From: Nadezhda Ivanova <nivanova@symas.com>
Date: Fri, 27 Jan 2017 09:49:24 +0000 (+0100)
Subject: ITS#8725 Fix an invalid data access during add operations if backend is asynchronous
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=c6e00c7b0fb673d670c3f5e94edd4852f1ff546c;p=openldap

ITS#8725 Fix an invalid data access during add operations if backend is asynchronous
---

diff --git a/servers/slapd/add.c b/servers/slapd/add.c
index d0b3b772fd..ae951b490e 100644
--- a/servers/slapd/add.c
+++ b/servers/slapd/add.c
@@ -48,7 +48,7 @@ do_add( Operation *op, SlapReply *rs )
 	size_t		textlen = sizeof( textbuf );
 	int		rc = 0;
 	int		freevals = 1;
-	OpExtraDB oex;
+	OpExtraDB *oex;
 
 	Debug( LDAP_DEBUG_TRACE, "%s do_add\n",
 		op->o_log_prefix, 0, 0 );
@@ -185,20 +185,20 @@ do_add( Operation *op, SlapReply *rs )
 	}
 
 	freevals = 0;
-
-	oex.oe.oe_key = (void *)do_add;
-	oex.oe_db = NULL;
-	LDAP_SLIST_INSERT_HEAD(&op->o_extra, &oex.oe, oe_next);
+	oex = op->o_tmpalloc( sizeof(OpExtraDB), op->o_tmpmemctx );
+	oex->oe.oe_key = (void *)do_add;
+	oex->oe_db = NULL;
+	LDAP_SLIST_INSERT_HEAD(&op->o_extra, &oex->oe, oe_next);
 
 	op->o_bd = frontendDB;
 	rc = frontendDB->be_add( op, rs );
-	LDAP_SLIST_REMOVE(&op->o_extra, &oex.oe, OpExtra, oe_next);
 
 	if ( rc == SLAPD_ASYNCOP ) {
 		/* skip cleanup */
 		return rc;
 	}
 
+	LDAP_SLIST_REMOVE(&op->o_extra, &oex->oe, OpExtra, oe_next);
 #ifdef LDAP_X_TXN
 	if ( rc == LDAP_X_TXN_SPECIFY_OKAY ) {
 		/* skip cleanup */
@@ -206,10 +206,10 @@ do_add( Operation *op, SlapReply *rs )
 	} else
 #endif
 	if ( rc == 0 ) {
-		if ( op->ora_e != NULL && oex.oe_db != NULL ) {
+		if ( op->ora_e != NULL && oex->oe_db != NULL ) {
 			BackendDB	*bd = op->o_bd;
 
-			op->o_bd = oex.oe_db;
+			op->o_bd = oex->oe_db;
 
 			be_entry_release_w( op, op->ora_e );
 
@@ -217,6 +217,7 @@ do_add( Operation *op, SlapReply *rs )
 			op->o_bd = bd;
 		}
 	}
+	op->o_tmpfree( oex, op->o_tmpmemctx );
 
 done:;
 	if ( modlist != NULL ) {