Minor cleanup (coverity)

libraries/libldap/cyrus.c

@@ -1171,6 +1171,7 @@ void *ldap_pvt_sasl_mutex_new(void)
 	if ( ldap_pvt_thread_mutex_init( mutex ) == 0 ) {
 		return mutex;
 	}
+	LDAP_FREE( mutex );
 #ifndef LDAP_DEBUG_R_SASL
 	assert( 0 );
 #endif /* !LDAP_DEBUG_R_SASL */

libraries/libldap/dnssrv.c

@@ -361,12 +361,14 @@ int ldap_domain2hostlist(
 		hostent_head[hostent_count].priority=priority;
 		hostent_head[hostent_count].weight=weight;
 		hostent_head[hostent_count].port=port;
-		strncpy(hostent_head[hostent_count].hostname, host, MAXHOST);
+		strncpy(hostent_head[hostent_count].hostname, host, MAXHOST-1);
+		hostent_head[hostent_count].hostname[MAXHOST-1] = '\0';
 		hostent_count++;
 	    }
 add_size:;
 	    p += size;
 	}
+	if (!hostent_head) goto out;
     qsort(hostent_head, hostent_count, sizeof(srv_record), srv_cmp);
 
 	if (!srv_seed)

libraries/libldap/filter.c

@@ -77,7 +77,6 @@ static int ldap_is_oid ( const char *str )
 				dot=0;
 
 			} else if ( str[i] == '.' ) {
-				if( dot ) return 0;
 				if( ++dot > 1 ) return 0;
 
 			} else {
@@ -120,7 +119,6 @@ static int ldap_is_desc ( const char *str )
 				dot=0;
 
 			} else if ( str[i] == '.' ) {
-				if( dot ) return 0;
 				if( ++dot > 1 ) return 0;
 
 			} else {
@@ -938,7 +936,7 @@ ldap_put_vrFilter( BerElement *ber, const char *str_in )
 	int rc =0;
 	
 	if ( ber_printf( ber, "{" /*"}"*/ ) == -1 ) {
-		rc = -1;
+		return -1;
 	}
 	
 	rc = put_vrFilter( ber, str_in );

libraries/librewrite/subst.c

@@ -155,6 +155,7 @@ rewrite_subst_compile(
 			tmpsm = ( struct rewrite_submatch * )realloc( submatch,
 					sizeof( struct rewrite_submatch )*( nsub + 1 ) );
 			if ( tmpsm == NULL ) {
+				rewrite_map_destroy( &map );
 				goto cleanup;
 			}
 			submatch = tmpsm;

servers/slapd/back-bdb/attr.c

@@ -212,6 +212,10 @@ bdb_attr_index_config(
 				fprintf( stderr, "%s: line %d: %s\n",
 					fname, lineno, c_reply->msg );
 			}
+fail:
+#ifdef LDAP_COMP_MATCH
+			ch_free( cr );
+#endif
 			goto done;
 		}
 
@@ -223,7 +227,7 @@ bdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_UNWILLING_TO_PERFORM;
-			goto done;
+			goto fail;
 		}
 
 		if( IS_SLAP_INDEX( mask, SLAP_INDEX_APPROX ) && !(
@@ -238,7 +242,7 @@ bdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_INAPPROPRIATE_MATCHING;
-			goto done;
+			goto fail;
 		}
 
 		if( IS_SLAP_INDEX( mask, SLAP_INDEX_EQUALITY ) && !(
@@ -253,7 +257,7 @@ bdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_INAPPROPRIATE_MATCHING;
-			goto done;
+			goto fail;
 		}
 
 		if( IS_SLAP_INDEX( mask, SLAP_INDEX_SUBSTR ) && !(
@@ -268,7 +272,7 @@ bdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_INAPPROPRIATE_MATCHING;
-			goto done;
+			goto fail;
 		}
 
 		Debug( LDAP_DEBUG_CONFIG, "index %s 0x%04lx\n",
@@ -303,7 +307,7 @@ bdb_attr_index_config(
 				if ( rc != LDAP_SUCCESS) {
 					fprintf( stderr, " error during inserting component reference in %s ", attrs[i]);
 					rc = LDAP_PARAM_ERROR;
-					goto done;
+					goto fail;
 				}
 				continue;
 			} else {
@@ -311,7 +315,8 @@ bdb_attr_index_config(
 				if ( rc != LDAP_SUCCESS) {
 					fprintf( stderr, " error during inserting component reference in %s ", attrs[i]);
 					rc = LDAP_PARAM_ERROR;
-					goto done;
+					ch_free( a );
+					goto fail;
 				}
 			}
 		}

servers/slapd/back-mdb/attr.c

@@ -309,6 +309,10 @@ mdb_attr_index_config(
 				fprintf( stderr, "%s: line %d: %s\n",
 					fname, lineno, c_reply->msg );
 			}
+fail:
+#ifdef LDAP_COMP_MATCH
+			ch_free( cr );
+#endif
 			goto done;
 		}
 
@@ -320,7 +324,7 @@ mdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_UNWILLING_TO_PERFORM;
-			goto done;
+			goto fail;
 		}
 
 		if( IS_SLAP_INDEX( mask, SLAP_INDEX_APPROX ) && !(
@@ -335,7 +339,7 @@ mdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_INAPPROPRIATE_MATCHING;
-			goto done;
+			goto fail;
 		}
 
 		if( IS_SLAP_INDEX( mask, SLAP_INDEX_EQUALITY ) && !(
@@ -350,7 +354,7 @@ mdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_INAPPROPRIATE_MATCHING;
-			goto done;
+			goto fail;
 		}
 
 		if( IS_SLAP_INDEX( mask, SLAP_INDEX_SUBSTR ) && !(
@@ -365,7 +369,7 @@ mdb_attr_index_config(
 					fname, lineno, c_reply->msg );
 			}
 			rc = LDAP_INAPPROPRIATE_MATCHING;
-			goto done;
+			goto fail;
 		}
 
 		Debug( LDAP_DEBUG_CONFIG, "index %s 0x%04lx\n",
@@ -398,11 +402,12 @@ mdb_attr_index_config(
 				 * just add the extracted component reference
 				 * in the AttrInfo
 				 */
+				ch_free( a );
 				rc = insert_component_reference( cr, &a_cr->ai_cr );
 				if ( rc != LDAP_SUCCESS) {
 					fprintf( stderr, " error during inserting component reference in %s ", attrs[i]);
 					rc = LDAP_PARAM_ERROR;
-					goto done;
+					goto fail;
 				}
 				continue;
 			} else {
@@ -410,7 +415,8 @@ mdb_attr_index_config(
 				if ( rc != LDAP_SUCCESS) {
 					fprintf( stderr, " error during inserting component reference in %s ", attrs[i]);
 					rc = LDAP_PARAM_ERROR;
-					goto done;
+					ch_free( a );
+					goto fail;
 				}
 			}
 		}

servers/slapd/back-meta/search.c

@@ -1627,8 +1627,6 @@ err_pr:;
 								}
 							}
 #endif /* SLAPD_META_CLIENT_PR */
-
-							ldap_controls_free( ctrls );
 						}
 						/* fallthru */
 
@@ -1679,6 +1677,7 @@ err_pr:;
 						break;
 					}
 	
+					ldap_controls_free( ctrls );
 					last = i;
 					rc = 0;
 	

servers/slapd/back-sql/schema-map.c

@@ -421,6 +421,7 @@ backsql_oc_get_attr_mapping( void *v_oc, void *v_bas )
 				Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_attr_mapping(): "
 					"unable to fetch attribute \"%s\": %s (%d)\n",
 					buf, text, rc );
+				ch_free( at_map );
 				return BACKSQL_AVL_STOP;
 			}
 		}
@@ -469,6 +470,7 @@ backsql_oc_get_attr_mapping( void *v_oc, void *v_bas )
 					"in objectClass \"%s\" map\n",
 					at_map->bam_ad->ad_cname.bv_val,
 					oc_map->bom_oc->soc_cname.bv_val, 0 );
+			ch_free( at_map );
 		}
 
 		if ( !BER_BVISNULL( &bas->bas_bi->sql_upper_func ) &&
@@ -628,6 +630,7 @@ backsql_load_schema_map( backsql_info *bi, SQLHDBC dbh )
 			Debug( LDAP_DEBUG_TRACE, "backsql_load_schema_map(): "
 				"objectClass \"%s\" is not defined in schema\n", 
 				oc_row.cols[ 1 ], 0, 0 );
+			ch_free( oc_map );
 			return LDAP_OTHER;	/* undefined objectClass ? */
 		}
 		
@@ -646,6 +649,7 @@ backsql_load_schema_map( backsql_info *bi, SQLHDBC dbh )
 			Debug( LDAP_DEBUG_TRACE, "backsql_load_schema_map(): "
 				"unable to parse expect_return=\"%s\" for objectClass \"%s\"\n", 
 				oc_row.cols[ delete_proc_idx + 1 ], oc_row.cols[ 1 ], 0 );
+			ch_free( oc_map );
 			return LDAP_OTHER;
 		}
 
@@ -666,6 +670,7 @@ backsql_load_schema_map( backsql_info *bi, SQLHDBC dbh )
 						text, rc );
 				backsql_PrintErrors( bi->sql_db_env, dbh,
 						sth, rc );
+				ch_free( oc_map );
 				return LDAP_OTHER;
 			}
 		}
@@ -680,6 +685,7 @@ backsql_load_schema_map( backsql_info *bi, SQLHDBC dbh )
 			Debug( LDAP_DEBUG_TRACE, "backsql_load_schema_map(): "
 					"duplicate objectClass \"%s\" in objectClass map\n",
 					oc_map->bom_oc->soc_cname.bv_val, 0, 0 );
+			ch_free( oc_map );
 			return LDAP_OTHER;
 		}
 		if ( avl_insert( &bi->sql_oc_by_id, oc_map, backsql_cmp_oc_id, avl_dup_error ) == -1 ) {

servers/slapd/component.c

@@ -945,7 +945,7 @@ static int
 get_item( Operation *op, ComponentAssertionValue* cav, ComponentAssertion** ca,
 		const char** text )
 {
-	int rc;
+	int rc, freeval = 0;
 	ComponentAssertion* _ca;
 	struct berval value;
 	MatchingRule* mr;
@@ -960,20 +960,25 @@ get_item( Operation *op, ComponentAssertionValue* cav, ComponentAssertion** ca,
 
 	_ca->ca_comp_data.cd_tree = NULL;
 	_ca->ca_comp_data.cd_mem_op = NULL;
+	BER_BVZERO( &_ca->ca_ma_value );
 
 	rc = peek_cav_str( cav, "component" );
 	if ( rc == LDAP_SUCCESS ) {
 		strip_cav_str( cav, "component" );
 		rc = get_component_reference( op, cav, &_ca->ca_comp_ref, text );
 		if ( rc != LDAP_SUCCESS ) {
+			rc = LDAP_INVALID_SYNTAX;
+fail:
+			if ( freeval )
+				op->o_tmpfree( _ca->ca_ma_value.bv_val, op->o_tmpmemctx );
 			if ( op )
 				op->o_tmpfree( _ca, op->o_tmpmemctx );
 			else
 				free( _ca );
-			return LDAP_INVALID_SYNTAX;
+			return rc;
 		}
 		if ( ( rc = strip_cav_str( cav,",") ) != LDAP_SUCCESS )
-			return rc;
+			goto fail;
 	} else {
 		_ca->ca_comp_ref = NULL;
 	}
@@ -982,35 +987,26 @@ get_item( Operation *op, ComponentAssertionValue* cav, ComponentAssertion** ca,
 	if ( rc == LDAP_SUCCESS ) {
 		rc = get_ca_use_default( op, cav, &_ca->ca_use_def, text );
 		if ( rc != LDAP_SUCCESS ) {
-			if ( op )
-				op->o_tmpfree( _ca, op->o_tmpmemctx );
-			else
-				free( _ca );
-			return LDAP_INVALID_SYNTAX;
+			rc = LDAP_INVALID_SYNTAX;
+			goto fail;
 		}
 		if ( ( rc = strip_cav_str( cav,",") ) != LDAP_SUCCESS )
-			return rc;
+			goto fail;
 	}
 	else _ca->ca_use_def = 1;
 
 	if ( !( strip_cav_str( cav, "rule" ) == LDAP_SUCCESS &&
 		get_matching_rule( op, cav , &_ca->ca_ma_rule, text ) == LDAP_SUCCESS )) {
-		if ( op )
-			op->o_tmpfree( _ca, op->o_tmpmemctx );
-		else
-			free( _ca );
-		return LDAP_INAPPROPRIATE_MATCHING;
+		rc = LDAP_INAPPROPRIATE_MATCHING;
+		goto fail;
 	}
 	
 	if ( ( rc = strip_cav_str( cav,",") ) != LDAP_SUCCESS )
-		return rc;
+		goto fail;
 	if ( !(strip_cav_str( cav, "value" ) == LDAP_SUCCESS &&
 		get_matching_value( op, _ca, cav,&value ,text ) == LDAP_SUCCESS )) {
-		if ( op )
-			op->o_tmpfree( _ca, op->o_tmpmemctx );
-		else
-			free( _ca );
-		return LDAP_INVALID_SYNTAX;
+		rc = LDAP_INVALID_SYNTAX;
+		goto fail;
 	}
 
 	/*
@@ -1026,7 +1022,8 @@ get_item( Operation *op, ComponentAssertionValue* cav, ComponentAssertion** ca,
 			NULL, mr,
 			&value, &_ca->ca_ma_value, op->o_tmpmemctx );
 		if ( rc != LDAP_SUCCESS )
-			return rc;
+			goto fail;
+		freeval = 1;
 	}
 	else
 		_ca->ca_ma_value = value;
@@ -1034,7 +1031,8 @@ get_item( Operation *op, ComponentAssertionValue* cav, ComponentAssertion** ca,
 	 * Validate the value of this component assertion
 	 */
 	if ( op && mr->smr_syntax->ssyn_validate( mr->smr_syntax, &_ca->ca_ma_value) != LDAP_SUCCESS ) {
-		return LDAP_INVALID_SYNTAX;
+		rc = LDAP_INVALID_SYNTAX;
+		goto fail;
 	}
 
 
@@ -1044,13 +1042,8 @@ get_item( Operation *op, ComponentAssertionValue* cav, ComponentAssertion** ca,
 		bv.bv_val = cav->cav_ptr;
 		bv.bv_len = cav_cur_len( cav );
 		rc = get_comp_filter( op, &bv,(ComponentFilter**)&_ca->ca_cf, text );
-		if ( rc != LDAP_SUCCESS ) {
-			if ( op )
-				op->o_tmpfree( _ca, op->o_tmpmemctx );
-			else
-				free( _ca );
-			return rc;
-		}
+		if ( rc != LDAP_SUCCESS )
+			goto fail;
 		cav->cav_ptr = bv.bv_val;
 		assert( cav->cav_end >= bv.bv_val );
 	}

servers/slapd/config.c

@@ -2010,7 +2010,7 @@ slap_client_connect( LDAP **ldp, slap_bindconf *sb )
 			"slap_client_connect: "
 			"URI=%s TLS context initialization failed (%d)\n",
 			sb->sb_uri.bv_val, rc, 0 );
-		return rc;
+		goto done;
 	}
 #endif
 

servers/slapd/connection.c

@@ -669,8 +669,6 @@ connection_destroy( Connection *c )
 
 	sd = c->c_sd;
 	c->c_sd = AC_SOCKET_INVALID;
-	c->c_conn_state = SLAP_C_INVALID;
-	c->c_struct_state = SLAP_C_UNUSED;
 	c->c_close_reason = "?";			/* should never be needed */
 
 	sb = c->c_sb;
@@ -679,6 +677,8 @@ connection_destroy( Connection *c )
 		ber_len_t max = sockbuf_max_incoming;
 		ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &max );
 	}
+	c->c_conn_state = SLAP_C_INVALID;
+	c->c_struct_state = SLAP_C_UNUSED;
 
 	/* c must be fully reset by this point; when we call slapd_remove
 	 * it may get immediately reused by a new connection.
@@ -1242,8 +1242,6 @@ void connection_client_stop(
 	assert( c->c_conn_state == SLAP_C_CLIENT );
 
 	c->c_listener = NULL;
-	c->c_conn_state = SLAP_C_INVALID;
-	c->c_struct_state = SLAP_C_UNUSED;
 	c->c_sd = AC_SOCKET_INVALID;
 	c->c_close_reason = "?";			/* should never be needed */
 	sb = c->c_sb;
@@ -1252,6 +1250,8 @@ void connection_client_stop(
 		ber_len_t max = sockbuf_max_incoming;
 		ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &max );
 	}
+	c->c_conn_state = SLAP_C_INVALID;
+	c->c_struct_state = SLAP_C_UNUSED;
 	slapd_remove( s, sb, 0, 1, 0 );
 
 	connection_return( c );

servers/slapd/controls.c

@@ -304,6 +304,7 @@ register_supported_control2(const char *controloid,
 	if ( sc == NULL ) {
 		sc = (struct slap_control *)SLAP_MALLOC( sizeof( *sc ) );
 		if ( sc == NULL ) {
+			ber_bvarray_free( extendedopsbv );
 			return LDAP_NO_MEMORY;
 		}
 

servers/slapd/daemon.c

@@ -1361,7 +1361,10 @@ slap_open_listener(
 #endif /* LDAP_PF_LOCAL || SLAP_X_LISTENER_MOD */
 
 	ldap_free_urldesc( lud );
-	if ( err ) return -1;
+	if ( err ) {
+		slap_free_listener_addresses(sal);
+		return -1;
+	}
 
 	/* If we got more than one address returned, we need to make space
 	 * for it in the slap_listeners array.

servers/slapd/overlays/dynlist.c

@@ -1158,6 +1158,12 @@ done_uri:;
 					filter_free( filter );
 				}
 
+				while ( dlm != NULL ) {
+					dlml = dlm;
+					dlm = dlm->dlm_next;
+					ch_free( dlml );
+				}
+
 				Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 					c->log, c->cr_msg, 0 );
 
@@ -1174,7 +1180,8 @@ done_uri:;
 				c->argv[ attridx ] );
 			Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 				c->log, c->cr_msg, 0 );
-			return 1;
+			rc = 1;
+			goto done_uri;
 		}
 
 		if ( !is_at_subtype( ad->ad_type, slap_schema.si_ad_labeledURI->ad_type ) ) {
@@ -1184,7 +1191,8 @@ done_uri:;
 				c->argv[ attridx ] );
 			Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 				c->log, c->cr_msg, 0 );
-			return 1;
+			rc = 1;
+			goto done_uri;
 		}
 
 		attridx++;
@@ -1213,7 +1221,8 @@ done_uri:;
 						i - 3, c->argv[ i ] );
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 						c->log, c->cr_msg, 0 );
-					return 1;
+					rc = 1;
+					goto done_uri;
 				}
 				arg = cp + 1;
 			}
@@ -1226,7 +1235,8 @@ done_uri:;
 					i - 3, c->argv[ i ] );
 				Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 					c->log, c->cr_msg, 0 );
-				return 1;
+				rc = 1;
+				goto done_uri;
 			}
 
 			dlmp = (dynlist_map_t *)ch_calloc( 1, sizeof( dynlist_map_t ) );
@@ -1255,7 +1265,8 @@ done_uri:;
 						c->valx );
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 						c->log, c->cr_msg, 0 );
-					return 1;
+					rc = 1;
+					goto done_uri;
 				}
 				dlip = &(*dlip)->dli_next;
 			}

servers/slapd/overlays/pcache.c

@@ -456,8 +456,10 @@ ftemp_attrs( struct berval *ftemp, struct berval *template,
 
 		p2 = strchr( p1, '=' );
 		if ( !p2 ) {
-			if ( !descs )
+			if ( !descs ) {
+				ch_free( temp2 );
 				return -1;
+			}
 			break;
 		}
 		i = p2 - p1;
@@ -471,6 +473,7 @@ ftemp_attrs( struct berval *ftemp, struct berval *template,
 		ad = NULL;
 		i = slap_bv2ad( &bv, &ad, text );
 		if ( i ) {
+			ch_free( temp2 );
 			ch_free( descs );
 			return -1;
 		}
@@ -566,6 +569,7 @@ bottom:
 	}
 	if ( !t_cnt ) {
 		*text = "couldn't parse template";
+		ch_free(attrs);
 		return -1;
 	}
 	if ( !got_oc && !( set->flags & PC_GOT_OC )) {

servers/slapd/overlays/ppolicy.c

@@ -382,6 +382,7 @@ create_passcontrol( Operation *op, int exptime, int grace, LDAPPasswordPolicyErr
 	BerElement *ber = (BerElement *) &berbuf, *b2 = (BerElement *) &bb2;
 	LDAPControl c = { 0 }, *cp;
 	struct berval bv;
+	int rc;
 
 	BER_BVZERO( &c.ldctl_value );
 
@@ -391,15 +392,23 @@ create_passcontrol( Operation *op, int exptime, int grace, LDAPPasswordPolicyErr
 	if ( exptime >= 0 ) {
 		ber_init2( b2, NULL, LBER_USE_DER );
 		ber_printf( b2, "ti", PPOLICY_EXPIRE, exptime );
-		ber_flatten2( b2, &bv, 1 );
+		rc = ber_flatten2( b2, &bv, 1 );
 		(void)ber_free_buf(b2);
+		if (rc == -1) {
+			cp = NULL;
+			goto fail;
+		}
 		ber_printf( ber, "tO", PPOLICY_WARNING, &bv );
 		ch_free( bv.bv_val );
 	} else if ( grace > 0 ) {
 		ber_init2( b2, NULL, LBER_USE_DER );
 		ber_printf( b2, "ti", PPOLICY_GRACE, grace );
-		ber_flatten2( b2, &bv, 1 );
+		rc = ber_flatten2( b2, &bv, 1 );
 		(void)ber_free_buf(b2);
+		if (rc == -1) {
+			cp = NULL;
+			goto fail;
+		}
 		ber_printf( ber, "tO", PPOLICY_WARNING, &bv );
 		ch_free( bv.bv_val );
 	}
@@ -418,6 +427,7 @@ create_passcontrol( Operation *op, int exptime, int grace, LDAPPasswordPolicyErr
 	cp->ldctl_value.bv_val = (char *)&cp[1];
 	cp->ldctl_value.bv_len = c.ldctl_value.bv_len;
 	AC_MEMCPY( cp->ldctl_value.bv_val, c.ldctl_value.bv_val, c.ldctl_value.bv_len );
+fail:
 	(void)ber_free_buf(ber);
 	
 	return cp;

servers/slapd/overlays/rwmmap.c

@@ -215,8 +215,9 @@ rwm_map_attrnames(
 		return LDAP_NO_MEMORY;
 	}
 
+	j = 0;
 	if ( an != NULL ) {
-	for ( i = 0, j = 0; !BER_BVISNULL( &an[i].an_name ); i++ ) {
+	for ( i = 0; !BER_BVISNULL( &an[i].an_name ); i++ ) {
 		struct ldapmapping	*m;
 		int			at_drop_missing = 0,
 					oc_drop_missing = 0;

servers/slapd/schema_init.c

@@ -2680,8 +2680,10 @@ integerIndexer(
 				itmp.bv_len = maxstrlen;
 		}
 		rc = integerVal2Key( &values[i], &keys[i], &itmp, ctx );
-		if ( rc )
+		if ( rc ) {
+			slap_sl_free( keys, ctx );
 			goto func_leave;
+		}
 	}
 	*keysp = keys;
 func_leave:
@@ -2728,12 +2730,16 @@ integerFilter(
 	}
 
 	rc = integerVal2Key( value, keys, &iv, ctx );
-	if ( rc == 0 )
-		*keysp = keys;
 
 	if ( iv.bv_val != ibuf ) {
 		slap_sl_free( iv.bv_val, ctx );
 	}
+
+	if ( rc == 0 )
+		*keysp = keys;
+	else
+		slap_sl_free( keys, ctx );
+
 	return rc;
 }
 

servers/slapd/slapcommon.c

@@ -441,6 +441,7 @@ slap_tool_init(
 			}
 
 			if ( ludp->lud_dn != NULL && ludp->lud_dn[0] != '\0' ) {
+				ch_free( subtree );