sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

librpc:ndr: Fix leaks

Browse Source 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton 2023-08-07 13:46:50 +12:00 committed by Andrew Bartlett
parent 38b93532a7
commit 6913aebd59
2 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
librpc/ndr/ndr.c
View File

@ -890,7 +890,13 @@ _PUBLIC_ enum ndr_err_code ndr_push_subcontext_start(struct ndr_push *ndr,
subndr->flags = ndr->flags & ~LIBNDR_FLAG_NDR64; subndr->flags = ndr->flags & ~LIBNDR_FLAG_NDR64;
if (size_is > 0) { if (size_is > 0) {
NDR_CHECK(ndr_push_zero(subndr, size_is)); enum ndr_err_code status;
status = ndr_push_zero(subndr, size_is);
if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
talloc_free(subndr);
return status;
}
subndr->offset = 0; subndr->offset = 0;
subndr->relative_end_offset = size_is; subndr->relative_end_offset = size_is;
} }
@ -1435,7 +1441,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem
ndr = ndr_push_init_ctx(mem_ctx); ndr = ndr_push_init_ctx(mem_ctx);
NDR_ERR_HAVE_NO_MEMORY(ndr); NDR_ERR_HAVE_NO_MEMORY(ndr);
NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p)); NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
*blob = ndr_push_blob(ndr); *blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob->data); talloc_steal(mem_ctx, blob->data);
@ -1483,8 +1489,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_
ndr = ndr_push_init_ctx(mem_ctx); ndr = ndr_push_init_ctx(mem_ctx);
NDR_ERR_HAVE_NO_MEMORY(ndr); NDR_ERR_HAVE_NO_MEMORY(ndr);
NDR_CHECK(ndr_push_set_switch_value(ndr, p, level)); NDR_CHECK_FREE(ndr_push_set_switch_value(ndr, p, level));
NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p)); NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
*blob = ndr_push_blob(ndr); *blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob->data); talloc_steal(mem_ctx, blob->data);

7
librpc/ndr/ndr_sec_helper.c
View File

@ -217,7 +217,11 @@ enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct
subndr->data_size = 28; subndr->data_size = 28;
subndr->offset = 0; subndr->offset = 0;
NDR_CHECK(ndr_pull_advance(ndr, 28)); status = ndr_pull_advance(ndr, 28);
if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
talloc_free(subndr);
return status;
}
status = ndr_pull_dom_sid(subndr, ndr_flags, sid); status = ndr_pull_dom_sid(subndr, ndr_flags, sid);
if (!NDR_ERR_CODE_IS_SUCCESS(status)) { if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
@ -227,6 +231,7 @@ enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct
ZERO_STRUCT(sid->sub_auths); ZERO_STRUCT(sid->sub_auths);
} }
talloc_free(subndr);
return NDR_ERR_SUCCESS; return NDR_ERR_SUCCESS;
} }