From: Andrej Gessel <Andrej.Gessel@janztec.com>
Date: Tue, 19 Jun 2018 08:07:51 +0000 (+0200)
Subject: check return value before using key_values
X-Git-Tag: ldb-1.3.4~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2a3f91ea027eb1d24568b96036801d3f9e5a13f2;p=thirdparty%2Fsamba.git

check return value before using key_values

there are also mem leaks in this function

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13475

Signed-off-by: Andrej Gessel <Andrej.Gessel@janztec.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit f75e8f58cd2390c092631803d333adadb475306a)
---

diff --git a/lib/ldb/ldb_tdb/ldb_index.c b/lib/ldb/ldb_tdb/ldb_index.c
index 21d501d4ee5..340e5c72550 100644
--- a/lib/ldb/ldb_tdb/ldb_index.c
+++ b/lib/ldb/ldb_tdb/ldb_index.c
@@ -1565,13 +1565,14 @@ static int ltdb_index_filter(struct ltdb_private *ltdb,
 					  struct guid_tdb_key,
 					  dn_list->count);
 
+		if (key_values == NULL) {
+			talloc_free(keys);
+			return ldb_module_oom(ac->module);
+		}
 		for (i = 0; i < dn_list->count; i++) {
 			keys[i].dptr = key_values[i].guid_key;
 			keys[i].dsize = sizeof(key_values[i].guid_key);
 		}
-		if (key_values == NULL) {
-			return ldb_module_oom(ac->module);
-		}
 	} else {
 		for (i = 0; i < dn_list->count; i++) {
 			keys[i].dptr = NULL;
@@ -1588,6 +1589,7 @@ static int ltdb_index_filter(struct ltdb_private *ltdb,
 				      &dn_list->dn[i],
 				      &keys[num_keys]);
 		if (ret != LDB_SUCCESS) {
+			talloc_free(keys);
 			return ret;
 		}
 
@@ -1625,6 +1627,7 @@ static int ltdb_index_filter(struct ltdb_private *ltdb,
 		bool matched;
 		msg = ldb_msg_new(ac);
 		if (!msg) {
+			talloc_free(keys);
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
 
@@ -1645,6 +1648,7 @@ static int ltdb_index_filter(struct ltdb_private *ltdb,
 
 		if (ret != LDB_SUCCESS && ret != LDB_ERR_NO_SUCH_OBJECT) {
 			/* an internal error */
+			talloc_free(keys);
 			talloc_free(msg);
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
@@ -1662,6 +1666,7 @@ static int ltdb_index_filter(struct ltdb_private *ltdb,
 		}
 
 		if (ret != LDB_SUCCESS) {
+			talloc_free(keys);
 			talloc_free(msg);
 			return ret;
 		}
@@ -1676,6 +1681,7 @@ static int ltdb_index_filter(struct ltdb_private *ltdb,
 		talloc_free(msg);
 
 		if (ret == -1) {
+			talloc_free(keys);
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
 
@@ -1685,6 +1691,7 @@ static int ltdb_index_filter(struct ltdb_private *ltdb,
 			 * is the callbacks responsiblity, and should
 			 * not be talloc_free()'ed */
 			ac->request_terminated = true;
+			talloc_free(keys);
 			return ret;
 		}