[Date Prev][Date Next] [Chronological] [Thread] [Top]

(ITS#7930) slapo-chain causes double-free with rwm



Full_Name: Howard Chu
Version: RE24
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (78.155.233.73)
Submitted by: hyc


chaining substitutes op->o_req_dn and then restores its original value after
performing the chained op. But rwm tries to cleanup op->o_req_dn when the
chained op finishes, and so the original DN will be invalid after that.

Partial fix: chain should only resto t the original value if the current value
matches
the last value that chain used.

Additional fix: rwm should not cleanup at this time, because the
send_ldap_result() of the chained op is not necessarily the final result of the
original op. (E.g., in a search that processes multiple search refs,
send_ldap_result will occur for each ref that is chained.)