Convert the prs_XXX struct and functions to use talloc instead of malloc. Passes valgrind and make tests for client and server. Second version of this patch after splitting up at Simo's request. Patch to follow will delete extraneous prs_mem_free() calls.

Jeremy.

Signed-off-by: Simo Sorce <idra@samba.org>

2 files changed, 10 insertions, 16 deletions

diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
index e248133de3..d420cbce3c 100644
--- a/source3/rpc_client/cli_pipe.c
+++ b/source3/rpc_client/cli_pipe.c
@@ -1453,7 +1453,6 @@ static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
 	NTSTATUS status;
 	uint8_t *rdata = NULL;
 	uint32_t rdata_len = 0;
-	char *rdata_copy;
 
 	status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
 	TALLOC_FREE(subreq);
@@ -1471,16 +1470,11 @@ static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
 	}
 
 	/*
-	 * Give the memory received from cli_trans as dynamic to the current
-	 * pdu. Duplicating it sucks, but prs_struct doesn't know about talloc
-	 * :-(
+	 * This is equivalent to a talloc_steal - gives rdata to
+	 * the prs_struct state->incoming_frag.
 	 */
-	rdata_copy = (char *)memdup(rdata, rdata_len);
-	TALLOC_FREE(rdata);
-	if (tevent_req_nomem(rdata_copy, req)) {
-		return;
-	}
-	prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
+	prs_give_memory(&state->incoming_frag, (char *)rdata, rdata_len, true);
+	rdata = NULL;
 
 	/* Ensure we have enough data for a pdu. */
 	subreq = get_complete_frag_send(state, state->ev, state->cli,
@@ -1597,9 +1591,10 @@ static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 	reply_pdu->mem_ctx = mem_ctx;
 
 	/*
-	 * Prevent state->incoming_pdu from being freed in
-	 * rpc_api_pipe_state_destructor()
+	 * Prevent state->incoming_pdu from being freed
+	 * when state is freed.
 	 */
+	talloc_steal(mem_ctx, prs_data_p(reply_pdu));
 	prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
 
 	return NT_STATUS_OK;
@@ -2458,9 +2453,10 @@ NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 	reply_pdu->mem_ctx = mem_ctx;
 
 	/*
-	 * Prevent state->req_pdu from being freed in
-	 * rpc_api_pipe_req_state_destructor()
+	 * Prevent state->req_pdu from being freed
+	 * when state is freed.
 	 */
+	talloc_steal(mem_ctx, prs_data_p(reply_pdu));
 	prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
 
 	return NT_STATUS_OK;
diff --git a/source3/rpc_client/ndr.c b/source3/rpc_client/ndr.c
index bbd78067bf..8e03f2e015 100644
--- a/source3/rpc_client/ndr.c
+++ b/source3/rpc_client/ndr.c
@@ -103,7 +103,6 @@ static void cli_do_rpc_ndr_done(struct tevent_req *subreq)
 
 	status = rpc_api_pipe_req_recv(subreq, state, &state->r_ps);
 	TALLOC_FREE(subreq);
-	prs_mem_free(&state->q_ps);
 	if (!NT_STATUS_IS_OK(status)) {
 		tevent_req_nterror(req, status);
 		return;
@@ -126,7 +125,6 @@ NTSTATUS cli_do_rpc_ndr_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx)
 	}
 
 	ret = prs_data_blob(&state->r_ps, &blob, talloc_tos());
-	prs_mem_free(&state->r_ps);
 	if (!ret) {
 		return NT_STATUS_NO_MEMORY;
 	}