All "o=foo" add to suffix "" if bound as root.

servers/slapd/back-bdb2/add.c

@@ -52,9 +52,13 @@ bdb2i_back_add_internal(
 	 * add the entry.
 	 */
 
-	if ( (pdn = dn_parent( be, e->e_ndn )) != NULL ) {
+	pdn = dn_parent( be, e->e_ndn );
+
+	if( pdn != NULL && *pdn != '\0' && !be_issuffix(be, "") ) {
 		char *matched = NULL;
 
+		assert( *pdn != '\0' );
+
 		/* get parent with writer lock */
 		if ( (p = bdb2i_dn2entry_w( be, pdn, &matched )) == NULL ) {
 			Debug( LDAP_DEBUG_TRACE, "parent does not exist\n", 0,
@@ -93,10 +97,17 @@ bdb2i_back_add_internal(
 		}
 
 	} else {
+		if(pdn != NULL) {
+			assert( *pdn == '\0' );
+			free(pdn);
+		}
+
 		/* no parent, must be adding entry to root */
 		if ( ! be_isroot( be, op->o_ndn ) ) {
-			Debug( LDAP_DEBUG_TRACE, "no parent & not root\n", 0,
-			    0, 0 );
+			Debug( LDAP_DEBUG_TRACE, "%s add denied\n",
+				pdn == NULL ? "suffix" : "entry at root",
+				0, 0 );
+
 			send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
 			    "", "" );