ITS#7906 fix ppolicy_connection_destroy

It can still run after ppolicy_close has freed the connection table

diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index 865a6cd8cb8d2ed48759a363d95072a1ecd55746..98221b86d41322a296f779875db544331393f9e5 100644 (file)
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -1269,7 +1269,7 @@ ppolicy_bind( Operation *op, SlapReply *rs )
 static int
 ppolicy_connection_destroy( BackendDB *bd, Connection *conn )
 {
-       if ( !BER_BVISEMPTY( &pwcons[conn->c_conn_idx].dn )) {
+       if ( pwcons && !BER_BVISEMPTY( &pwcons[conn->c_conn_idx].dn )) {
                ch_free( pwcons[conn->c_conn_idx].dn.bv_val );
                BER_BVZERO( &pwcons[conn->c_conn_idx].dn );
        }
@@ -2330,9 +2330,10 @@ ppolicy_close(
        /* Perhaps backover should provide bi_destroy hooks... */
        ov_count--;
        if ( ov_count <=0 && pwcons ) {
-               pwcons--;
-               free( pwcons );
+               pw_conn *pwc = pwcons;
                pwcons = NULL;
+               pwc--;
+               ch_free( pwc );
        }
        free( pi->def_policy.bv_val );
        free( pi );