From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Mon, 7 Aug 2023 01:46:50 +0000 (+1200)
Subject: librpc:ndr: Fix leaks
X-Git-Tag: tevent-0.16.0~1161
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6913aebd5934860349f3539a7f6a2c8b0eefd289;p=thirdparty%2Fsamba.git

librpc:ndr: Fix leaks

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/librpc/ndr/ndr.c b/librpc/ndr/ndr.c
index 43a1f6dd3d3..d9437785ac8 100644
--- a/librpc/ndr/ndr.c
+++ b/librpc/ndr/ndr.c
@@ -890,7 +890,13 @@ _PUBLIC_ enum ndr_err_code ndr_push_subcontext_start(struct ndr_push *ndr,
 	subndr->flags	= ndr->flags & ~LIBNDR_FLAG_NDR64;
 
 	if (size_is > 0) {
-		NDR_CHECK(ndr_push_zero(subndr, size_is));
+		enum ndr_err_code status;
+
+		status = ndr_push_zero(subndr, size_is);
+		if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
+			talloc_free(subndr);
+			return status;
+		}
 		subndr->offset = 0;
 		subndr->relative_end_offset = size_is;
 	}
@@ -1435,7 +1441,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem
 	ndr = ndr_push_init_ctx(mem_ctx);
 	NDR_ERR_HAVE_NO_MEMORY(ndr);
 
-	NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
+	NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 
 	*blob = ndr_push_blob(ndr);
 	talloc_steal(mem_ctx, blob->data);
@@ -1483,8 +1489,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_
 	ndr = ndr_push_init_ctx(mem_ctx);
 	NDR_ERR_HAVE_NO_MEMORY(ndr);
 
-	NDR_CHECK(ndr_push_set_switch_value(ndr, p, level));
-	NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
+	NDR_CHECK_FREE(ndr_push_set_switch_value(ndr, p, level));
+	NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 
 	*blob = ndr_push_blob(ndr);
 	talloc_steal(mem_ctx, blob->data);
diff --git a/librpc/ndr/ndr_sec_helper.c b/librpc/ndr/ndr_sec_helper.c
index 4d91be89c3b..0384626e827 100644
--- a/librpc/ndr/ndr_sec_helper.c
+++ b/librpc/ndr/ndr_sec_helper.c
@@ -217,7 +217,11 @@ enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct
 	subndr->data_size	= 28;
 	subndr->offset		= 0;
 
-	NDR_CHECK(ndr_pull_advance(ndr, 28));
+	status = ndr_pull_advance(ndr, 28);
+	if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
+		talloc_free(subndr);
+		return status;
+	}
 
 	status = ndr_pull_dom_sid(subndr, ndr_flags, sid);
 	if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
@@ -227,6 +231,7 @@ enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct
 		ZERO_STRUCT(sid->sub_auths);
 	}
 
+	talloc_free(subndr);
 	return NDR_ERR_SUCCESS;
 }