From fb67aa65d9a4955e0e8214b86fc3af93d96e355e Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Sat, 7 Feb 2026 09:30:21 +0000
Subject: [PATCH] ITS#10450 slapd get_filter: plug leak on failed filter list

---
 servers/slapd/filter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/servers/slapd/filter.c b/servers/slapd/filter.c
index 18970a4eb3..bd946438ea 100644
--- a/servers/slapd/filter.c
+++ b/servers/slapd/filter.c
@@ -230,6 +230,7 @@ get_filter0(
 		Debug( LDAP_DEBUG_FILTER, "AND\n" );
 		err = get_filter_list( op, ber, &f.f_and, text, depth+1 );
 		if ( err != LDAP_SUCCESS ) {
+			filter_free_x( op, &f, 0 );
 			break;
 		}
 		if ( f.f_and == NULL ) {
@@ -243,6 +244,7 @@ get_filter0(
 		Debug( LDAP_DEBUG_FILTER, "OR\n" );
 		err = get_filter_list( op, ber, &f.f_or, text, depth+1 );
 		if ( err != LDAP_SUCCESS ) {
+			filter_free_x( op, &f, 0 );
 			break;
 		}
 		if ( f.f_or == NULL ) {
@@ -342,6 +344,7 @@ get_filter_list( Operation *op, BerElement *ber,
 	char		*last;
 
 	Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n" );
+	*f = NULL;
 	new = f;
 	for ( tag = ber_first_element( ber, &len, &last );
 		tag != LBER_DEFAULT;