sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-26 21:57:41 +03:00
Code

librpc/rpc: keep talloc hierachie sane in dcerpc_parse_binding()

Browse Source 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
This commit is contained in:
Stefan Metzmacher 2014-01-15 15:22:47 +01:00 committed by Günther Deschner
parent 7c0985bb35
commit 5d22127118
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
librpc/rpc/binding.c
View File

@ -374,13 +374,18 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc
}
for (i=0; (p = strchr(options, ',')); i++) {
b->options[i] = talloc_strndup(b, options, PTR_DIFF(p, options));
b->options[i] = talloc_strndup(b->options,
options,
PTR_DIFF(p, options));
if (!b->options[i]) {
return NT_STATUS_NO_MEMORY;
}
options = p+1;
}
b->options[i] = options;
b->options[i] = talloc_strdup(b->options, options);
if (!b->options[i]) {
return NT_STATUS_NO_MEMORY;
}
b->options[i+1] = NULL;
/* some options are pre-parsed for convenience */
@ -388,6 +393,7 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc
for (j=0;j<ARRAY_SIZE(ncacn_options);j++) {
size_t opt_len = strlen(ncacn_options[j].name);
if (strncasecmp(ncacn_options[j].name, b->options[i], opt_len) == 0) {
char *o = discard_const_p(char, b->options[i]);
int k;
char c = b->options[i][opt_len];
@ -398,6 +404,7 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc
}
b->flags |= ncacn_options[j].flag;
talloc_free(o);
for (k=i;b->options[k];k++) {
b->options[k] = b->options[k+1];
}
@ -409,8 +416,12 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc
if (b->options[0] && strchr(b->options[0], '=') == NULL) {
/* Endpoint is first option */
b->endpoint = b->options[0];
if (strlen(b->endpoint) == 0) b->endpoint = NULL;
b->endpoint = talloc_steal(b, b->options[0]);
if (strlen(b->endpoint) == 0) {
char *e = discard_const_p(char, b->endpoint);
talloc_free(e);
b->endpoint = NULL;
}
for (i=0;b->options[i];i++) {
b->options[i] = b->options[i+1];