Bug 690526 - (cov#10734) Double free in dse_add()
It's possible to encounter a double free of a Slapi_Entry in an
error condition in dse_add(). This function makes a copy of the
entry being added for use by postop plug-ins, but it can be free'd
twice in the following code:
e_copy = slapi_entry_dup(e);
if ( dse_add_entry_pb(pdse, e_copy, pb) != 0)
{
slapi_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, NULL,
0, NULL );
slapi_sdn_done(&sdn;;
return dse_add_return(error, e_copy);
}
The dse_add_entry_pb() function frees the passed in entry in all
conditions, but dse_add_return() also free's the passed in entry.
This double free could trigger a crash.
The way dse_add works is that entry in SLAPI_ADD_ENTRY in the
pblock should be consumed upon success, but will be left for
the caller to deal with upon failure. We should be passing NULL
for the second argument to dse_add_return() to avoid the double
free.
(cherry picked from commit 753c55017477fe3201d4d156cd90707d0ea5be13)