Fix noticed by Corny.Bondad@hp.com. Ensure we free up memory on error exit.

Jeremy.
(This used to be commit 05a8a61af83a6d85ddbb70749c8cd0abe9eb8180)

diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 08337c2901ac2d54fd50c545fafcaf87bcb8ff4e..67c5da01f33809e09695417694bce7ce820747c4 100644 (file)
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -397,6 +397,7 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int
        if (tpscnt) {
                if((params = (char *)malloc(tpscnt)) == NULL) {
                        DEBUG(0,("reply_trans: param malloc fail for %u bytes !\n", tpscnt));
+                       SAFE_FREE(data);
                        END_PROFILE(SMBtrans);
                        return(ERROR_DOS(ERRDOS,ERRnomem));
                } 
@@ -412,6 +413,8 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int
                int i;
                if((setup = (uint16 *)malloc(suwcnt*sizeof(uint16))) == NULL) {
                        DEBUG(0,("reply_trans: setup malloc fail for %u bytes !\n", (unsigned int)(suwcnt * sizeof(uint16))));
+                       SAFE_FREE(data);
+                       SAFE_FREE(params);
                        END_PROFILE(SMBtrans);
                        return(ERROR_DOS(ERRDOS,ERRnomem));
                }