]> git.ipfire.org Git - thirdparty/samba.git/commitdiff
s3: RPC: Don't crash on trying to talloc_free(-1) if smb_iconv_open_ex() fails.
authorJeremy Allison <jra@samba.org>
Wed, 6 May 2020 19:36:00 +0000 (12:36 -0700)
committerRalph Boehme <slow@samba.org>
Thu, 7 May 2020 18:03:16 +0000 (18:03 +0000)
Assign output from smb_iconv_open_ex() to a temporary
handle. Only assign to mds_ctx->[handles] if correctly
opened otherwise we end up trying to call smb_iconv_close(-1).

MacOSX Catalina triggers this.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14372

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu May  7 18:03:16 UTC 2020 on sn-devel-184

source3/rpc_server/mdssvc/mdssvc.c

index fce3335d60214e7fdcfbd7c741120e4c0a7b3dd2..d6edc1c1686a79c856cc2be8f2307a8475b67363 100644 (file)
@@ -1528,6 +1528,7 @@ struct mds_ctx *mds_init_ctx(TALLOC_CTX *mem_ctx,
        struct mds_ctx *mds_ctx;
        int backend;
        bool ok;
+       smb_iconv_t iconv_hnd = (smb_iconv_t)-1;
 
        mds_ctx = talloc_zero(mem_ctx, struct mds_ctx);
        if (mds_ctx == NULL) {
@@ -1566,21 +1567,23 @@ struct mds_ctx *mds_init_ctx(TALLOC_CTX *mem_ctx,
                goto error;
        }
 
-       mds_ctx->ic_nfc_to_nfd = smb_iconv_open_ex(mds_ctx,
+       iconv_hnd = smb_iconv_open_ex(mds_ctx,
                                                   "UTF8-NFD",
                                                   "UTF8-NFC",
                                                   false);
-       if (mds_ctx->ic_nfc_to_nfd == (smb_iconv_t)-1) {
+       if (iconv_hnd == (smb_iconv_t)-1) {
                goto error;
        }
+       mds_ctx->ic_nfc_to_nfd = iconv_hnd;
 
-       mds_ctx->ic_nfd_to_nfc = smb_iconv_open_ex(mds_ctx,
+       iconv_hnd = smb_iconv_open_ex(mds_ctx,
                                                   "UTF8-NFC",
                                                   "UTF8-NFD",
                                                   false);
-       if (mds_ctx->ic_nfd_to_nfc == (smb_iconv_t)-1) {
+       if (iconv_hnd == (smb_iconv_t)-1) {
                goto error;
        }
+       mds_ctx->ic_nfd_to_nfc = iconv_hnd;
 
        mds_ctx->sharename = talloc_strdup(mds_ctx, sharename);
        if (mds_ctx->sharename == NULL) {