From 7dbf736ebe7e4f655f50a9e19437ca42189abf92 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Mon, 18 Jan 2010 20:06:30 +0100
Subject: Fix a double free bug

---
 server/responder/pam/pamsrv_cmd.c | 3 ---
 1 file changed, 3 deletions(-)

(limited to 'server/responder')

diff --git a/server/responder/pam/pamsrv_cmd.c b/server/responder/pam/pamsrv_cmd.c
index ca41d641..8a7ccd95 100644
--- a/server/responder/pam/pamsrv_cmd.c
+++ b/server/responder/pam/pamsrv_cmd.c
@@ -687,7 +687,6 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
     if (blen >= sizeof(uint32_t) &&
         ((uint32_t *)(&body[blen - sizeof(uint32_t)]))[0] != END_OF_PAM_REQUEST) {
         DEBUG(1, ("Received data not terminated.\n"));
-        talloc_free(preq);
         ret = EINVAL;
         goto done;
     }
@@ -711,7 +710,6 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
             ret = EINVAL;
     }
     if (ret != EOK) {
-        talloc_free(preq);
         ret = EINVAL;
         goto done;
     }
@@ -722,7 +720,6 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
             if (strcasecmp(dom->name, pd->domain) == 0) break;
         }
         if (!dom) {
-            talloc_free(preq);
             ret = ENOENT;
             goto done;
         }
-- 
cgit