svn commit: samba r16610 - in branches/SAMBA_3_0/source/nsswitch: .

[jra at samba.org]

Author: jra
Date: 2006-06-28 04:43:19 +0000 (Wed, 28 Jun 2006)
New Revision: 16610

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=16610

Log:
Subtle one from Klocwork #2076. If multiple flags
are set in a winbindd request it might overwrite existing
state->response.extra_data.data values without freeing.
Jeremy.

Modified:
   branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c


Changeset:
Modified: branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c
===================================================================
--- branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c	2006-06-28 04:43:14 UTC (rev 16609)
+++ branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c	2006-06-28 04:43:19 UTC (rev 16610)
@@ -97,6 +97,7 @@
 	}
 
 	size = prs_data_size(&ps);
+	SAFE_FREE(state->response.extra_data.data);
 	state->response.extra_data.data = SMB_MALLOC(size);
 	if (!state->response.extra_data.data) {
 		prs_mem_free(&ps);
@@ -1365,6 +1366,7 @@
 		cell += 1;
 
 		/* Append an AFS token string */
+		SAFE_FREE(state->response.extra_data.data);
 		state->response.extra_data.data =
 			afs_createtoken_str(afsname, cell);
 
@@ -1614,6 +1616,7 @@
 
 			DEBUG(5, ("Setting unix username to [%s]\n", username_out));
 
+			SAFE_FREE(state->response.extra_data.data);
 			state->response.extra_data.data = SMB_STRDUP(username_out);
 			if (!state->response.extra_data.data) {
 				result = NT_STATUS_NO_MEMORY;