reset o_next pointer before freeing the operation (otherwise an assertion

failure in slap_op_free is possible)

servers/slapd/abandon.c

@@ -103,6 +103,7 @@ do_abandon( Operation *op, SlapReply *rs )
 		if ( o->o_msgid == id ) {
 			LDAP_STAILQ_REMOVE( &op->o_conn->c_pending_ops,
 				o, slap_op, o_next );
+			LDAP_STAILQ_NEXT(o, o_next) = NULL;
 			op->o_conn->c_n_ops_pending--;
 			slap_op_free( o );
 			goto done;

servers/slapd/cancel.c

@@ -66,6 +66,7 @@ int cancel_extop( Operation *op, SlapReply *rs )
 	LDAP_STAILQ_FOREACH( o, &op->o_conn->c_pending_ops, o_next ) {
 		if ( o->o_msgid == opid ) {
 			LDAP_STAILQ_REMOVE( &op->o_conn->c_pending_ops, o, slap_op, o_next );
+			LDAP_STAILQ_NEXT(o, o_next) = NULL;
 			op->o_conn->c_n_ops_pending--;
 			slap_op_free( o );
 			found = 1;