don't risk using dangling pointers when looping thru connections (ITS#4405)

diff --git a/libraries/libldap/result.c b/libraries/libldap/result.c
index 4a95d537c23cbbca96cc075d310130fd3f314577..810348d2b9206aedde9856a3a607290f0a0bc806 100644 (file)
--- a/libraries/libldap/result.c
+++ b/libraries/libldap/result.c
@@ -239,7 +239,7 @@ wait4msg(
                        *tvp;
        time_t          start_time = 0;
        time_t          tmp_time;
-       LDAPConn        *lc, *nextlc;
+       LDAPConn        *lc;
 
        assert( ld != NULL );
        assert( result != NULL );
@@ -297,8 +297,7 @@ wait4msg(
 #ifdef LDAP_R_COMPILE
                        ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
 #endif
-                       for ( lc = ld->ld_conns; lc != NULL; lc = nextlc ) {
-                               nextlc = lc->lconn_next;
+                       for ( lc = ld->ld_conns; lc != NULL; lc = lc->lconn_next ) {
                                if ( ber_sockbuf_ctrl( lc->lconn_sb,
                                                LBER_SB_OPT_DATA_READY, NULL ) )
                                {
@@ -354,10 +353,10 @@ wait4msg(
                                        ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
                                        ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
 #endif
-                                       for ( lc = ld->ld_conns; rc == LDAP_MSG_X_KEEP_LOOKING && lc != NULL;
-                                               lc = nextlc )
+                                       for ( lc = ld->ld_conns;
+                                               rc == LDAP_MSG_X_KEEP_LOOKING && lc != NULL;
+                                               lc = lc->lconn_next )
                                        {
-                                               nextlc = lc->lconn_next;
                                                if ( lc->lconn_status == LDAP_CONNST_CONNECTED &&
                                                        ldap_is_read_ready( ld, lc->lconn_sb ) )
                                                {
@@ -365,10 +364,17 @@ wait4msg(
                                                        ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
 #endif
                                                        rc = try_read1msg( ld, msgid, all, &lc, result );
-                                                               if ( lc == NULL ) lc = nextlc;
 #ifdef LDAP_R_COMPILE
                                                        ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
 #endif
+                                                       if ( lc == NULL ) {
+                                                               /* if lc gets free()'d,
+                                                                * there's no guarantee
+                                                                * lc->lconn_next is still
+                                                                * sane; better restart
+                                                                * (ITS#4405) */
+                                                               lc = ld->ld_conns;
+                                                       }
                                                }
                                        }
 #ifdef LDAP_R_COMPILE