sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-26 21:57:41 +03:00
Code

printing: don't leak cache_path onto talloc tos

Browse Source 
Also check for allocation failures.

Reported-by: Franz Pförtsch <franz.pfoertsch@brose.com>
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
David Disseldorp 2014-10-06 18:21:15 +02:00 committed by Jeremy Allison
parent 3c592eaac6
commit 58b18e23e9
2 changed files with 25 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
source3/printing/printing.c
View File

@ -198,17 +198,28 @@ bool print_backend_init(struct messaging_context *msg_ctx)
int services = lp_numservices();
int snum;
bool ok;
char *print_cache_path;
if (!printer_list_parent_init()) {
return false;
}
ok = directory_create_or_exist(cache_path("printing"), 0755);
print_cache_path = cache_path("printing");
if (print_cache_path == NULL) {
return false;
}
ok = directory_create_or_exist(print_cache_path, 0755);
TALLOC_FREE(print_cache_path);
if (!ok) {
return false;
}
unlink(cache_path("printing.tdb"));
print_cache_path = cache_path("printing.tdb");
if (print_cache_path == NULL) {
return false;
}
unlink(print_cache_path);
TALLOC_FREE(print_cache_path);
/* handle a Samba upgrade */

15
source3/printing/printing_db.c
View File

@ -38,6 +38,8 @@ struct tdb_print_db *get_print_db_byname(const char *printername)
int num_open = 0;
char *printdb_path = NULL;
bool done_become_root = False;
char *print_cache_path;
int ret;
SMB_ASSERT(printername != NULL);
@ -93,9 +95,16 @@ struct tdb_print_db *get_print_db_byname(const char *printername)
DLIST_ADD(print_db_head, p);
}
if (asprintf(&printdb_path, "%s%s.tdb",
cache_path("printing/"),
printername) < 0) {
print_cache_path = cache_path("printing/");
if (print_cache_path == NULL) {
DLIST_REMOVE(print_db_head, p);
SAFE_FREE(p);
return NULL;
}
ret = asprintf(&printdb_path, "%s%s.tdb",
print_cache_path, printername);
TALLOC_FREE(print_cache_path);
if (ret < 0) {
DLIST_REMOVE(print_db_head, p);
SAFE_FREE(p);
return NULL;