Author: abartlet Date: 2007-07-21 10:14:46 +0000 (Sat, 21 Jul 2007) New Revision: 23982
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=23982 Log: Fix use-after-realloc() found by valgrind and [EMAIL PROTECTED] Should fix bug #4804. Andrew Bartlett Modified: branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/kludge_acl.c Changeset: Modified: branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/kludge_acl.c =================================================================== --- branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/kludge_acl.c 2007-07-20 16:39:42 UTC (rev 23981) +++ branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/kludge_acl.c 2007-07-21 10:14:46 UTC (rev 23982) @@ -115,7 +115,7 @@ static int kludge_acl_allowedAttributes(struct ldb_context *ldb, struct ldb_message *msg, const char *attrName) { - struct ldb_message_element *oc_el = ldb_msg_find_element(msg, "objectClass"); + struct ldb_message_element *oc_el; struct ldb_message_element *allowedAttributes; const struct dsdb_schema *schema = dsdb_get_schema(ldb); const struct dsdb_class *class; @@ -125,6 +125,10 @@ return ret; } + /* To ensure that oc_el is valid, we must look for it after + we alter the element array in ldb_msg_add_empty() */ + oc_el = ldb_msg_find_element(msg, "objectClass"); + for (i=0; i < oc_el->num_values; i++) { class = dsdb_class_by_lDAPDisplayName(schema, (const char *)oc_el->values[i].data); if (!class) {
