diff options
| author | Stefan Metzmacher <metze@samba.org> | 2014-01-15 15:22:47 +0100 |
|---|---|---|
| committer | Günther Deschner <gd@samba.org> | 2014-02-13 11:54:14 +0100 |
| commit | 5d221271182f2614b5d2cd3adab728c20f655c2e (patch) | |
| tree | 31e12cb976acd1a042ce3829315aa18542f22684 /librpc | |
| parent | 7c0985bb352ce0d4bc896e951fee73ae32322d82 (diff) | |
| download | samba-5d221271182f2614b5d2cd3adab728c20f655c2e.tar.gz samba-5d221271182f2614b5d2cd3adab728c20f655c2e.tar.xz samba-5d221271182f2614b5d2cd3adab728c20f655c2e.zip | |
librpc/rpc: keep talloc hierachie sane in dcerpc_parse_binding()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Diffstat (limited to 'librpc')
| -rw-r--r-- | librpc/rpc/binding.c | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/librpc/rpc/binding.c b/librpc/rpc/binding.c index e81cd4d2b14..e34d31fcef3 100644 --- a/librpc/rpc/binding.c +++ b/librpc/rpc/binding.c @@ -374,13 +374,18 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc } for (i=0; (p = strchr(options, ',')); i++) { - b->options[i] = talloc_strndup(b, options, PTR_DIFF(p, options)); + b->options[i] = talloc_strndup(b->options, + options, + PTR_DIFF(p, options)); if (!b->options[i]) { return NT_STATUS_NO_MEMORY; } options = p+1; } - b->options[i] = options; + b->options[i] = talloc_strdup(b->options, options); + if (!b->options[i]) { + return NT_STATUS_NO_MEMORY; + } b->options[i+1] = NULL; /* some options are pre-parsed for convenience */ @@ -388,6 +393,7 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc for (j=0;j<ARRAY_SIZE(ncacn_options);j++) { size_t opt_len = strlen(ncacn_options[j].name); if (strncasecmp(ncacn_options[j].name, b->options[i], opt_len) == 0) { + char *o = discard_const_p(char, b->options[i]); int k; char c = b->options[i][opt_len]; @@ -398,6 +404,7 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc } b->flags |= ncacn_options[j].flag; + talloc_free(o); for (k=i;b->options[k];k++) { b->options[k] = b->options[k+1]; } @@ -409,8 +416,12 @@ _PUBLIC_ NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struc if (b->options[0] && strchr(b->options[0], '=') == NULL) { /* Endpoint is first option */ - b->endpoint = b->options[0]; - if (strlen(b->endpoint) == 0) b->endpoint = NULL; + b->endpoint = talloc_steal(b, b->options[0]); + if (strlen(b->endpoint) == 0) { + char *e = discard_const_p(char, b->endpoint); + talloc_free(e); + b->endpoint = NULL; + } for (i=0;b->options[i];i++) { b->options[i] = b->options[i+1]; |