[PATCH] NTLM_AUTH leaks memory when used with old version of curl

[Kai Blin]

On Tuesday 17 November 2009 07:24:14 Volker Lendecke wrote:
> On Tue, Nov 17, 2009 at 10:30:45AM +0530, Shibu p wrote:
> > I missed to mention about the version, sorry about that.
> > Yes, we still run old version of samba - samba-3.0.xx.
> > I am not sure if this leak exist on newer versions of samba.
> 
> Please try a later version, we won't fix 3.0 for this one
> anymore.

That code seems to exist in master as well. However, I think not duplicating 
the data blob is the wrong fix. The correct fix seems to be to use 
data_blob_talloc() in winbind_pw_check() to hang the memory off the 
ntlmssp_state instead of the NULL context. That way it's freed on calling 
ntlmssp_end() once the reference count drops to 0.

Volker, what do you think of attached patch (and above reasoning for that 
matter)?

Cheers,
Kai

-- 
Kai Blin
WorldForge developer  http://www.worldforge.org/
Wine developer        http://wiki.winehq.org/KaiBlin
Samba team member     http://www.samba.org/samba/team/
--
Will code for cotton.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-ntlm_auth-use-data_blob_talloc-to-allocate-session-k.patch
Type: text/x-patch
Size: 1140 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20091120/f7c615b9/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20091120/f7c615b9/attachment.pgp>