https://bugs.openldap.org/show_bug.cgi?id=10545

Issue ID: 10545 Summary: urltest leaks the parsed LDAPURLDesc and reconstructed URL string Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: 1489378385@qq.com Target Milestone: ---

URL: https://github.com/openldap/openldap/blob/8afcbe9e04f1a40f03cea51c57418b05f8...

Description:

Source revision: 8afcbe9e04f1a40f03cea51c57418b05f86e8f44

Affected file: libraries/libldap/urltest.c

Affected lines: 75 and 125-127

Source-level observation:

On a successful call, ldap_url_parse() allocates an LDAPURLDesc and stores it in lud. The program reaches its final return without calling ldap_free_urldesc(lud).

There is also a second allocation on line 125:

fprintf(stdout, "URL: %s\n", ldap_url_desc2str(lud));

ldap_url_desc2str() allocates its returned string with LDAP_MALLOC. Because the return value is passed directly to fprintf(), its pointer is lost and the string cannot be released.

Steps to verify:

1. Build libraries/libldap/urltest with AddressSanitizer or LeakSanitizer. 2. Run it with a valid URL, for example: ./urltest 'ldap://localhost/dc=example,dc=com??sub?(objectClass=*)' 3. Allow the program to exit successfully. 4. Inspect the sanitizer report.

Actual result:

A successful invocation exits without releasing either the LDAPURLDesc or the string returned by ldap_url_desc2str().

Expected result:

Both allocations should be released before returning from main().

Impact:

Each successful run leaves two process-lifetime allocations. The practical impact is low because urltest is a short-lived test utility, but the ownership contracts are not followed and leak detectors report the allocations.

Validation status:

Confirmed by source review at the revision above. Runtime sanitizer validation is pending.