fix ITS#5163 (re23 only)

diff --git a/CHANGES b/CHANGES
index d3712994fa529dc682cf9141dcf4209e249c9a0f..fd6887c589fa5eca57f697da3259e8e0dc333711 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,7 @@ OpenLDAP 2.3.39 Engineering
        Fixed slapd-sql concurrency issue (ITS#5095)
        Fixed slapo-chain double-free (ITS#5137)
        Fixed slapo-pcache and -rwm interaction fix (ITS#4991) 
+       Fixed slapo-pcache non-null terminated array crasher (ITS#5163)
        Fixed slapo-rwm modlist handling (ITS#5124)
        Fixed liblber Windows x64 portability (ITS#5105)
        Fixed libldap ppolicy control creation (ITS#5103)

diff --git a/servers/slapd/overlays/pcache.c b/servers/slapd/overlays/pcache.c
index 85bf03c3c4c61894a26f3236ed25a31f78b2f563..c42eaa9e05ec898f97802c5f40b79fa855b441c6 100644 (file)
--- a/servers/slapd/overlays/pcache.c
+++ b/servers/slapd/overlays/pcache.c
@@ -1134,8 +1134,8 @@ add_filter_attrs(
                count++;
        }
 
-       *new_attrs = (AttributeName*)ch_malloc((count+1)*
-               sizeof(AttributeName));
+       *new_attrs = (AttributeName*)ch_calloc( count + 1,
+               sizeof(AttributeName) );
        for (i=0; i<attrs->count; i++) {
                (*new_attrs)[i].an_name = attrs->attrs[i].an_name;
                (*new_attrs)[i].an_desc = attrs->attrs[i].an_desc;
@@ -1155,18 +1155,13 @@ add_filter_attrs(
                        continue;
                (*new_attrs)[j].an_name = filter_attrs[i].an_name;
                (*new_attrs)[j].an_desc = filter_attrs[i].an_desc;
-               (*new_attrs)[j].an_oc = NULL;
-               (*new_attrs)[j].an_oc_exclude = 0;
                j++;
        }
        if ( addoc ) {
                (*new_attrs)[j].an_name = slap_schema.si_ad_objectClass->ad_cname;
                (*new_attrs)[j].an_desc = slap_schema.si_ad_objectClass;
-               (*new_attrs)[j].an_oc = NULL;
-               (*new_attrs)[j].an_oc_exclude = 0;
                j++;
        }
-       BER_BVZERO( &(*new_attrs)[j].an_name );
 }
 
 /* NOTE: this is a quick workaround to let pcache minimally interact