Fix more valgrind issues.

This passes down the timeout more consistantly, and ensures that no
matter how the modules screw up, we don't free() the memory we are
going to write into the ASN1 packet until we actually write it out.

Andrew Bartlett

4 files changed, 52 insertions, 3 deletions

diff --git a/source/dsdb/samdb/ldb_modules/linked_attributes.c b/source/dsdb/samdb/ldb_modules/linked_attributes.c
index 8685c722aad..04b9987071d 100644
--- a/source/dsdb/samdb/ldb_modules/linked_attributes.c
+++ b/source/dsdb/samdb/ldb_modules/linked_attributes.c
@@ -520,6 +520,12 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 			
 			talloc_steal(new_req, attrs);
 			
+			ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+
 			/* Create a spot in the list for the requests */
 			ac->down_req = talloc_realloc(ac, ac->down_req, 
 						      struct ldb_request *, ac->num_requests + 1);
@@ -568,6 +574,12 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 			
 			talloc_steal(new_req, attrs);
 			
+			ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+
 			/* Create a spot in the list for the requests */
 			ac->down_req = talloc_realloc(ac, ac->down_req, 
 						      struct ldb_request *, ac->num_requests + 1);
@@ -629,7 +641,11 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 			
 			talloc_steal(new_req, new_msg);
 			
-			ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+			
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
 			
 			/* Now add it to the list */
 			ac->down_req = talloc_realloc(ac, ac->down_req, 
@@ -752,6 +768,12 @@ static int linked_attributes_rename(struct ldb_module *module, struct ldb_reques
 
 	talloc_steal(new_req, attrs);
 
+	ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
 	ac->search_req = new_req;
 	ac->step = LA_SEARCH;
 	return ldb_next_request(module, new_req);
@@ -805,6 +827,12 @@ static int linked_attributes_delete(struct ldb_module *module, struct ldb_reques
 
 	talloc_steal(new_req, attrs);
 
+	ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
 	ac->search_req = new_req;
 	ac->step = LA_SEARCH;
 	return ldb_next_request(module, new_req);
diff --git a/source/dsdb/samdb/ldb_modules/subtree_rename.c b/source/dsdb/samdb/ldb_modules/subtree_rename.c
index bf8124e253a..fd1388d4164 100644
--- a/source/dsdb/samdb/ldb_modules/subtree_rename.c
+++ b/source/dsdb/samdb/ldb_modules/subtree_rename.c
@@ -117,7 +117,15 @@ static int subtree_rename_search_callback(struct ldb_context *ldb, void *context
 					   NULL,
 					   NULL);
 		
-		if (ret != LDB_SUCCESS) return ret;
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+
+		ret = ldb_set_timeout_from_prev_req(ldb, ac->orig_req, req);
+		
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
 
 		talloc_steal(req, newdn);
 
@@ -186,6 +194,12 @@ static int subtree_rename(struct ldb_module *module, struct ldb_request *req)
 		return ret;
 	}
 
+	ret = ldb_set_timeout_from_prev_req(module->ldb, req, new_req);
+	
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
 	ac->down_req = talloc_realloc(ac, ac->down_req, 
 					struct ldb_request *, ac->num_requests + 1);
 	if (!ac->down_req) {
diff --git a/source/ldap_server/ldap_backend.c b/source/ldap_server/ldap_backend.c
index 8b1c3cec693..9b43d7bd742 100644
--- a/source/ldap_server/ldap_backend.c
+++ b/source/ldap_server/ldap_backend.c
@@ -261,6 +261,11 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
 			ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultEntry);
 			NT_STATUS_HAVE_NO_MEMORY(ent_r);
 
+			/* Better to have the whole message kept here,
+			 * than to find someone further up didn't put
+			 * a value in the right spot in the talloc tree */
+			talloc_steal(ent_r, res->msgs[i]);
+			
 			ent = &ent_r->msg->r.SearchResultEntry;
 			ent->dn = ldb_dn_alloc_linearized(ent_r, res->msgs[i]->dn);
 			ent->num_attributes = 0;
diff --git a/source/ldap_server/ldap_server.c b/source/ldap_server/ldap_server.c
index 5b2519c035a..ce80941e03f 100644
--- a/source/ldap_server/ldap_server.c
+++ b/source/ldap_server/ldap_server.c
@@ -155,8 +155,10 @@ static NTSTATUS ldapsrv_decode(void *private, DATA_BLOB blob)
 	}
 
 	data_blob_free(&blob);
-	ldapsrv_process_message(conn, msg);
+	talloc_steal(conn, msg);
 	asn1_free(asn1);
+
+	ldapsrv_process_message(conn, msg);
 	return NT_STATUS_OK;
 }