From b34494fa18f9bba3c70cbbba41b51ecbec8bfd2f Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Tue, 22 Apr 2025 17:39:05 +0100
Subject: [PATCH] ITS#10328 librewrite: fix substitution cleanup

---
 libraries/librewrite/subst.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/libraries/librewrite/subst.c b/libraries/librewrite/subst.c
index 72539206c6..df5acb23db 100644
--- a/libraries/librewrite/subst.c
+++ b/libraries/librewrite/subst.c
@@ -131,6 +131,7 @@ rewrite_subst_compile(
 				map = rewrite_xmap_parse( info,
 						p + 3, (const char **)&begin );
 				if ( map == NULL ) {
+					nsub++;	/* make sure subs[nsub] is freed */
 					goto cleanup;
 				}
 				submatch[ nsub ].ls_map = map;
@@ -146,6 +147,7 @@ rewrite_subst_compile(
 			map = rewrite_map_parse( info, p + 2,
 					(const char **)&begin );
 			if ( map == NULL ) {
+				nsub++;	/* make sure subs[nsub] is freed */
 				goto cleanup;
 			}
 			p = begin - 1;
@@ -165,6 +167,7 @@ rewrite_subst_compile(
 			continue;
 
 		} else {
+			nsub++;	/* make sure subs[nsub] is freed */
 			goto cleanup;
 		}
 
@@ -176,10 +179,6 @@ rewrite_subst_compile(
 	 */
 	tmps = (struct berval * )realloc( subs, sizeof( struct berval )*( nsub + 1 ) );
 	if ( tmps == NULL ) {
-		/*
-		 * XXX need to free the value subst stuff!
-		 */
-		free( subs );
 		goto cleanup;
 	}
 	subs = tmps;
@@ -200,6 +199,7 @@ rewrite_subst_compile(
 
 	s = calloc( sizeof( struct rewrite_subst ), 1 );
 	if ( s == NULL ) {
+		nsub++;	/* make sure last elements are freed */
 		goto cleanup;
 	}
 
@@ -213,13 +213,13 @@ rewrite_subst_compile(
 cleanup:;
 	if ( subs ) {
 		for ( l=0; l<nsub; l++ ) {
-			free( subs[nsub].bv_val );
+			free( subs[l].bv_val );
 		}
 		free( subs );
 	}
 	if ( submatch ) {
 		for ( l=0; l<nsub; l++ ) {
-			free( submatch[nsub].ls_map );
+			free( submatch[l].ls_map );
 		}
 		free( submatch );
 	}
-- 
2.47.2