diff options
| author | Swen Schillig <swen@linux.ibm.com> | 2019-07-31 10:27:37 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2019-09-04 08:31:24 +0000 |
| commit | 57f00784ffac527a0f9b830339bba24784f2e294 (patch) | |
| tree | 27506f1bbd7216a4e2c5e409bfbca07fda031faf /lib | |
| parent | 7cf6afba65641f48a5e2c326464fd97fd9f4173c (diff) | |
| download | samba-57f00784ffac527a0f9b830339bba24784f2e294.tar.gz | |
ldb: Fix mem-leak if talloc_realloc fails
In case of a failing talloc_realloc(), the only reference
to the originally allocated memory is overwritten.
Instead use a temp var until success is verified.
Signed-off-by: Swen Schillig <swen@linux.ibm.com>
Reviewed-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Matthias Dieter Wallnöfer <mdw@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 99b4791cfe423b19f1f21d5f9fb42157336019f1)
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/ldb/common/ldb_dn.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/lib/ldb/common/ldb_dn.c b/lib/ldb/common/ldb_dn.c index 23a817edf65..9b2fa966e11 100644 --- a/lib/ldb/common/ldb_dn.c +++ b/lib/ldb/common/ldb_dn.c @@ -376,6 +376,7 @@ static bool ldb_dn_explode(struct ldb_dn *dn) } if (in_ex_value && *p == '>') { + struct ldb_dn_ext_component *ext_comp = NULL; const struct ldb_dn_extended_syntax *ext_syntax; struct ldb_val ex_val = { .data = (uint8_t *)ex_value, @@ -388,15 +389,19 @@ static bool ldb_dn_explode(struct ldb_dn *dn) /* Process name and ex_value */ - dn->ext_components = talloc_realloc(dn, - dn->ext_components, - struct ldb_dn_ext_component, - dn->ext_comp_num + 1); - if ( ! dn->ext_components) { + ext_comp = talloc_realloc( + dn, + dn->ext_components, + struct ldb_dn_ext_component, + dn->ext_comp_num + 1); + + if (ext_comp == NULL) { /* ouch ! */ goto failed; } + dn->ext_components = ext_comp; + ext_syntax = ldb_dn_extended_syntax_by_name(dn->ldb, ex_name); if (!ext_syntax) { /* We don't know about this type of extended DN */ |