[master] fix SDB bug

3970.   [contrib]       Fixed a use after free bug in the SDB LDAP driver.
                        [RT #37237]

diff --git a/CHANGES b/CHANGES
index 963aab639a699dbf5ef3b93cd1859c3c0de6b4db..e7deb1f159c7042a4cacc75f6c213a88569bd690 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3970.   [contrib]       Fixed a use after free bug in the SDB LDAP driver.
+                        [RT #37237]
+
 3969.  [test]          Added 'delv' system test. [RT #36901]
 
 3968.  [bug]           Silence spurious log messages when using 'named -[46]'.

diff --git a/contrib/sdb/ldap/ldapdb.c b/contrib/sdb/ldap/ldapdb.c
index caade37c80e0a7ae8320d6faa3e921e094a90022..c43342cd27d0aaab832a160ed6f8899167b29fe4 100644 (file)
--- a/contrib/sdb/ldap/ldapdb.c
+++ b/contrib/sdb/ldap/ldapdb.c
@@ -133,7 +133,6 @@ ldapdb_getconn(struct ldapdb_data *data)
                        free(threaddata->index);
                        while (threaddata->data != NULL) {
                                conndata = threaddata->data;
-                               free(conndata->index);
                                if (conndata->data != NULL)
                                        ldap_unbind((LDAP *)conndata->data);
                                threaddata->data = conndata->next;