From 38c92a11510e4c302fac334e5835a7a127e4e31a Mon Sep 17 00:00:00 2001
From: Kurt Zeilenga <kurt@openldap.org>
Date: Sun, 9 Aug 1998 02:54:09 +0000
Subject: [PATCH] LDAPworld P10: SLAPD Index corruption

---
 servers/slapd/back-ldbm/index.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/servers/slapd/back-ldbm/index.c b/servers/slapd/back-ldbm/index.c
index 3d75a091d3..fd13d7ec07 100644
--- a/servers/slapd/back-ldbm/index.c
+++ b/servers/slapd/back-ldbm/index.c
@@ -3,7 +3,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <sys/types.h>
-#include <sys/socket.h>
 #include "slap.h"
 #include "back-ldbm.h"
 
@@ -130,25 +129,26 @@ index_read(
 	realval = val;
 	tmpval = NULL;
 	if ( prefix != '\0' ) {
-		int	len;
+              int     len = strlen( val );
 
-		if ( (len = strlen( val )) < sizeof(buf) ) {
-			buf[0] = prefix;
-			strcpy( &buf[1], val );
+              if ( (len + 2) < sizeof(buf) ) {
 			realval = buf;
 		} else {
 			/* value + prefix + null */
 			tmpval = (char *) ch_malloc( len + 2 );
-			tmpval[0] = prefix;
-			strcat( &tmpval[1], val );
 			realval = tmpval;
 		}
+              realval[0] = prefix;
+              strcpy( &realval[1], val );
 	}
 
 	key.dptr = realval;
 	key.dsize = strlen( realval ) + 1;
 
 	idl = idl_fetch( be, db, key );
+      if ( tmpval != NULL ) {
+              free( tmpval );
+      }
 
 	ldbm_cache_close( be, db );
 
@@ -181,19 +181,17 @@ add_value(
 	tmpval = NULL;
 	idl = NULL;
 	if ( prefix != '\0' ) {
-		int	len;
+              int     len = strlen( val );
 
-		if ( (len = strlen( val )) < sizeof(buf) ) {
-			buf[0] = prefix;
-			strcpy( &buf[1], val );
+              if ( (len + 2) < sizeof(buf) ) {
 			realval = buf;
 		} else {
 			/* value + prefix + null */
 			tmpval = (char *) ch_malloc( len + 2 );
-			tmpval[0] = prefix;
-			strcat( &tmpval[1], val );
 			realval = tmpval;
 		}
+              realval[0] = prefix;
+              strcpy( &realval[1], val );
 	}
 
 	key.dptr = realval;
-- 
2.39.5