RE: Crash on recursive rebind following referral (ITS#3359)

[ian@underpressuredivers.com]

There are actually a lot of places where the return code from ldap_result is
checked to be == -1 or < 0 for error, and if that is not the case then it
goes on to look at the reply message, usually calling ldap_parse_result()
which will asert if the reply message pointer is NULL (as it is on a
timeout). These include calls to ldap_result() in ldapdelete.c,
ldapmodify.c, ldapmodrdn.c, add.c, bind.c, compare.c, delete.c, extend.c,
kbind.c, passwd.c, sasl.c, test.c and whoami.c.

In fact, the only places I can find that allow for a 0 return code from
ldap_result() being an error are in ldapsearch.c and search.c.