sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-11-23 20:23:50 +03:00
Code Activity

Fixed memory leak in RPC parsing code.

Browse Source 
Problem in prs_set_buffer_size() was Realloc returns a NULL when newsize is zero (equivalent to a free()). We were returning a failure here without resetting the buffer_size or the data_p pointer in the prs_struct. And we weren't checking for a failure from prs_set_buffer_size(). So realloc's to zero size were not reflected in the prs_struct: memory leak.
(This used to be commit 590d9ece84)
This commit is contained in:
Shirish Kalele
2000-05-26 22:37:08 +00:00
parent 9646e6e1ba
commit f3c44fba11
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
source3/rpc_parse/parse_prs.c
View File

@@ -164,9 +164,11 @@ BOOL prs_set_buffer_size(prs_struct *ps, uint32 newsize)
if (newsize < ps->buffer_size) {
char *new_data_p = Realloc(ps->data_p, newsize);
if (new_data_p == NULL) {
/* if newsize is zero, Realloc acts like free() & returns NULL*/
if (new_data_p == NULL && newsize != 0) {
DEBUG(0,("prs_set_buffer_size: Realloc failure for size %u.\n",
(unsigned int)newsize));
DEBUG(0,("prs_set_buffer_size: Reason %s\n",strerror(errno)));
return False;
}
ps->data_p = new_data_p;

7
source3/rpc_server/srv_pipe_hnd.c
View File

@@ -480,7 +480,12 @@ authentication failed. Denying the request.\n", p->name));
* size as the current offset.
*/
prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data));
if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)))
{
DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
set_incoming_fault(p);
return False;
}
/*
* Set the parse offset to the start of the data and set the