[Date Prev][Date Next]
(ITS#7930) slapo-chain causes double-free with rwm
Full_Name: Howard Chu
Submission from: (NULL) (220.127.116.11)
Submitted by: hyc
chaining substitutes op->o_req_dn and then restores its original value after
performing the chained op. But rwm tries to cleanup op->o_req_dn when the
chained op finishes, and so the original DN will be invalid after that.
Partial fix: chain should only resto t the original value if the current value
the last value that chain used.
Additional fix: rwm should not cleanup at this time, because the
send_ldap_result() of the chained op is not necessarily the final result of the
original op. (E.g., in a search that processes multiple search refs,
send_ldap_result will occur for each ref that is chained.)