printing: don't leak cache_path onto talloc tos

Also check for allocation failures.

Reported-by: Franz Pförtsch <franz.pfoertsch@brose.com>
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

2 files changed, 25 insertions, 5 deletions

diff --git a/source3/printing/printing.c b/source3/printing/printing.c
index dcfd2a2dc5e..d8b619162e9 100644
--- a/source3/printing/printing.c
+++ b/source3/printing/printing.c
@@ -198,17 +198,28 @@ bool print_backend_init(struct messaging_context *msg_ctx)
 	int services = lp_numservices();
 	int snum;
 	bool ok;
+	char *print_cache_path;
 
 	if (!printer_list_parent_init()) {
 		return false;
 	}
 
-	ok = directory_create_or_exist(cache_path("printing"), 0755);
+	print_cache_path = cache_path("printing");
+	if (print_cache_path == NULL) {
+		return false;
+	}
+	ok = directory_create_or_exist(print_cache_path, 0755);
+	TALLOC_FREE(print_cache_path);
 	if (!ok) {
 		return false;
 	}
 
-	unlink(cache_path("printing.tdb"));
+	print_cache_path = cache_path("printing.tdb");
+	if (print_cache_path == NULL) {
+		return false;
+	}
+	unlink(print_cache_path);
+	TALLOC_FREE(print_cache_path);
 
 	/* handle a Samba upgrade */
 
diff --git a/source3/printing/printing_db.c b/source3/printing/printing_db.c
index b721317e5d6..1a129eaad3b 100644
--- a/source3/printing/printing_db.c
+++ b/source3/printing/printing_db.c
@@ -38,6 +38,8 @@ struct tdb_print_db *get_print_db_byname(const char *printername)
 	int num_open = 0;
 	char *printdb_path = NULL;
 	bool done_become_root = False;
+	char *print_cache_path;
+	int ret;
 
 	SMB_ASSERT(printername != NULL);
 
@@ -93,9 +95,16 @@ struct tdb_print_db *get_print_db_byname(const char *printername)
 		DLIST_ADD(print_db_head, p);
 	}
 
-	if (asprintf(&printdb_path, "%s%s.tdb",
-				cache_path("printing/"),
-				printername) < 0) {
+	print_cache_path = cache_path("printing/");
+	if (print_cache_path == NULL) {
+		DLIST_REMOVE(print_db_head, p);
+		SAFE_FREE(p);
+		return NULL;
+	}
+	ret = asprintf(&printdb_path, "%s%s.tdb",
+		       print_cache_path, printername);
+	TALLOC_FREE(print_cache_path);
+	if (ret < 0) {
 		DLIST_REMOVE(print_db_head, p);
 		SAFE_FREE(p);
 		return NULL;