Do not leak BerElements

servers/lloadd/client.c

@@ -115,6 +115,8 @@ fail:
                 op, LDAP_OTHER, "server error or overloaded", 1 );
         op->o_client = NULL;
         operation_destroy( op );
+    } else if ( ber ) {
+        ber_free( ber, 1 );
     }
 
     client_destroy( c );

servers/lloadd/connection.c

@@ -64,6 +64,9 @@ connection_destroy( Connection *c )
     if ( c->c_currentber ) {
         ber_free( c->c_currentber, 1 );
     }
+    if ( c->c_pendingber ) {
+        ber_free( c->c_pendingber, 1 );
+    }
 
     ldap_pvt_thread_mutex_unlock( &c->c_mutex );
 

servers/lloadd/operation.c

@@ -232,7 +232,7 @@ operation_abandon( Operation *op )
             Debug( LDAP_DEBUG_ANY, "operation_abandon: "
                     "ber_alloc failed\n" );
             ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
-            return;
+            goto done;
         }
         c->c_pendingber = ber;
 
@@ -240,13 +240,15 @@ operation_abandon( Operation *op )
                 LDAP_TAG_MSGID, c->c_next_msgid++,
                 LDAP_REQ_ABANDON, op->o_upstream_msgid );
 
-        ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
-
         if ( rc == -1 ) {
             ber_free( ber, 1 );
-            return;
         }
-        upstream_write_cb( -1, 0, c );
+
+        ldap_pvt_thread_mutex_unlock( &c->c_io_mutex );
+
+        if ( rc != -1 ) {
+            upstream_write_cb( -1, 0, c );
+        }
     }
 
 done:

servers/lloadd/upstream.c

@@ -572,7 +572,7 @@ upstream_bind_cb( evutil_socket_t s, short what, void *arg )
 {
     Connection *c = arg;
     BerElement *ber;
-    char *matcheddn = NULL, *message = NULL;
+    BerValue matcheddn, message;
     ber_tag_t tag;
     ber_len_t len;
     ber_int_t msgid, result;
@@ -622,7 +622,7 @@ upstream_bind_cb( evutil_socket_t s, short what, void *arg )
         goto fail;
     }
 
-    if ( ber_scanf( ber, "{eAA" /* "}" */, &result, &matcheddn, &message ) ==
+    if ( ber_scanf( ber, "{emm" /* "}" */, &result, &matcheddn, &message ) ==
                  LBER_ERROR ) {
         Debug( LDAP_DEBUG_ANY, "upstream_bind_cb: "
                 "response does not conform with a bind response\n" );
@@ -640,20 +640,16 @@ upstream_bind_cb( evutil_socket_t s, short what, void *arg )
         default:
             Debug( LDAP_DEBUG_ANY, "upstream_bind_cb: "
                     "upstream bind failed, rc=%d, message='%s'\n",
-                    result, message );
+                    result, message.bv_val );
             goto fail;
     }
 
-    if ( matcheddn ) ber_memfree( matcheddn );
-    if ( message ) ber_memfree( message );
-
     ldap_pvt_thread_mutex_unlock( &c->c_mutex );
 
+    ber_free( ber, 1 );
     return;
-fail:
-    if ( matcheddn ) ber_memfree( matcheddn );
-    if ( message ) ber_memfree( message );
 
+fail:
     ber_free( ber, 1 );
     upstream_destroy( c );
 }