From: Howard Chu <hyc@openldap.org>
Date: Fri, 18 Aug 2006 01:37:21 +0000 (+0000)
Subject: Fix null pointer reference (coverity scan) and freed pointer reference
X-Git-Tag: OPENLDAP_REL_ENG_2_4_3ALPHA~9^2
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=ad1f0a323971311a11caf59e3c70d0ae35308647;p=openldap

Fix null pointer reference (coverity scan) and freed pointer reference
---

diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c
index 447a48b6f4..7f33dd1cb3 100644
--- a/servers/slapd/overlays/constraint.c
+++ b/servers/slapd/overlays/constraint.c
@@ -137,32 +137,24 @@ constraint_cf_gen( ConfigArgs *c )
                         
                         on->on_bi.bi_private = NULL;
                     } else {
-                        constraint *cpp;
+                        constraint **cpp;
                         
                             /* zap constraint numbered 'valx' */
-                        for(i=0, cp = cn, cpp = NULL;
+                        for(i=0, cp = cn, cpp = &cn;
                             (cp) && (i<c->valx);
-                            i++, cpp = cp, cp=cp->ap_next);
+                            i++, cpp = &cp->ap_next, cp = *cpp);
 
-                        if (cpp) {
+                        if (cp) {
                                 /* zap cp, and join cpp to cp->ap_next */
-                            cpp->ap_next = cp->ap_next;
+                            *cpp = cp->ap_next;
                             if (cp->re) {
                                 regfree(cp->re);
                                 ch_free(cp->re);
                             }
                             if (cp->re_str) ch_free(cp->re_str);
                             ch_free(cp);
-                        } else {
-                                /* zap the list head */
-                            if (cn->re) {
-                                regfree(cn->re);
-                                ch_free(cn->re);
-                            }
-                            if (cn->re_str) ch_free(cn->re_str);
-                            ch_free(cn);
-                            on->on_bi.bi_private = cn->ap_next;
                         }
+                        on->on_bi.bi_private = cn;
                     }
                     
                     break;