1 files changed, 18 insertions, 4 deletions

diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 72b4ba0742..edbb0dfc4d 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -1238,12 +1238,12 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 				int *last_entry_off,
 				struct ea_list *name_list)
 {
-	const char *dname;
+	char *dname;
 	bool found = False;
 	SMB_STRUCT_STAT sbuf;
 	const char *mask = NULL;
 	char *pathreal = NULL;
-	const char *fname = NULL;
+	char *fname = NULL;
 	char *p, *q, *pdata = *ppdata;
 	uint32 reskey=0;
 	long prev_dirpos=0;
@@ -1319,9 +1319,13 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 		/* Mangle fname if it's an illegal name. */
 		if (mangle_must_mangle(dname,conn->params)) {
 			if (!name_to_8_3(dname,mangled_name,True,conn->params)) {
+				TALLOC_FREE(fname);
 				continue; /* Error - couldn't mangle. */
 			}
-			fname = mangled_name;
+			fname = talloc_strdup(ctx, mangled_name);
+			if (!fname) {
+				return False;
+			}
 		}
 
 		if(!(got_match = *got_exact_match = exact_match(conn, fname, mask))) {
@@ -1338,6 +1342,7 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 			 */
 			/* Force the mangling into 8.3. */
 			if (!name_to_8_3( fname, mangled_name, False, conn->params)) {
+				TALLOC_FREE(fname);
 				continue; /* Error - couldn't mangle. */
 			}
 
@@ -1350,6 +1355,7 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 			bool isdots = (ISDOT(dname) || ISDOTDOT(dname));
 
 			if (dont_descend && !isdots) {
+				TALLOC_FREE(fname);
 				continue;
 			}
 
@@ -1367,6 +1373,7 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 			}
 
 			if (!pathreal) {
+				TALLOC_FREE(fname);
 				return False;
 			}
 
@@ -1375,6 +1382,7 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 					DEBUG(5,("get_lanman2_dir_entry:Couldn't lstat [%s] (%s)\n",
 						pathreal,strerror(errno)));
 					TALLOC_FREE(pathreal);
+					TALLOC_FREE(fname);
 					continue;
 				}
 			} else if (!VALID_STAT(sbuf) && SMB_VFS_STAT(conn,pathreal,&sbuf) != 0) {
@@ -1386,6 +1394,7 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 					DEBUG(5,("get_lanman2_dir_entry:Couldn't stat [%s] (%s)\n",
 						pathreal,strerror(errno)));
 					TALLOC_FREE(pathreal);
+					TALLOC_FREE(fname);
 					continue;
 				}
 			}
@@ -1399,6 +1408,7 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 			if (!dir_check_ftype(conn,mode,dirtype)) {
 				DEBUG(5,("get_lanman2_dir_entry: [%s] attribs didn't match %x\n",fname,dirtype));
 				TALLOC_FREE(pathreal);
+				TALLOC_FREE(fname);
 				continue;
 			}
 
@@ -1440,6 +1450,9 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 
 			dptr_DirCacheAdd(conn->dirptr, dname, curr_dirpos);
 		}
+
+		if (!found)
+			TALLOC_FREE(fname);
 	}
 
 	p = pdata;
@@ -1833,10 +1846,11 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
 			break;
 
 		default:
+			TALLOC_FREE(fname);
 			return(False);
 	}
 
-
+	TALLOC_FREE(fname);
 	if (PTR_DIFF(p,pdata) > space_remaining) {
 		/* Move the dirptr back to prev_dirpos */
 		dptr_SeekDir(conn->dirptr, prev_dirpos);