From c481ac1da75bc0f45088fc7ac0dbabded21c99fa Mon Sep 17 00:00:00 2001
From: Kurt Zeilenga <kurt@openldap.org>
Date: Wed, 19 May 2004 02:53:34 +0000
Subject: [PATCH] slapd extended match memory leak (ITS#3146) fix from HEAD

---
 CHANGES                     |  1 +
 servers/slapd/filterentry.c | 28 ++++++++++++++++++++--------
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/CHANGES b/CHANGES
index 4ab9635b14..a11e33621c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,7 @@ OpenLDAP 2.2.12 Engineering
 	Fixed slapd first component bug (ITS#3118)
 	Fixed slapd TOLOWER macro use bug (ITS#3115)
 	Fixed slapd TLS context clash bug (ITS#3109)
+	Fixed slapd extended match memory leak (ITS#3146)
 	Fixed libldap SASL buffering bug (ITS#1181)
 	Build Environment
 		Fixed liblber memory debug portability bug (ITS#3116)
diff --git a/servers/slapd/filterentry.c b/servers/slapd/filterentry.c
index 681c66c5c1..8ac43338fe 100644
--- a/servers/slapd/filterentry.c
+++ b/servers/slapd/filterentry.c
@@ -286,6 +286,7 @@ static int test_mra_filter(
 			/* check search access */
 			if ( !access_allowed( op, e,
 				a->a_desc, &value, ACL_SEARCH, NULL ) ) {
+				op->o_tmpfree( value.bv_val, memctx );
 				continue;
 			}
 
@@ -297,19 +298,23 @@ static int test_mra_filter(
 			for ( ; bv->bv_val != NULL; bv++ )
 			{
 				int ret;
-				int rc;
 	
 				rc = value_match( &ret, a->a_desc, mra->ma_rule, 0,
 					bv, &value, &text );
 	
 				if( rc != LDAP_SUCCESS ) {
-					return rc;
+					break;
 				}
 	
 				if ( ret == 0 ) {
-					return LDAP_COMPARE_TRUE;
+					rc = LDAP_COMPARE_TRUE;
+					break;
 				}
 			}
+			op->o_tmpfree( value.bv_val, memctx );
+			if ( rc != LDAP_SUCCESS ) {
+				return rc ;
+			}
 		}
 	}
 
@@ -325,6 +330,8 @@ static int test_mra_filter(
 			return LDAP_INVALID_SYNTAX;
 		}
 
+		rc = LDAP_COMPARE_FALSE;
+
 		/* for each AVA of each RDN ... */
 		for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) {
 			LDAPRDN		rdn = dn[ iRDN ];
@@ -334,7 +341,6 @@ static int test_mra_filter(
 				struct berval	*bv = &ava->la_value, value;
 				AttributeDescription *ad = (AttributeDescription *)ava->la_private;
 				int ret;
-				int rc;
 				const char *text;
 
 				assert( ad );
@@ -366,6 +372,7 @@ static int test_mra_filter(
 					/* check search access */
 					if ( !access_allowed( op, e,
 						ad, &value, ACL_SEARCH, NULL ) ) {
+						op->o_tmpfree( value.bv_val, memctx );
 						continue;
 					}
 				}
@@ -374,17 +381,22 @@ static int test_mra_filter(
 				rc = value_match( &ret, ad, mra->ma_rule, 0,
 					bv, &value, &text );
 
+				if ( value.bv_val != mra->ma_value.bv_val ) {
+					op->o_tmpfree( value.bv_val, memctx );
+				}
+
 				if( rc != LDAP_SUCCESS ) {
-					ldap_dnfree_x( dn, memctx );
-					return rc;
+					break;
 				}
 
 				if ( ret == 0 ) {
-					ldap_dnfree_x( dn, memctx );
-					return LDAP_COMPARE_TRUE;
+					rc = LDAP_COMPARE_TRUE;
+					break;
 				}
 			}
 		}
+		ldap_dnfree_x( dn, memctx );
+		return rc;
 	}
 
 	return LDAP_COMPARE_FALSE;
-- 
2.39.5