https://bugs.openldap.org/show_bug.cgi?id=10488
--- Comment #4 from wangxiaomeng wangxiaomeng@kylinos.cn --- (In reply to Howard Chu from comment #3)
Please provide sample requests that trigger these two conditions.
Thank you for the context on commit f021404b. You are right that the call site in slap_send_ldap_result is guarded by op->o_protocol < LDAP_VERSION3, and with disallow bind_v2 being the default since 2001, this path is not reachable from a network client in a default configuration.
I do not currently have a sample request that can trigger these two conditions against an unmodified slapd. The report originated from a static analysis run against result.c, not from a live exploit.
I would like to ask whether you would still consider the patch on code-hygiene grounds: 1. The two checks are one-line defensive guards with no runtime cost on the normal path; 2. They remove a class of static-analyzer warnings that downstream distributors (including us) have to carry as local patches or suppress.
If you do not consider this worth changing, I am fine with the bug being closed as WONTFIX. I just wanted to raise the option.
Thanks again for the quick review.