From 9e3eef02b91ab6c894665c63928a775635b291cb Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Wed, 15 Dec 2010 15:06:39 +0100 Subject: [PATCH 3/4] Fix another possible memory leak in sss_nss_recv_rep() https://fedorahosted.org/sssd/ticket/723 --- src/sss_client/common.c | 27 +++++++++++++++++++-------- 1 files changed, 19 insertions(+), 8 deletions(-) diff --git a/src/sss_client/common.c b/src/sss_client/common.c index 905c0df..20def9b 100644 --- a/src/sss_client/common.c +++ b/src/sss_client/common.c @@ -175,8 +175,9 @@ static enum nss_status sss_nss_recv_rep(enum sss_cli_command cmd, { uint32_t header[4]; size_t datarecv; - uint8_t *buf; + uint8_t *buf = NULL; int len; + int ret; header[0] = SSS_NSS_HEADER_SIZE; /* unitl we know the real lenght */ header[1] = 0; @@ -228,7 +229,8 @@ static enum nss_status sss_nss_recv_rep(enum sss_cli_command cmd, } if (*errnop) { sss_cli_close_socket(); - return NSS_STATUS_UNAVAIL; + ret = NSS_STATUS_UNAVAIL; + goto failed; } errno = 0; @@ -259,7 +261,8 @@ static enum nss_status sss_nss_recv_rep(enum sss_cli_command cmd, sss_cli_close_socket(); *errnop = errno; - return NSS_STATUS_UNAVAIL; + ret = NSS_STATUS_UNAVAIL; + goto failed; } datarecv += res; @@ -273,24 +276,28 @@ static enum nss_status sss_nss_recv_rep(enum sss_cli_command cmd, sss_cli_close_socket(); *errnop = header[2]; if (*errnop == EAGAIN) { - return NSS_STATUS_TRYAGAIN; + ret = NSS_STATUS_TRYAGAIN; + goto failed; } else { - return NSS_STATUS_UNAVAIL; + ret = NSS_STATUS_UNAVAIL; + goto failed; } } if (header[1] != cmd) { /* wrong command id */ sss_cli_close_socket(); *errnop = EBADMSG; - return NSS_STATUS_UNAVAIL; + ret = NSS_STATUS_UNAVAIL; + goto failed; } if (header[0] > SSS_NSS_HEADER_SIZE) { len = header[0] - SSS_NSS_HEADER_SIZE; buf = malloc(len); if (!buf) { sss_cli_close_socket(); - *errnop = ENOMEM; - return NSS_STATUS_UNAVAIL; + *errnop = ENOMEM; + ret = NSS_STATUS_UNAVAIL; + goto failed; } } } @@ -300,6 +307,10 @@ static enum nss_status sss_nss_recv_rep(enum sss_cli_command cmd, *_buf = buf; return NSS_STATUS_SUCCESS; + +failed: + free(buf); + return ret; } /* this function will check command codes match and returned length is ok */ -- 1.7.3.2