lib ldb: fix use after free
authorGary Lockyer <gary@catalyst.net.nz>
Tue, 17 Dec 2019 22:17:51 +0000 (11:17 +1300)
committerAndrew Bartlett <abartlet@samba.org>
Wed, 18 Dec 2019 06:39:26 +0000 (06:39 +0000)
Fix ASAN detected use after free.  No security implications as  the
talloc_free is followed immediately by the print statement and the value
printed is an integer

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
lib/ldb/common/ldb.c

index 95e9138a56b82f993a628890f45fac8b9013cc0b..8c86dca45a1e20cf32b83955eac234c3b6d7ba63 100644 (file)
@@ -1392,8 +1392,8 @@ int ldb_op_default_callback(struct ldb_request *req, struct ldb_reply *ares)
        }
 
        if (ares->type != LDB_REPLY_DONE) {
-               talloc_free(ares);
                ldb_asprintf_errstring(req->handle->ldb, "Invalid LDB reply type %d", ares->type);
+               TALLOC_FREE(ares);
                return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
        }