https://bugs.openldap.org/show_bug.cgi?id=10480

Issue ID: 10480 Summary: Use after free in cn=config replication Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: backends Assignee: bugs@openldap.org Reporter: ondra@mistotebe.net Target Milestone: ---

If a renumber needs to happen, cn=config frees e->e_name, but some code (e.g. syncrepl) sets op->o_req_dn to point to the same and as such it can't be used anymore. This causes a crash in syncrepl (if LDAP_DEBUG_SYNC is on) and accesslog during cn=config replication.

Either syncrepl (and others) shouldn't do this or cn=config should check for this case and adjust o_req_dn after the fact.