https://bugs.openldap.org/show_bug.cgi?id=10649

Issue ID: 10649 Summary: dap_do_free_request asserts lr->lr_refcnt == 1 after a failed referral rebind frees the in-flight request Product: OpenLDAP Version: 2.5.16 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: subramam@netapp.com Target Milestone: ---

libldap aborts in ldap_do_free_request (assert(lr->lr_refcnt == 1)) when a referral rebind fails.

ldap_search_ext_s is chasing a referral. The rebind callback calls ldap_start_tls_s on the same LDAP* and fails. ldap_new_connection then calls ldap_free_connection(ld, lc, 1, 0), which frees every request in ld_requests, including the search try_read1msg still holds. try_read1msg frees that request again and hits the assert. The request memory is already freed (0x5a).

force == 1 should free only requests on the connection being closed, and ldap_do_free_request should defer any positive lr_refcnt instead of requiring it to be 1.

====================================== b) bt #0 abort2 () at abort2.S:4 #1 0x000000080d26cb8e in __assert (func=<optimized out>, file=0x80c0763f5 "../../../../../../distro/libraries/libldap/request.c", line=979, failedexpr=0x80c07b28b "lr->lr_refcnt == 1") at ../../../../../../src/lib/libc/gen/assert.c:51 #2 0x000000080c0a85bc in ldap_do_free_request (arg=0x816b74180) at ../../../../../../distro/libraries/libldap/request.c:979 #3 0x000000080c0a9041 in ldap_free_request_int (ld=0x818377080, lr=0x816b74180) at ../../../../../../distro/libraries/libldap/request.c:1022 #4 0x000000080c0aab41 in ldap_return_request (ld=0x818377080, lrx=0x816b74180, freeit=0) at ../../../../../../distro/libraries/libldap/request.c:1726 #5 0x000000080c089db3 in try_read1msg (ld=0x818377080, msgid=6, all=1, lc=0x0, result=0x814b4b150) at ../../../../../../distro/libraries/libldap/result.c:926 #6 0x000000080c088402 in wait4msg (ld=0x818377080, msgid=6, all=1, timeout=0x814b4aae0, result=0x814b4b150) at ../../../../../../distro/libraries/libldap/result.c:369 #7 0x000000080c087dc2 in ldap_result (ld=0x818377080, msgid=6, all=1, timeout=0x814b4aae0, result=0x814b4b150) at ../../../../../../distro/libraries/libldap/result.c:120 #8 0x000000080c08cd70 in ldap_pvt_search_s (ld=0x818377080, base=0x818484809 "DC=dc25home2,DC=com", scope=2, filter=0x8184847a0 "(&(objectClass=User)(uid=RefUser11))", attrs=0x814b4a730, attrsonly=0, sctrls=0x0, cctrls=0x0, timeout=0x814b4aae0, sizelimit=0, deref=-1, res=0x814b4b150) at ../../../../../../distro/libraries/libldap/search.c:185 #9 0x000000080c08cc33 in ldap_search_ext_s (ld=0x818377080, base=0x818484809 "DC=dc25home2,DC=com", scope=2, filter=0x8184847a0 "(&(objectClass=User)(uid=RefUser11))", attrs=0x814b4a730, attrsonly=0, sctrls=0x0, cctrls=0x0, timeout=0x814b4aae0, sizelimit=0, res=0x814b4b150) at ../../../../../../distro/libraries/libldap/search.c:150 ==================================================