From: Howard Chu <hyc@openldap.org>
Date: Wed, 30 Jan 2013 01:15:09 +0000 (-0800)
Subject: ITS#7473 fix b1a6f6980f2e5f17a39527069b27dfdc5ee73f8a
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=a8352c03b374125fcbcfdc4297060f9fc6f29bb7;p=openldap

ITS#7473 fix b1a6f6980f2e5f17a39527069b27dfdc5ee73f8a

uninit'd size in dn2id_walk, bogus pagedresults
---

diff --git a/servers/slapd/back-mdb/dn2id.c b/servers/slapd/back-mdb/dn2id.c
index af003648af..1f2c4ea33e 100644
--- a/servers/slapd/back-mdb/dn2id.c
+++ b/servers/slapd/back-mdb/dn2id.c
@@ -835,6 +835,7 @@ mdb_dn2id_walk(
 				key.mv_data = &isc->scopes[n].mid;
 				key.mv_size = sizeof(ID);
 				data.mv_data = isc->nrdns[n].bv_val - 2;
+				data.mv_size = 1;	/* just needs to be non-zero, mdb_dup_compare doesn't care */
 				mdb_cursor_get( isc->mc, &key, &data, MDB_GET_BOTH );
 				continue;
 			}
diff --git a/servers/slapd/back-mdb/search.c b/servers/slapd/back-mdb/search.c
index 3ea6c5d9c5..09bdf60c96 100644
--- a/servers/slapd/back-mdb/search.c
+++ b/servers/slapd/back-mdb/search.c
@@ -630,6 +630,7 @@ dn2entry_retry:
 		}
 		if ( id == (ID)ps->ps_cookie )
 			id = mdb_idl_next( candidates, &cursor );
+		nsubs = ncand;	/* always bypass scope'd search */
 		goto loop_begin;
 	}
 	if ( nsubs < ncand ) {