Bug(s) fixed: 179135

Bug Description: memory leaks using ber_scanf when handling bad BER packets
Reviewed by: All (Thanks!)
Files: https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=123783
Branch: HEAD
Fix Description:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135#c0
I basically did a search through our code for all calls to ber_scanf,
ber_get_stringa, and ber_get_stringal and made sure we properly free any
arguments that may have been allocated.  There was a bug in the ldapsdk
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135 that causes
us to free uninitialized memory when trying to clean up the result of
ber_get_stringal (or ber_scanf with 'V').  I had to initialize some
variables to NULL so that we could properly clean them up, and added
some additional clean ups that were missing.  Also, in repl_extop.c, we
were calling free on an array that we should have been calling
ch_array_free on.  Yet another lesson in the evils of slapi_ch_free and
disabling compiler type checks in general.
Platforms tested: Fedora Core 4
Flag Day: no
Doc impact: no

1 files changed, 3 insertions, 1 deletions

diff --git a/ldap/servers/slapd/ava.c b/ldap/servers/slapd/ava.c
index a1974db8..7ea35f0a 100644
--- a/ldap/servers/slapd/ava.c
+++ b/ldap/servers/slapd/ava.c
@@ -53,10 +53,12 @@ get_ava(
     struct ava	*ava
 )
 {
-	char	*type;
+	char	*type = NULL;
 
 	if ( ber_scanf( ber, "{ao}", &type, &ava->ava_value )
 	    == LBER_ERROR ) {
+        slapi_ch_free_string(&type);
+        ava_done(ava);
 		LDAPDebug( LDAP_DEBUG_ANY, "  get_ava ber_scanf\n", 0, 0, 0 );
 		return( LDAP_PROTOCOL_ERROR );
 	}