From cd87b3b972b39003def69671d8a3c6aaf51afd50 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Fri, 9 Jul 2004 00:13:55 +0000
Subject: [PATCH] r1414: Memory leak fixes found by valgrind whilst checking
 the password history code. Error code paths were not freeing up some memory.
 Jeremy. (This used to be commit 7c4666e56c2c281e023c6483459cb9e8d4787d36)

---
 source3/auth/auth_sam.c           |  6 ++++++
 source3/rpc_server/srv_pipe.c     | 34 +++++++++++++++----------------
 source3/rpc_server/srv_pipe_hnd.c | 16 +++++++++++++++
 source3/smbd/service.c            |  8 ++++++--
 4 files changed, 45 insertions(+), 19 deletions(-)

diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c
index 2f9ff6265c9..44e0a1810fe 100644
--- a/source3/auth/auth_sam.c
+++ b/source3/auth/auth_sam.c
@@ -231,6 +231,8 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 				DEBUG(1, ("Failed to modify entry.\n"));
 			unbecome_root();
 		}
+		data_blob_free(&user_sess_key);
+		data_blob_free(&lm_sess_key);
 		pdb_free_sam(&sampass);
 		return nt_status;
 	}
@@ -253,11 +255,15 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		pdb_free_sam(&sampass);
+		data_blob_free(&user_sess_key);
+		data_blob_free(&lm_sess_key);
 		return nt_status;
 	}
 
 	if (!NT_STATUS_IS_OK(nt_status = make_server_info_sam(server_info, sampass))) {		
 		DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
+		data_blob_free(&user_sess_key);
+		data_blob_free(&lm_sess_key);
 		return nt_status;
 	}
 
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 36929150e54..2232f0bc243 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -52,28 +52,28 @@ struct dcinfo last_dcinfo;
 
 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
 {
-    unsigned char *hash = p->ntlmssp_hash;
-    unsigned char index_i = hash[256];
-    unsigned char index_j = hash[257];
-    int ind;
+	unsigned char *hash = p->ntlmssp_hash;
+	unsigned char index_i = hash[256];
+	unsigned char index_j = hash[257];
+	int ind;
 
-    for( ind = 0; ind < len; ind++) {
-        unsigned char tc;
-        unsigned char t;
+	for( ind = 0; ind < len; ind++) {
+		unsigned char tc;
+		unsigned char t;
 
-        index_i++;
-        index_j += hash[index_i];
+		index_i++;
+		index_j += hash[index_i];
 
-        tc = hash[index_i];
-        hash[index_i] = hash[index_j];
-        hash[index_j] = tc;
+		tc = hash[index_i];
+		hash[index_i] = hash[index_j];
+		hash[index_j] = tc;
 
-        t = hash[index_i] + hash[index_j];
-        data[ind] = data[ind] ^ hash[t];
-    }
+		t = hash[index_i] + hash[index_j];
+		data[ind] = data[ind] ^ hash[t];
+	}
 
-    hash[256] = index_i;
-    hash[257] = index_j;
+	hash[256] = index_i;
+	hash[257] = index_j;
 }
 
 /*******************************************************************
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index c0e6bf8f5e6..562b55b8f76 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -1091,6 +1091,22 @@ BOOL close_rpc_pipe_hnd(smb_np_struct *p)
 	return True;
 }
 
+/****************************************************************************
+ Close all pipes on a connection.
+****************************************************************************/
+
+void pipe_close_conn(connection_struct *conn)
+{
+	smb_np_struct *p, *next;
+
+	for (p=Pipes;p;p=next) {
+		next = p->next;
+		if (p->conn == conn) {
+			close_rpc_pipe_hnd(p);
+		}
+	}
+}
+
 /****************************************************************************
  Close an rpc pipe.
 ****************************************************************************/
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 3b499d5cc1d..794b5332ac5 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -823,8 +823,12 @@ void close_cnum(connection_struct *conn, uint16 vuid)
 {
 	DirCacheFlush(SNUM(conn));
 
-	file_close_conn(conn);
-	dptr_closecnum(conn);
+	if (IS_IPC(conn)) {
+		pipe_close_conn(conn);
+	} else {
+		file_close_conn(conn);
+		dptr_closecnum(conn);
+	}
 
 	change_to_root_user();