diff options
| author | Andrew Kroeger <andrew@id10ts.net> | 2009-06-11 02:15:28 -0500 |
|---|---|---|
| committer | Volker Lendecke <vl@samba.org> | 2009-06-12 10:29:37 +0200 |
| commit | 6c5c99130462ecddb449e99138c88930003325a3 (patch) | |
| tree | 5349bba1ad99cc609da76296d568da7cada27264 | |
| parent | ff4acca13aa53865182bd26715c92e45f6e8f861 (diff) | |
| download | samba-6c5c99130462ecddb449e99138c88930003325a3.tar.gz samba-6c5c99130462ecddb449e99138c88930003325a3.tar.bz2 samba-6c5c99130462ecddb449e99138c88930003325a3.zip | |
s3: Call va_end() after all va_start()/va_copy() calls.
There are error paths in S3 where va_end() is not properly called after
va_start() or va_copy() have been called.
These issues were noted while performing an inspection for S4 bug #6129. Thanks
to Erik Hovland <erik@hovland.org> for the original bug report.
| -rw-r--r-- | source3/lib/ldb/common/ldb_dn.c | 2 | ||||
| -rw-r--r-- | source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c | 1 | ||||
| -rw-r--r-- | source3/lib/util.c | 2 |
3 files changed, 3 insertions, 2 deletions
diff --git a/source3/lib/ldb/common/ldb_dn.c b/source3/lib/ldb/common/ldb_dn.c index 09d58555bd..fb7f3e99f3 100644 --- a/source3/lib/ldb/common/ldb_dn.c +++ b/source3/lib/ldb/common/ldb_dn.c @@ -362,9 +362,9 @@ struct ldb_dn *ldb_dn_new_fmt(void *mem_ctx, struct ldb_context *ldb, const char va_start(ap, new_fmt); strdn = talloc_vasprintf(mem_ctx, new_fmt, ap); + va_end(ap); if (strdn == NULL) return NULL; - va_end(ap); dn = ldb_dn_explode(mem_ctx, strdn); diff --git a/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c b/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c index cb516b6e75..d8fc162741 100644 --- a/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c +++ b/source3/lib/ldb/ldb_sqlite3/ldb_sqlite3.c @@ -534,6 +534,7 @@ query_int(const struct lsqlite3_private * lsqlite3, /* Format the query */ if ((p = sqlite3_vmprintf(pSql, args)) == NULL) { + va_end(args); return SQLITE_NOMEM; } diff --git a/source3/lib/util.c b/source3/lib/util.c index b85f29e136..c0bb042d28 100644 --- a/source3/lib/util.c +++ b/source3/lib/util.c @@ -2113,10 +2113,10 @@ void *smb_xmalloc_array(size_t size, unsigned int count) va_copy(ap2, ap); n = vasprintf(ptr, format, ap2); + va_end(ap2); if (n == -1 || ! *ptr) { smb_panic("smb_xvasprintf: out of memory"); } - va_end(ap2); return n; } |