From f023d6129b7bf0d972f2bb9ecc025d316e55c8ae Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Sat, 23 Nov 2002 02:52:38 +0000 Subject: Lots of fixes for error paths where tdb_fetch() data need freeing. Found via a post from Arcady Chernyak . Jeremy. (This used to be commit 19f86f1f72aca924e9e320e20a175b5d21de45ad) --- source3/printing/nt_printing.c | 19 +++++++++++-------- source3/printing/printing.c | 21 ++++++++++++++------- 2 files changed, 25 insertions(+), 15 deletions(-) (limited to 'source3/printing') diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index a12f906526..1460bea084 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -212,10 +212,12 @@ static BOOL upgrade_to_version_3(void) if (strncmp(kbuf.dptr, FORMS_PREFIX, strlen(FORMS_PREFIX)) == 0) { DEBUG(0,("upgrade_to_version_3:moving form\n")); if (tdb_store(tdb_forms, kbuf, dbuf, TDB_REPLACE) != 0) { + SAFE_FREE(dbuf.dptr); DEBUG(0,("upgrade_to_version_3: failed to move form. Error (%s).\n", tdb_errorstr(tdb_forms))); return False; } if (tdb_delete(tdb_drivers, kbuf) != 0) { + SAFE_FREE(dbuf.dptr); DEBUG(0,("upgrade_to_version_3: failed to delete form. Error (%s)\n", tdb_errorstr(tdb_drivers))); return False; } @@ -224,10 +226,12 @@ static BOOL upgrade_to_version_3(void) if (strncmp(kbuf.dptr, PRINTERS_PREFIX, strlen(PRINTERS_PREFIX)) == 0) { DEBUG(0,("upgrade_to_version_3:moving printer\n")); if (tdb_store(tdb_printers, kbuf, dbuf, TDB_REPLACE) != 0) { + SAFE_FREE(dbuf.dptr); DEBUG(0,("upgrade_to_version_3: failed to move printer. Error (%s)\n", tdb_errorstr(tdb_printers))); return False; } if (tdb_delete(tdb_drivers, kbuf) != 0) { + SAFE_FREE(dbuf.dptr); DEBUG(0,("upgrade_to_version_3: failed to delete printer. Error (%s)\n", tdb_errorstr(tdb_drivers))); return False; } @@ -236,10 +240,12 @@ static BOOL upgrade_to_version_3(void) if (strncmp(kbuf.dptr, SECDESC_PREFIX, strlen(SECDESC_PREFIX)) == 0) { DEBUG(0,("upgrade_to_version_3:moving secdesc\n")); if (tdb_store(tdb_printers, kbuf, dbuf, TDB_REPLACE) != 0) { + SAFE_FREE(dbuf.dptr); DEBUG(0,("upgrade_to_version_3: failed to move secdesc. Error (%s)\n", tdb_errorstr(tdb_printers))); return False; } if (tdb_delete(tdb_drivers, kbuf) != 0) { + SAFE_FREE(dbuf.dptr); DEBUG(0,("upgrade_to_version_3: failed to delete secdesc. Error (%s)\n", tdb_errorstr(tdb_drivers))); return False; } @@ -1771,8 +1777,7 @@ static WERROR get_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 **info_ptr, driver.defaultdatatype); i=0; - while (len < dbuf.dsize) - { + while (len < dbuf.dsize) { fstring *tddfs; tddfs = (fstring *)Realloc(driver.dependentfiles, @@ -1793,8 +1798,7 @@ static WERROR get_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 **info_ptr, SAFE_FREE(dbuf.dptr); - if (len != dbuf.dsize) - { + if (len != dbuf.dsize) { SAFE_FREE(driver.dependentfiles); return get_a_printer_driver_3_default(info_ptr, drivername, arch); @@ -2918,8 +2922,7 @@ static WERROR get_a_printer_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstring sharen * See comments in get_a_printer_2_default() */ - if (lp_default_devmode(lp_servicenumber(sharename)) && !info.devmode) - { + if (lp_default_devmode(lp_servicenumber(sharename)) && !info.devmode) { DEBUG(8,("get_a_printer_2: Constructing a default device mode for [%s]\n", printername)); info.devmode = construct_nt_devicemode(printername); @@ -3160,8 +3163,8 @@ static BOOL set_driver_init_2( NT_PRINTER_INFO_LEVEL_2 *info_ptr ) */ if ( info.devmode ) { - ZERO_STRUCT(info.devmode->devicename); - fstrcpy(info.devmode->devicename, info_ptr->printername); + ZERO_STRUCT(info.devmode->devicename); + fstrcpy(info.devmode->devicename, info_ptr->printername); } /* diff --git a/source3/printing/printing.c b/source3/printing/printing.c index cc4d588e2d..a8f9097255 100644 --- a/source3/printing/printing.c +++ b/source3/printing/printing.c @@ -71,6 +71,7 @@ uint16 pjobid_to_rap(int snum, uint32 jobid) SAFE_FREE(data.dptr); return rap_jobid; } + SAFE_FREE(data.dptr); /* Not found - create and store mapping. */ rap_jobid = ++next_rap_jobid; if (rap_jobid == 0) @@ -99,6 +100,7 @@ BOOL rap_to_pjobid(uint16 rap_jobid, int *psnum, uint32 *pjobid) SAFE_FREE(data.dptr); return True; } + SAFE_FREE(data.dptr); return False; } @@ -117,8 +119,10 @@ static void rap_jobid_delete(int snum, uint32 jobid) key.dptr = (char *)&jinfo; key.dsize = sizeof(jinfo); data = tdb_fetch(rap_tdb, key); - if (!data.dptr || (data.dsize != sizeof(uint16))) + if (!data.dptr || (data.dsize != sizeof(uint16))) { + SAFE_FREE(data.dptr); return; + } memcpy(&rap_jobid, data.dptr, sizeof(uint16)); SAFE_FREE(data.dptr); @@ -404,8 +408,10 @@ static struct printjob *print_job_find(int snum, uint32 jobid) ZERO_STRUCT( pjob ); - if ( unpack_pjob( ret.dptr, ret.dsize, &pjob ) == -1 ) + if ( unpack_pjob( ret.dptr, ret.dsize, &pjob ) == -1 ) { + SAFE_FREE(ret.dptr); return NULL; + } SAFE_FREE(ret.dptr); return &pjob; @@ -580,8 +586,7 @@ static BOOL pjob_store(int snum, uint32 jobid, struct printjob *pjob) len += pack_devicemode(pjob->nt_devmode, buf+len, buflen-len); - if (buflen != len) - { + if (buflen != len) { char *tb; tb = (char *)Realloc(buf, len); @@ -593,8 +598,7 @@ static BOOL pjob_store(int snum, uint32 jobid, struct printjob *pjob) buf = tb; newlen = len; } - } - while ( buflen != len ); + } while ( buflen != len ); /* Store new data */ @@ -833,8 +837,10 @@ static pid_t get_updating_pid(fstring printer_name) data = tdb_fetch(pdb->tdb, key); release_print_db(pdb); - if (!data.dptr || data.dsize != sizeof(pid_t)) + if (!data.dptr || data.dsize != sizeof(pid_t)) { + SAFE_FREE(data.dptr); return (pid_t)-1; + } memcpy(&updating_pid, data.dptr, sizeof(pid_t)); SAFE_FREE(data.dptr); @@ -1065,6 +1071,7 @@ static TDB_DATA get_printer_notify_pid_list(TDB_CONTEXT *tdb, const char *printe if (data.dsize % 8) { DEBUG(0,("get_printer_notify_pid_list: Size of record for printer %s not a multiple of 8 !\n", printer_name )); tdb_delete_by_string(tdb, NOTIFY_PID_LIST_KEY ); + SAFE_FREE(data.dptr); ZERO_STRUCT(data); return data; } -- cgit