[src/trunk]: src/external/bsd/openldap/dist/servers/slapd Apply: http://www.o...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/138a85157bd4
branches:  trunk
changeset: 336033:138a85157bd4
user:      christos <christos%NetBSD.org@localhost>
date:      Sat Feb 07 17:56:59 2015 +0000

description:
Apply: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;\
    h=2f1a2dd329b91afe561cd06b872d09630d4edb6a

Certain search queries including the Matched Values control can trigger
a double free in slapd 2.4.40 when freeing operation controls. This is a
regression in 2.4.40, no earlier releases are affected. [CVE-1546]

XXX: Pullup-7

diffstat:

 external/bsd/openldap/dist/servers/slapd/filter.c |  12 ++++--------
 1 files changed, 4 insertions(+), 8 deletions(-)

diffs (27 lines):

diff -r 34d6ae438016 -r 138a85157bd4 external/bsd/openldap/dist/servers/slapd/filter.c
--- a/external/bsd/openldap/dist/servers/slapd/filter.c Sat Feb 07 17:20:16 2015 +0000
+++ b/external/bsd/openldap/dist/servers/slapd/filter.c Sat Feb 07 17:56:59 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: filter.c,v 1.1.1.4 2014/05/28 09:58:46 tron Exp $      */
+/*     $NetBSD: filter.c,v 1.2 2015/02/07 17:56:59 christos Exp $      */
 
 /* filter.c - routines for parsing and dealing with filters */
 /* $OpenLDAP$ */
@@ -1160,14 +1160,10 @@
 void
 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
 {
-       ValuesReturnFilter      *p, *next;
+       ValuesReturnFilter      *next;
 
-       if ( vrf == NULL ) {
-               return;
-       }
-
-       for ( p = vrf; p != NULL; p = next ) {
-               next = p->vrf_next;
+       for ( p = vrf; vrf != NULL; vrf = next ) {
+               next = vrf->vrf_next;
 
                switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
                case LDAP_FILTER_PRESENT: