https://bugs.openldap.org/show_bug.cgi?id=10280
--- Comment #4 from Howard Chu hyc@openldap.org --- (In reply to Ondřej Kuzník from comment #3)
On Fri, Apr 10, 2026 at 02:27:54PM +0000, openldap-its@openldap.org wrote:
That was by design, this check https://git.openldap.org/openldap/openldap/-/blob/master/servers/slapd/overl... was to make sure we didn't expand the same value twice. Commenting that out is sufficient to make the example in this ticket work, but that opens the door to unbounded expansions, which could eat all of memory.
We could reuse the filter in multiple parts of the tree if we can ensure we're the ones in charge of freeing it. Or add a new filter type which defers this to the other one/a callback/...
Yeah, I've been thinking about how to do that too.
Otherwise, shouldn't the search be rejected (and some documentation added) rather than letting it continue with a somewhat murky semantics?
There's no precedent for rejecting a search due to problems with filter evaluation. In any other case, the search just proceeds, potentially with a bunch of filter terms undefined.