Issue 6169 - dds overlay bug(s) when expiring entries
Summary: dds overlay bug(s) when expiring entries
Status: RESOLVED PARTIAL
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-06-11 01:06 UTC by Hallvard Furuseth
Modified: 2014-08-01 21:04 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description Hallvard Furuseth 2009-06-11 01:06:28 UTC 
Full_Name: Hallvard B Furuseth
Version: HEAD, RE24
OS: Linux
URL: 
Submission from: (NULL) (129.240.6.233)
Submitted by: hallvard


Thinko in dds_expire():

Traversing a list chained on (struct dds_expire_t).de_next,
it keeps dds_expire_t **dep == &(previous element).de_next.
Before freeing (de = *dep), it points dep into de.  Fixing.

Suspicious code in same function:

The 'default:' branch says "deferring" (deferring what? deletion?)
and does not increment ndeletes, yet 'dds_expire_t *de' is deleted
in that case as well.  Is that intentional?  I don't know dds.  If
it's not, we could just move the free() into 'case LDAP_SUCCESS:'
and remove the 'de = NULL;' in the LDAP_NOT_ALLOWED_ON_NONLEAF case.
Comment 1 Hallvard Furuseth 2009-06-11 01:12:37 UTC 
changed notes
moved from Incoming to Software Bugs
Comment 2 Quanah Gibson-Mount 2009-06-11 18:22:06 UTC 
changed notes
Comment 3 ando@openldap.org 2009-08-18 17:21:40 UTC 
changed notes
changed state Open to Partial
Comment 4 OpenLDAP project 2014-08-01 21:04:22 UTC 
First half fixed in HEAD
First half fixed in RE24