ITS#5853

diff --git a/CHANGES b/CHANGES
index 22b28e2653fb1030d719117ab671dcffb4d63212..0ffe55295d17962598f8cffc8963587acc4c3e3d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ OpenLDAP 2.4.14 Engineering
        Added libldap GnuTLS support for TLS_CIPHER_SUITE (ITS#5887)
        Added libldap GnuTLS setting random file (ITS#5462)
        Added libldap alias dereferencing in C API (ITS#5916)
+       Fixed libldap chasing multiple referrals (ITS#5853)
        Fixed libldap deref handling (ITS#5768)
        Fixed libldap NULL pointer deref (ITS#5934)
        Fixed libldap peer cert memory leak (ITS#5849)

diff --git a/libraries/libldap/os-ip.c b/libraries/libldap/os-ip.c
index bebd82382ffcf0fc5c040ef2764ca9250326e6ad..3fc414564b0f6fe108e632772c8b76d948ab5dd3 100644 (file)
--- a/libraries/libldap/os-ip.c
+++ b/libraries/libldap/os-ip.c
@@ -957,6 +957,9 @@ ldap_is_read_ready( LDAP *ld, Sockbuf *sb )
 
        sip = (struct selectinfo *)ld->ld_selectinfo;
 
+       if (ber_sockbuf_ctrl( sb, LBER_SB_OPT_DATA_READY, NULL ))
+               return 1;
+
        ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_FD, &sd );
 
 #ifdef HAVE_POLL

diff --git a/libraries/libldap/result.c b/libraries/libldap/result.c
index 10ca5b7d3c4131a90c7501827b9246fbb7d5c0f2..21f02c9831b338b862801ebcefabc736352b0ee9 100644 (file)
--- a/libraries/libldap/result.c
+++ b/libraries/libldap/result.c
@@ -71,7 +71,7 @@ static int ldap_mark_abandoned LDAP_P(( LDAP *ld, ber_int_t msgid, int idx ));
 static int wait4msg LDAP_P(( LDAP *ld, ber_int_t msgid, int all, struct timeval *timeout,
        LDAPMessage **result ));
 static ber_tag_t try_read1msg LDAP_P(( LDAP *ld, ber_int_t msgid,
-       int all, LDAPConn **lc, LDAPMessage **result ));
+       int all, LDAPConn *lc, LDAPMessage **result ));
 static ber_tag_t build_result_ber LDAP_P(( LDAP *ld, BerElement **bp, LDAPRequest *lr ));
 static void merge_error_info LDAP_P(( LDAP *ld, LDAPRequest *parentr, LDAPRequest *lr ));
 static LDAPMessage * chkResponseList LDAP_P(( LDAP *ld, int msgid, int all));
@@ -106,7 +106,7 @@ ldap_result(
        struct timeval *timeout,
        LDAPMessage **result )
 {
-       LDAPMessage     *lm = NULL;
+       LDAPMessage     *lm;
        int             rc;
 
        assert( ld != NULL );
@@ -118,19 +118,7 @@ ldap_result(
        ldap_pvt_thread_mutex_lock( &ld->ld_res_mutex );
 #endif
 
-#if 0
-       /* this is already done inside wait4msg(), right?... */
-       lm = chkResponseList( ld, msgid, all );
-#endif
-
-       if ( lm == NULL ) {
-               rc = wait4msg( ld, msgid, all, timeout, result );
-
-       } else {
-               *result = lm;
-               ld->ld_errno = LDAP_SUCCESS;
-               rc = lm->lm_msgtype;
-       }
+       rc = wait4msg( ld, msgid, all, timeout, result );
 
 #ifdef LDAP_R_COMPILE
        ldap_pvt_thread_mutex_unlock( &ld->ld_res_mutex );
@@ -335,13 +323,6 @@ wait4msg(
                                if ( ber_sockbuf_ctrl( lc->lconn_sb,
                                        LBER_SB_OPT_DATA_READY, NULL ) )
                                {
-#ifdef LDAP_R_COMPILE
-                                       ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
-#endif
-                                       rc = try_read1msg( ld, msgid, all, &lc, result );
-#ifdef LDAP_R_COMPILE
-                                       ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
-#endif
                                        lc_ready = 1;
                                        break;
                                }
@@ -375,54 +356,63 @@ wait4msg(
                                        rc = LDAP_MSG_X_KEEP_LOOKING;   /* select interrupted: loop */
 
                                } else {
-                                       rc = LDAP_MSG_X_KEEP_LOOKING;
+                                       lc_ready = 1;
+                               }
+                       }
+                       if ( lc_ready ) {
+                               LDAPConn *lnext;
+                               rc = LDAP_MSG_X_KEEP_LOOKING;
 #ifdef LDAP_R_COMPILE
-                                       ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
+                               ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
 #endif
-                                       if ( ld->ld_requests &&
-                                               ld->ld_requests->lr_status == LDAP_REQST_WRITING &&
-                                               ldap_is_write_ready( ld,
-                                                       ld->ld_requests->lr_conn->lconn_sb ) )
-                                       {
-                                               ldap_int_flush_request( ld, ld->ld_requests );
-                                       }
+                               if ( ld->ld_requests &&
+                                       ld->ld_requests->lr_status == LDAP_REQST_WRITING &&
+                                       ldap_is_write_ready( ld,
+                                               ld->ld_requests->lr_conn->lconn_sb ) )
+                               {
+                                       ldap_int_flush_request( ld, ld->ld_requests );
+                               }
 #ifdef LDAP_R_COMPILE
-                                       ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
-                                       ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
+                               ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
+                               ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
 #endif
-                                       for ( lc = ld->ld_conns;
-                                               rc == LDAP_MSG_X_KEEP_LOOKING && lc != NULL; )
+                               for ( lc = ld->ld_conns;
+                                       rc == LDAP_MSG_X_KEEP_LOOKING && lc != NULL;
+                                       lc = lnext )
+                               {
+                                       if ( lc->lconn_status == LDAP_CONNST_CONNECTED &&
+                                               ldap_is_read_ready( ld, lc->lconn_sb ) )
                                        {
-                                               if ( lc->lconn_status == LDAP_CONNST_CONNECTED &&
-                                                       ldap_is_read_ready( ld, lc->lconn_sb ) )
-                                               {
+                                               /* Don't let it get freed out from under us */
+                                               ++lc->lconn_refcnt;
 #ifdef LDAP_R_COMPILE
-                                                       ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
+                                               ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
 #endif
-                                                       rc = try_read1msg( ld, msgid, all, &lc, result );
+                                               rc = try_read1msg( ld, msgid, all, lc, result );
+                                               lnext = lc->lconn_next;
+
+                                               /* Only take locks if we're really freeing */
+                                               if ( lc->lconn_refcnt <= 1 ) {
 #ifdef LDAP_R_COMPILE
-                                                       ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
+                                                       ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
 #endif
-                                                       if ( lc == NULL ) {
-                                                               /* if lc gets free()'d,
-                                                                * there's no guarantee
-                                                                * lc->lconn_next is still
-                                                                * sane; better restart
-                                                                * (ITS#4405) */
-                                                               lc = ld->ld_conns;
-
-                                                               /* don't get to next conn! */
-                                                               break;
-                                                       }
+                                                       ldap_free_connection( ld, lc, 0, 1 );
+#ifdef LDAP_R_COMPILE
+                                                       ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
+#endif
+                                               } else {
+                                                       --lc->lconn_refcnt;
                                                }
-
-                                               /* next conn */
-                                               lc = lc->lconn_next;
-                                       }
 #ifdef LDAP_R_COMPILE
-                                       ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
+                                               ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
 #endif
+                                       } else {
+                                               lnext = lc->lconn_next;
+                                       }
                                }
+#ifdef LDAP_R_COMPILE
+                               ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
+#endif
                        }
                }
 
@@ -482,7 +472,7 @@ try_read1msg(
        LDAP *ld,
        ber_int_t msgid,
        int all,
-       LDAPConn **lcp,
+       LDAPConn *lc,
        LDAPMessage **result )
 {
        BerElement      *ber;
@@ -493,7 +483,6 @@ try_read1msg(
        ber_len_t       len;
        int             foundit = 0;
        LDAPRequest     *lr, *tmplr, dummy_lr = { 0 };
-       LDAPConn        *lc;
        BerElement      tmpber;
        int             rc, refer_cnt, hadref, simple_request, err;
        ber_int_t       lderr;
@@ -504,8 +493,7 @@ try_read1msg(
 #endif
 
        assert( ld != NULL );
-       assert( lcp != NULL );
-       assert( *lcp != NULL );
+       assert( lc != NULL );
        
 #ifdef LDAP_R_COMPILE
        LDAP_PVT_THREAD_ASSERT_MUTEX_OWNER( &ld->ld_res_mutex );
@@ -514,8 +502,6 @@ try_read1msg(
        Debug( LDAP_DEBUG_TRACE, "read1msg: ld %p msgid %d all %d\n",
                (void *)ld, msgid, all );
 
-       lc = *lcp;
-
 retry:
        if ( lc->lconn_ber == NULL ) {
                lc->lconn_ber = ldap_alloc_ber_with_options( ld );
@@ -561,14 +547,8 @@ nextresp3:
                if ( err == EAGAIN ) return LDAP_MSG_X_KEEP_LOOKING;
 #endif
                ld->ld_errno = LDAP_SERVER_DOWN;
-#ifdef LDAP_R_COMPILE
-               ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
-#endif
-               ldap_free_connection( ld, lc, 1, 0 );
-#ifdef LDAP_R_COMPILE
-               ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
-#endif
-               lc = *lcp = NULL;
+               --lc->lconn_refcnt;
+               lc->lconn_status = 0;
                return -1;
 
        default:
@@ -938,14 +918,8 @@ nextresp2:
                         * shouldn't necessarily end the connection
                         */
                        if ( lc != NULL && id != 0 ) {
-#ifdef LDAP_R_COMPILE
-                               ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
-#endif
-                               ldap_free_connection( ld, lc, 0, 1 );
-#ifdef LDAP_R_COMPILE
-                               ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
-#endif
-                               lc = *lcp = NULL;
+                               --lc->lconn_refcnt;
+                               lc = NULL;
                        }
                }
        }
@@ -1011,14 +985,7 @@ nextresp2:
 
                        /* get rid of the connection... */
                        if ( lc != NULL ) {
-#ifdef LDAP_R_COMPILE
-                               ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
-#endif
-                               ldap_free_connection( ld, lc, 0, 1 );
-#ifdef LDAP_R_COMPILE
-                               ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
-#endif
-                               lc = *lcp = NULL;
+                               --lc->lconn_refcnt;
                        }
 
                        /* need to return -1, because otherwise