ITS#8725 Fix an invalid data access during add operations if backend is asynchronous

diff --git a/servers/slapd/add.c b/servers/slapd/add.c
index d0b3b772fdfaac0b154452ccaeba31d78f5641f6..ae951b490e63ffc99f4c39358ae1d8ab05a9ab4b 100644 (file)
--- a/servers/slapd/add.c
+++ b/servers/slapd/add.c
@@ -48,7 +48,7 @@ do_add( Operation *op, SlapReply *rs )
        size_t          textlen = sizeof( textbuf );
        int             rc = 0;
        int             freevals = 1;
-       OpExtraDB oex;
+       OpExtraDB *oex;
 
        Debug( LDAP_DEBUG_TRACE, "%s do_add\n",
                op->o_log_prefix, 0, 0 );
@@ -185,20 +185,20 @@ do_add( Operation *op, SlapReply *rs )
        }
 
        freevals = 0;
-
-       oex.oe.oe_key = (void *)do_add;
-       oex.oe_db = NULL;
-       LDAP_SLIST_INSERT_HEAD(&op->o_extra, &oex.oe, oe_next);
+       oex = op->o_tmpalloc( sizeof(OpExtraDB), op->o_tmpmemctx );
+       oex->oe.oe_key = (void *)do_add;
+       oex->oe_db = NULL;
+       LDAP_SLIST_INSERT_HEAD(&op->o_extra, &oex->oe, oe_next);
 
        op->o_bd = frontendDB;
        rc = frontendDB->be_add( op, rs );
-       LDAP_SLIST_REMOVE(&op->o_extra, &oex.oe, OpExtra, oe_next);
 
        if ( rc == SLAPD_ASYNCOP ) {
                /* skip cleanup */
                return rc;
        }
 
+       LDAP_SLIST_REMOVE(&op->o_extra, &oex->oe, OpExtra, oe_next);
 #ifdef LDAP_X_TXN
        if ( rc == LDAP_X_TXN_SPECIFY_OKAY ) {
                /* skip cleanup */
@@ -206,10 +206,10 @@ do_add( Operation *op, SlapReply *rs )
        } else
 #endif
        if ( rc == 0 ) {
-               if ( op->ora_e != NULL && oex.oe_db != NULL ) {
+               if ( op->ora_e != NULL && oex->oe_db != NULL ) {
                        BackendDB       *bd = op->o_bd;
 
-                       op->o_bd = oex.oe_db;
+                       op->o_bd = oex->oe_db;
 
                        be_entry_release_w( op, op->ora_e );
 
@@ -217,6 +217,7 @@ do_add( Operation *op, SlapReply *rs )
                        op->o_bd = bd;
                }
        }
+       op->o_tmpfree( oex, op->o_tmpmemctx );
 
 done:;
        if ( modlist != NULL ) {