From 99b4791cfe423b19f1f21d5f9fb42157336019f1 Mon Sep 17 00:00:00 2001 From: Swen Schillig Date: Wed, 31 Jul 2019 10:27:37 +0200 Subject: ldb: Fix mem-leak if talloc_realloc fails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In case of a failing talloc_realloc(), the only reference to the originally allocated memory is overwritten. Instead use a temp var until success is verified. Signed-off-by: Swen Schillig Reviewed-by: Christof Schmitt Reviewed-by: Matthias Dieter Wallnöfer Reviewed-by: Andrew Bartlett --- lib/ldb/common/ldb_dn.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'lib/ldb') diff --git a/lib/ldb/common/ldb_dn.c b/lib/ldb/common/ldb_dn.c index 23a817edf65..9b2fa966e11 100644 --- a/lib/ldb/common/ldb_dn.c +++ b/lib/ldb/common/ldb_dn.c @@ -376,6 +376,7 @@ static bool ldb_dn_explode(struct ldb_dn *dn) } if (in_ex_value && *p == '>') { + struct ldb_dn_ext_component *ext_comp = NULL; const struct ldb_dn_extended_syntax *ext_syntax; struct ldb_val ex_val = { .data = (uint8_t *)ex_value, @@ -388,15 +389,19 @@ static bool ldb_dn_explode(struct ldb_dn *dn) /* Process name and ex_value */ - dn->ext_components = talloc_realloc(dn, - dn->ext_components, - struct ldb_dn_ext_component, - dn->ext_comp_num + 1); - if ( ! dn->ext_components) { + ext_comp = talloc_realloc( + dn, + dn->ext_components, + struct ldb_dn_ext_component, + dn->ext_comp_num + 1); + + if (ext_comp == NULL) { /* ouch ! */ goto failed; } + dn->ext_components = ext_comp; + ext_syntax = ldb_dn_extended_syntax_by_name(dn->ldb, ex_name); if (!ext_syntax) { /* We don't know about this type of extended DN */ -- cgit v1.2.1