mrc0mmand / rpms / openldap

Forked from rpms/openldap 3 years ago
Clone

Blame SOURCES/openldap-ITS8655-fix-double-free-on-paged-search-with-pagesize-0.patch

a3e6a8
commit ec2fe743f5795eb7aaf43687e6b257ac071cef22
a3e6a8
Author: Ryan Tandy <ryan@nardis.ca>
a3e6a8
Date:   Wed May 17 20:07:39 2017 -0700
a3e6a8
a3e6a8
    ITS#8655 fix double free on paged search with pagesize 0
a3e6a8
    
a3e6a8
    Fixes a double free when a search includes the Paged Results control
a3e6a8
    with a page size of 0 and the search base matches the filter.
a3e6a8
a3e6a8
diff --git a/servers/slapd/back-mdb/search.c b/servers/slapd/back-mdb/search.c
a3e6a8
index 009939d..d0db918 100644
a3e6a8
--- a/servers/slapd/back-mdb/search.c
a3e6a8
+++ b/servers/slapd/back-mdb/search.c
a3e6a8
@@ -1066,7 +1066,8 @@ notfound:
a3e6a8
 			/* check size limit */
a3e6a8
 			if ( get_pagedresults(op) > SLAP_CONTROL_IGNORED ) {
a3e6a8
 				if ( rs->sr_nentries >= ((PagedResultsState *)op->o_pagedresults_state)->ps_size ) {
a3e6a8
-					mdb_entry_return( op, e );
a3e6a8
+					if (e != base)
a3e6a8
+						mdb_entry_return( op, e );
a3e6a8
 					e = NULL;
a3e6a8
 					send_paged_response( op, rs, &lastid, tentries );
a3e6a8
 					goto done;