svn commit: samba r10375 - in trunk/source: rpc_client rpc_parse

[jra at samba.org]

Author: jra
Date: 2005-09-21 03:34:45 +0000 (Wed, 21 Sep 2005)
New Revision: 10375

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=10375

Log:
Fix double-free error found by valgrind in new pipe code.
Jeremy.

Modified:
   trunk/source/rpc_client/cli_pipe.c
   trunk/source/rpc_parse/parse_prs.c


Changeset:
Modified: trunk/source/rpc_client/cli_pipe.c
===================================================================
--- trunk/source/rpc_client/cli_pipe.c	2005-09-21 00:38:23 UTC (rev 10374)
+++ trunk/source/rpc_client/cli_pipe.c	2005-09-21 03:34:45 UTC (rev 10375)
@@ -1827,7 +1827,7 @@
 					RPC_IFACE *abstract,
 					RPC_IFACE *transfer,
 					enum pipe_auth_level auth_level,
-					DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
+					const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
 					prs_struct *rpc_out)
 {
 	RPC_HDR_AUTH hdr_auth;
@@ -1841,7 +1841,7 @@
 	init_rpc_hdr_auth(&hdr_auth, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
 
 	if (pauth_blob->length) {
-		if (!prs_copy_data_in(&auth_info, (char *)pauth_blob->data, pauth_blob->length)) {
+		if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
 			prs_mem_free(&auth_info);
 			return NT_STATUS_NO_MEMORY;
 		}
@@ -1925,6 +1925,7 @@
 	tmp_blob = spnego_gen_auth(client_reply);
 	data_blob_free(&client_reply);
 	client_reply = tmp_blob;
+	tmp_blob = data_blob(NULL,0); /* Ensure it's safe to free this just in case. */
 
 	/* Now prepare the alter context pdu. */
 	prs_init(&rpc_out, 0, prs_get_mem_context(rbuf), MARSHALL);

Modified: trunk/source/rpc_parse/parse_prs.c
===================================================================
--- trunk/source/rpc_parse/parse_prs.c	2005-09-21 00:38:23 UTC (rev 10374)
+++ trunk/source/rpc_parse/parse_prs.c	2005-09-21 03:34:45 UTC (rev 10375)
@@ -398,7 +398,7 @@
  Append the data from a buffer into a parse_struct.
  ********************************************************************/
 
-BOOL prs_copy_data_in(prs_struct *dst, char *src, uint32 len)
+BOOL prs_copy_data_in(prs_struct *dst, const char *src, uint32 len)
 {
 	if (len == 0)
 		return True;