librpc:ndr: Fix leaks

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/librpc/ndr/ndr.c b/librpc/ndr/ndr.c
index 43a1f6dd3d397b89980268b869f4f838acd88877..d9437785ac88a890ee9ab44f09301f5dbdb52e84 100644 (file)
--- a/librpc/ndr/ndr.c
+++ b/librpc/ndr/ndr.c
@@ -890,7 +890,13 @@ _PUBLIC_ enum ndr_err_code ndr_push_subcontext_start(struct ndr_push *ndr,
        subndr->flags   = ndr->flags & ~LIBNDR_FLAG_NDR64;
 
        if (size_is > 0) {
-               NDR_CHECK(ndr_push_zero(subndr, size_is));
+               enum ndr_err_code status;
+
+               status = ndr_push_zero(subndr, size_is);
+               if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
+                       talloc_free(subndr);
+                       return status;
+               }
                subndr->offset = 0;
                subndr->relative_end_offset = size_is;
        }
@@ -1435,7 +1441,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem
        ndr = ndr_push_init_ctx(mem_ctx);
        NDR_ERR_HAVE_NO_MEMORY(ndr);
 
-       NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
+       NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 
        *blob = ndr_push_blob(ndr);
        talloc_steal(mem_ctx, blob->data);
@@ -1483,8 +1489,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_
        ndr = ndr_push_init_ctx(mem_ctx);
        NDR_ERR_HAVE_NO_MEMORY(ndr);
 
-       NDR_CHECK(ndr_push_set_switch_value(ndr, p, level));
-       NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
+       NDR_CHECK_FREE(ndr_push_set_switch_value(ndr, p, level));
+       NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 
        *blob = ndr_push_blob(ndr);
        talloc_steal(mem_ctx, blob->data);

diff --git a/librpc/ndr/ndr_sec_helper.c b/librpc/ndr/ndr_sec_helper.c
index 4d91be89c3b28453667d933a0f7c287cd9a29b57..0384626e827341c96415e2aa6545785934d25d43 100644 (file)
--- a/librpc/ndr/ndr_sec_helper.c
+++ b/librpc/ndr/ndr_sec_helper.c
@@ -217,7 +217,11 @@ enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct
        subndr->data_size       = 28;
        subndr->offset          = 0;
 
-       NDR_CHECK(ndr_pull_advance(ndr, 28));
+       status = ndr_pull_advance(ndr, 28);
+       if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
+               talloc_free(subndr);
+               return status;
+       }
 
        status = ndr_pull_dom_sid(subndr, ndr_flags, sid);
        if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
@@ -227,6 +231,7 @@ enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct
                ZERO_STRUCT(sid->sub_auths);
        }
 
+       talloc_free(subndr);
        return NDR_ERR_SUCCESS;
 }