diff options
| author | Shirish Kalele <kalele@samba.org> | 2000-05-26 22:37:08 +0000 |
|---|---|---|
| committer | Shirish Kalele <kalele@samba.org> | 2000-05-26 22:37:08 +0000 |
| commit | f3c44fba111392a7680e489330f3f69aedbff13d (patch) | |
| tree | b080bdb73077897348c598cbe38ae82260e0de76 /source3/rpc_server/srv_pipe_hnd.c | |
| parent | 9646e6e1ba5e44b3c4349e85e08ab9f73372a4d5 (diff) | |
| download | samba-f3c44fba111392a7680e489330f3f69aedbff13d.tar.gz samba-f3c44fba111392a7680e489330f3f69aedbff13d.tar.bz2 samba-f3c44fba111392a7680e489330f3f69aedbff13d.zip | |
Fixed memory leak in RPC parsing code.
Problem in prs_set_buffer_size() was Realloc returns a NULL when newsize is zero (equivalent to a free()). We were returning a failure here without resetting the buffer_size or the data_p pointer in the prs_struct. And we weren't checking for a failure from prs_set_buffer_size(). So realloc's to zero size were not reflected in the prs_struct: memory leak.
(This used to be commit 590d9ece8449b1feecfe1aa13e61bcd8fea4e5bf)
Diffstat (limited to 'source3/rpc_server/srv_pipe_hnd.c')
| -rw-r--r-- | source3/rpc_server/srv_pipe_hnd.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c index a349da839a..e01ecf82a2 100644 --- a/source3/rpc_server/srv_pipe_hnd.c +++ b/source3/rpc_server/srv_pipe_hnd.c @@ -480,7 +480,12 @@ authentication failed. Denying the request.\n", p->name)); * size as the current offset. */ - prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)); + if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data))) + { + DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n")); + set_incoming_fault(p); + return False; + } /* * Set the parse offset to the start of the data and set the |