New subject: [Issue 10480] Use after free in cn=config replication

1 Apr 2026


      https://bugs.openldap.org/show_bug.cgi?id=10480
Issue ID: 10480
           Summary: Use after free in cn=config replication
           Product: OpenLDAP
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Keywords: needs_review
          Severity: normal
          Priority: ---
         Component: backends
          Assignee: bugs@openldap.org
          Reporter: ondra@mistotebe.net
  Target Milestone: ---
If a renumber needs to happen, cn=config frees e->e_name, but some code (e.g.
syncrepl) sets op->o_req_dn to point to the same and as such it can't be used
anymore. This causes a crash in syncrepl (if LDAP_DEBUG_SYNC is on) and
accesslog during cn=config replication.
Either syncrepl (and others) shouldn't do this or cn=config should check for
this case and adjust o_req_dn after the fact.
-- 
You are receiving this mail because:
You are on the CC list for the issue.

[Issue 10480] New: Use after free in cn=config replication