ( op->o_callback->sc_response ) {
+				slap_callback *sc2 = op->o_callback;
 				rc = op->o_callback->sc_response( op, rs );
-				if ( op->o_callback != *sc_prev ) {
+				if ( op->o_callback != sc2 ) {
 					*sc_prev = op->o_callback;
 				}
 				if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+				if ( op->o_callback != sc2 ) continue;
 			}
 			sc_prev = &op->o_callback->sc_next;
 		}
@@ -1172,11 +1178,13 @@ error_return:;
 		for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
 			sc_next = op->o_callback->sc_next;
 			if ( op->o_callback->sc_cleanup ) {
+				slap_callback *sc2 = op->o_callback;
 				(void)op->o_callback->sc_cleanup( op, rs );
-				if ( op->o_callback != *sc_prev ) {
+				if ( op->o_callback != sc2 ) {
 					*sc_prev = op->o_callback;
 				}
 				if ( !op->o_callback ) break;
+				if ( op->o_callback != sc2 ) continue;
 			}
 			sc_prev = &op->o_callback->sc_next;
 		}
@@ -1230,11 +1238,13 @@ slap_send_search_reference( Operation *op, SlapReply *rs )
 		for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
 			sc_next = op->o_callback->sc_next;
 			if ( op->o_callback->sc_response ) {
+				slap_callback *sc2 = op->o_callback;
 				rc = op->o_callback->sc_response( op, rs );
-				if ( op->o_callback != *sc_prev ) {
+				if ( op->o_callback != sc2 ) {
 					*sc_prev = op->o_callback;
 				}
 				if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+				if ( op->o_callback != sc2 ) continue;
 			}
 			sc_prev = &op->o_callback->sc_next;
 		}
@@ -1371,11 +1381,13 @@ rel:
 		for ( sc_next = op->o_callback; sc_next; op->o_callback = sc_next) {
 			sc_next = op->o_callback->sc_next;
 			if ( op->o_callback->sc_cleanup ) {
+				slap_callback *sc2 = op->o_callback;
 				(void)op->o_callback->sc_cleanup( op, rs );
-				if ( op->o_callback != *sc_prev ) {
+				if ( op->o_callback != sc2 ) {
 					*sc_prev = op->o_callback;
 				}
 				if ( rc != SLAP_CB_CONTINUE || !op->o_callback ) break;
+				if ( op->o_callback != sc2 ) continue;
 			}
 			sc_prev = &op->o_callback->sc_next;
 		}