From 0af193c3a5c5bac9b77b933de3ba6fc96c310b3f Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: Mar 13 2012 19:15:17 +0000
Subject: Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash


https://fedorahosted.org/389/ticket/305
Resolves: Ticket #305
Bug Description: Certain CMP operations hang or cause ns-slapd to crash
Reviewed by: nkinder, nhosoi (Thanks!)
Branch: rhel-6.3
Fix Description: This addresses the hang part, which I incorrectly assumed
was related to the crash part.  The code using vattr_map_sp_next() was causing
an infinite loop (and hang) by passing the list head every time rather than
the previous next pointer.
In addition, LDAP compare operations were not working if a vattr service
provider was in effect for an attribute, and there was a real value for
the attribute in the entry.  The rc code was being set to -1 to indicate
no vattr service providers provided the value, but it was not being reset
to 0 when the value was found in the actual entry.  The fix is to reset
rc to 0 (success) and *result to 0 (compare false) when testing the real
attribute.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 55135e37a9e330f084ab7d254306cbf155526b25)
(cherry picked from commit f00c678e36c138a7991b6c3c4780d40af30dc7c4)

---

diff --git a/ldap/servers/slapd/vattr.c b/ldap/servers/slapd/vattr.c
index dc0a4ac..e8b2342 100644
--- a/ldap/servers/slapd/vattr.c
+++ b/ldap/servers/slapd/vattr.c
@@ -1096,7 +1096,7 @@ int slapi_vattr_namespace_value_compare_sp(vattr_context *c,/* Entry we're inter
 	if (list) {
 		vattr_sp_handle *current_handle = NULL;
 		void *hint = NULL;
-		for (current_handle = vattr_map_sp_first(list,&hint); current_handle; current_handle = vattr_map_sp_next(list,&hint)) {
+		for (current_handle = vattr_map_sp_first(list,&hint); current_handle; current_handle = vattr_map_sp_next(current_handle,&hint)) {
 			/* call this SP */
 			rc = vattr_call_sp_compare_value(current_handle,c,e,my_get,type,test_this,result,flags, hint);
 			if (0 == rc) {
@@ -1117,17 +1117,19 @@ int slapi_vattr_namespace_value_compare_sp(vattr_context *c,/* Entry we're inter
 	
 			/* Put the required stuff in the fake attr */
 
+			rc = 0; /* found real attr - now see if we have the requested value*/
+			*result = 0;	/* return "compare false" by default */
 			for(i=0;i<attr_count;i++)
 			{
 				Dummy_value = slapi_valueset_find( my_get[i].get_attr, my_get[i].get_present_values, test_this );
 
 				if (Dummy_value) {
 					*result = 1;	/* return "compare true" */
-
 					break;
 				}
 			}
 		} else {
+			/* no such attribute */
 			rc = SLAPI_VIRTUALATTRS_NOT_FOUND;
 		}
 	}