summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Kroeger <andrew@id10ts.net>2009-06-11 02:15:28 -0500
committerVolker Lendecke <vl@samba.org>2009-06-12 10:29:37 +0200
commit6c5c99130462ecddb449e99138c88930003325a3 (patch)
tree5349bba1ad99cc609da76296d568da7cada27264
parentff4acca13aa53865182bd26715c92e45f6e8f861 (diff)
downloadsamba-6c5c99130462ecddb449e99138c88930003325a3.tar.gz
samba-6c5c99130462ecddb449e99138c88930003325a3.tar.bz2
samba-6c5c99130462ecddb449e99138c88930003325a3.zip
s3: Call va_end() after all va_start()/va_copy() calls.
There are error paths in S3 where va_end() is not properly called after va_start() or va_copy() have been called. These issues were noted while performing an inspection for S4 bug #6129. Thanks to Erik Hovland <erik@hovland.org> for the original bug report.
-rw-r--r--source3/lib/ldb/common/ldb_dn.c2
-rw-r--r--source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c1
-rw-r--r--source3/lib/util.c2
3 files changed, 3 insertions, 2 deletions
diff --git a/source3/lib/ldb/common/ldb_dn.c b/source3/lib/ldb/common/ldb_dn.c
index 09d58555bd..fb7f3e99f3 100644
--- a/source3/lib/ldb/common/ldb_dn.c
+++ b/source3/lib/ldb/common/ldb_dn.c
@@ -362,9 +362,9 @@ struct ldb_dn *ldb_dn_new_fmt(void *mem_ctx, struct ldb_context *ldb, const char
va_start(ap, new_fmt);
strdn = talloc_vasprintf(mem_ctx, new_fmt, ap);
+ va_end(ap);
if (strdn == NULL)
return NULL;
- va_end(ap);
dn = ldb_dn_explode(mem_ctx, strdn);
diff --git a/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c b/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
index cb516b6e75..d8fc162741 100644
--- a/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
+++ b/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
@@ -534,6 +534,7 @@ query_int(const struct lsqlite3_private * lsqlite3,
/* Format the query */
if ((p = sqlite3_vmprintf(pSql, args)) == NULL) {
+ va_end(args);
return SQLITE_NOMEM;
}
diff --git a/source3/lib/util.c b/source3/lib/util.c
index b85f29e136..c0bb042d28 100644
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -2113,10 +2113,10 @@ void *smb_xmalloc_array(size_t size, unsigned int count)
va_copy(ap2, ap);
n = vasprintf(ptr, format, ap2);
+ va_end(ap2);
if (n == -1 || ! *ptr) {
smb_panic("smb_xvasprintf: out of memory");
}
- va_end(ap2);
return n;
}