From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 15 Sep 2023 17:36:45 +0000 (-0400)
Subject: ensure that the buffers are talloc'd
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fe47bdb36de75434b2bad018f1854d274b3df27e;p=thirdparty%2Ffreeradius-server.git

ensure that the buffers are talloc'd

the memdup_shallow() call will just assign the ptr to the
value-box.  But the added talloc_get_name() fails, because the
ptr isn't talloced.
---

diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index 84908a4f70f..2384b28ed29 100644
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -4366,6 +4366,7 @@ void fr_value_box_memdup_shallow(fr_value_box_t *dst, fr_dict_attr_t const *enum
 				 uint8_t const *src, size_t len, bool tainted)
 {
 	fr_value_box_init(dst, FR_TYPE_OCTETS, enumv, tainted);
+	(void) talloc_get_name(src);
 	dst->vb_octets = src;
 	dst->vb_length = len;
 }
@@ -5630,7 +5631,7 @@ int fr_value_box_list_concat_in_place(TALLOC_CTX *ctx,
 			}
 			(void)fr_sbuff_trim_talloc(&sbuff, SIZE_MAX);
 			if (vb_should_free_value(proc_action)) fr_value_box_clear_value(out);
-			fr_value_box_bstrndup_shallow(out, NULL, fr_sbuff_buff(&sbuff), fr_sbuff_used(&sbuff), tainted);
+			fr_value_box_bstrndup(out, out, NULL, fr_sbuff_buff(&sbuff), fr_sbuff_used(&sbuff), tainted);
 			break;
 
 		case FR_TYPE_OCTETS:
@@ -5646,7 +5647,7 @@ int fr_value_box_list_concat_in_place(TALLOC_CTX *ctx,
 			}
 			(void)fr_dbuff_trim_talloc(&dbuff, SIZE_MAX);
 			if (vb_should_free_value(proc_action)) fr_value_box_clear_value(out);
-			fr_value_box_memdup_shallow(out, NULL, fr_dbuff_buff(&dbuff), fr_dbuff_used(&dbuff), tainted);
+			fr_value_box_memdup(out, out, NULL, fr_dbuff_buff(&dbuff), fr_dbuff_used(&dbuff), tainted);
 			break;
 
 		default:
@@ -5670,7 +5671,7 @@ int fr_value_box_list_concat_in_place(TALLOC_CTX *ctx,
 			(void)fr_sbuff_trim_talloc(&sbuff, SIZE_MAX);
 
 			entry = out->entry;
-			fr_value_box_bstrndup_shallow(out, NULL, fr_sbuff_buff(&sbuff), fr_sbuff_used(&sbuff), tainted);
+			fr_value_box_bstrndup(out, out, NULL, fr_sbuff_buff(&sbuff), fr_sbuff_used(&sbuff), tainted);
 			out->entry = entry;
 			break;
 
@@ -5681,7 +5682,7 @@ int fr_value_box_list_concat_in_place(TALLOC_CTX *ctx,
 			(void)fr_dbuff_trim_talloc(&dbuff, SIZE_MAX);
 
 			entry = out->entry;
-			fr_value_box_memdup_shallow(out, NULL, fr_dbuff_buff(&dbuff), fr_dbuff_used(&dbuff), tainted);
+			fr_value_box_memdup(out, out, NULL, fr_dbuff_buff(&dbuff), fr_dbuff_used(&dbuff), tainted);
 			out->entry = entry;
 			break;