[lacatoire]

ldap_set_rebind_proc() passed a pointer to its own argument slot as the callback context, which is stale once a referral is chased later. Pass the ldap_linkdata instead.

To reproduce

With a server answering dc=ref with a referral:

<?php
function cb($conn, $url) { echo "callback: ", get_class($conn), " $url\n"; return 0; }
function setup($l) { ldap_set_rebind_proc($l, 'cb'); }
function deeper($l, $d) { return $d > 0 ? deeper($l, $d - 1) : ldap_read($l, "dc=ref", "(objectClass=*)", ["cn"]); }

$l = ldap_connect("ldap://127.0.0.1:3899");
ldap_set_option($l, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_bind($l);
ldap_set_option($l, LDAP_OPT_REFERRALS, 1);
setup($l);
var_dump(deeper($l, 6));

Before (ASAN build): SEGV in _ldap_rebind_proc

After: callback: LDAP\Connection ldap://localhost:3899/dc=x