https://bugs.openldap.org/show_bug.cgi?id=10543

Issue ID: 10543 Summary: slapd-read frees the DN pointer array but not the ldap_get_dn() strings Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: test suite Assignee: bugs@openldap.org Reporter: 1489378385@qq.com Target Milestone: ---

URL: https://github.com/openldap/openldap/blob/8afcbe9e04f1a40f03cea51c57418b05f8...

Description:

Source revision: 8afcbe9e04f1a40f03cea51c57418b05f86e8f44

Affected file: tests/progs/slapd-read.c

Affected lines: 204-232

Source-level observation:

do_random() allocates the values pointer array with malloc(). It then calls ldap_get_dn() once for every LDAP search result and stores each independently allocated DN string in values[i].

After the read loop, the code calls:

free(values);

This releases only the pointer array. It does not release any of the strings returned by ldap_get_dn().

The ldap_get_dn(3) documentation states that its returned string is dynamically allocated and should be released with ldap_memfree().

Steps to verify:

1. Build slapd-read with AddressSanitizer or LeakSanitizer. 2. Run it with a search filter so that do_random() is used. 3. Use a search base containing multiple matching entries. 4. Run multiple outer iterations if possible. 5. Allow the tester to exit and inspect the sanitizer report.

Actual result:

One DN string remains allocated for every entry returned by each search batch. Only the surrounding values array is freed.

Expected result:

Every non-NULL value returned by ldap_get_dn() should be released before the values array is freed.

Impact:

The leak scales with the number of matching entries and the number of outer test iterations. Long or repeated test runs can accumulate substantially more memory than the other three findings.

Validation status:

Confirmed by source review at the revision above. Runtime sanitizer validation is pending.