From: Gary Lockyer <gary@catalyst.net.nz>
Date: Tue, 17 Dec 2019 22:17:51 +0000 (+1300)
Subject: lib ldb: fix use after free
X-Git-Tag: ldb-2.1.0~228
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4d9753dfbd8a2d66d86f60aabee627826247aa38;p=thirdparty%2Fsamba.git

lib ldb: fix use after free

Fix ASAN detected use after free.  No security implications as  the
talloc_free is followed immediately by the print statement and the value
printed is an integer

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/lib/ldb/common/ldb.c b/lib/ldb/common/ldb.c
index 95e9138a56b..8c86dca45a1 100644
--- a/lib/ldb/common/ldb.c
+++ b/lib/ldb/common/ldb.c
@@ -1392,8 +1392,8 @@ int ldb_op_default_callback(struct ldb_request *req, struct ldb_reply *ares)
 	}
 
 	if (ares->type != LDB_REPLY_DONE) {
-		talloc_free(ares);
 		ldb_asprintf_errstring(req->handle->ldb, "Invalid LDB reply type %d", ares->type);
+		TALLOC_FREE(ares);
 		return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
 	}