Bug 635987 - Incorrect sub scope search result with

ACL containing ldap:///self

https://bugzilla.redhat.com/show_bug.cgi?id=635987

Description: When a basedn has no descendants, the code to take an
intersection of idl (which was returned from the filter search --
filter_candidates) and the basedn was skipped in subtree_candidates
(ldbm_search.c).  Regardless of descendants, the intersection should
be taken for the idl and a tree starting with the basedn.
Note: This bug was introduced with entryrdn.

ldap/servers/slapd/back-ldbm/ldbm_search.c

@@ -960,12 +960,10 @@ subtree_candidates(
         } else if (!has_tombstone_filter) {
             *err = ldbm_ancestorid_read(be, NULL, e->ep_id, &descendants);
         }
-        if (descendants) {
-            idl_insert(&descendants, e->ep_id);
-            candidates = idl_intersection(be, candidates, descendants);
-            idl_free(tmp);
-            idl_free(descendants);
-        }
+        idl_insert(&descendants, e->ep_id);
+        candidates = idl_intersection(be, candidates, descendants);
+        idl_free(tmp);
+        idl_free(descendants);
     }
 
     return( candidates );