https://bugs.openldap.org/show_bug.cgi?id=10404
--- Comment #17 from Ondřej Kuzník ondra@mistotebe.net --- On Wed, Feb 18, 2026 at 03:55:54PM +0000, openldap-its@openldap.org wrote:
This trace is suspicious. There is no such function "slap_sasl_getconfpath" in OpenLDAP slapd.
==1559117== 31 bytes in 1 blocks are definitely lost in loss record 542 of 1,022 ==1559117== at 0x4844818: malloc (vg_replace_malloc.c:446) ==1559117== by 0x1A7031: slap_sasl_getconfpath (sasl.c:1248) ==1559117== by 0x48E6044: sasl_server_init (in /usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25) ==1559117== by 0x1A7B6C: slap_sasl_init (sasl.c:1291) ==1559117== by 0x17EEF4: slap_init (init.c:152) ==1559117== by 0x130AAB: main (main.c:651)
It seems you're running code with 3rd party patches. We can't help you with that.
This code would appear to be coming from a Debian-specific patch: https://salsa.debian.org/openldap-team/openldap/-/blob/master/debian/patches...
SASL_CB_GETCONFPATH callback contract is undocumented but it does handle global strings so the assumption is that it's the callback's responsibility to manage the lifetime of the returned string *somehow*.
As such this is per-server-init allocation, so not really a meaningful leak.