1 files changed, 22 insertions, 25 deletions

diff --git a/source4/heimdal/lib/krb5/transited.c b/source4/heimdal/lib/krb5/transited.c
index 196ef447ee..1ff4ce1658 100644
--- a/source4/heimdal/lib/krb5/transited.c
+++ b/source4/heimdal/lib/krb5/transited.c
@@ -62,9 +62,8 @@ static int
 make_path(krb5_context context, struct tr_realm *r,
 	  const char *from, const char *to)
 {
-    const char *p;
-    struct tr_realm *path = r->next;
     struct tr_realm *tmp;
+    const char *p;
 
     if(strlen(from) < strlen(to)){
 	const char *str;
@@ -90,11 +89,12 @@ make_path(krb5_context context, struct tr_realm *r,
 				       N_("malloc: out of memory", ""));
 		return ENOMEM;
 	    }
-	    tmp->next = path;
-	    path = tmp;
-	    path->realm = strdup(p);
-	    if(path->realm == NULL){
-		r->next = path; /* XXX */
+	    tmp->next = r->next;
+	    r->next = tmp;
+	    tmp->realm = strdup(p);
+	    if(tmp->realm == NULL){
+		r->next = tmp->next;
+		free(tmp);
 		krb5_set_error_message(context, ENOMEM,
 				       N_("malloc: out of memory", ""));
 		return ENOMEM;;
@@ -104,10 +104,9 @@ make_path(krb5_context context, struct tr_realm *r,
 	p = from + strlen(from);
 	while(1){
 	    while(p >= from && *p != '/') p--;
-	    if(p == from) {
-		r->next = path; /* XXX */
+	    if(p == from)
 		return KRB5KDC_ERR_POLICY;
-	    }
+
 	    if(strncmp(to, from, p - from) == 0)
 		break;
 	    tmp = calloc(1, sizeof(*tmp));
@@ -116,24 +115,24 @@ make_path(krb5_context context, struct tr_realm *r,
 				       N_("malloc: out of memory", ""));
 		return ENOMEM;
 	    }
-	    tmp->next = path;
-	    path = tmp;
-	    path->realm = malloc(p - from + 1);
-	    if(path->realm == NULL){
-		r->next = path; /* XXX */
+	    tmp->next = r->next;
+	    r->next = tmp;
+	    tmp->realm = malloc(p - from + 1);
+	    if(tmp->realm == NULL){
+		r->next = tmp->next;
+		free(tmp);
 		krb5_set_error_message(context, ENOMEM,
 				       N_("malloc: out of memory", ""));
 		return ENOMEM;
 	    }
-	    memcpy(path->realm, from, p - from);
-	    path->realm[p - from] = '\0';
+	    memcpy(tmp->realm, from, p - from);
+	    tmp->realm[p - from] = '\0';
 	    p--;
 	}
     } else {
 	krb5_clear_error_message (context);
 	return KRB5KDC_ERR_POLICY;
     }
-    r->next = path;
 
     return 0;
 }
@@ -359,17 +358,15 @@ krb5_domain_x500_decode(krb5_context context,
 	return ret;
 
     /* remove empty components and count realms */
-    q = &r;
     *num_realms = 0;
-    for(p = r; p; ){
-	if(p->realm[0] == '\0'){
+    for(q = &r; *q; ){
+	if((*q)->realm[0] == '\0'){
+	    p = *q;
+	    *q = (*q)->next;
 	    free(p->realm);
-	    *q = p->next;
 	    free(p);
-	    p = *q;
 	}else{
-	    q = &p->next;
-	    p = p->next;
+	    q = &(*q)->next;
 	    (*num_realms)++;
 	}
     }