Fix two memleaks in the encryption code

[ira/wip.git] / source3 / libsmb / smb_seal.c

diff --git a/source3/libsmb/smb_seal.c b/source3/libsmb/smb_seal.c
index b5befbf7cdcecba0e7adc2fd83adf28f781927a2..2f7305c5b65466c95439391b227fda70e12d18c8 100644 (file)
--- a/source3/libsmb/smb_seal.c
+++ b/source3/libsmb/smb_seal.c
@@ -136,7 +136,7 @@ NTSTATUS common_ntlm_encrypt_buffer(NTLMSSP_STATE *ntlmssp_state,
 
        smb_set_enclen(buf_out, smb_len(buf) + NTLMSSP_SIG_SIZE, enc_ctx_num);
 
-       sig = data_blob(NULL, NTLMSSP_SIG_SIZE);
+       ZERO_STRUCT(sig);
 
        status = ntlmssp_seal_packet(ntlmssp_state,
                (unsigned char *)buf_out + 8 + NTLMSSP_SIG_SIZE, /* 4 byte len + 0xFF 'S' <enc> <ctx> */
@@ -153,6 +153,7 @@ NTSTATUS common_ntlm_encrypt_buffer(NTLMSSP_STATE *ntlmssp_state,
 
        /* First 16 data bytes are signature for SSPI compatibility. */
        memcpy(buf_out + 8, sig.data, NTLMSSP_SIG_SIZE);
+       data_blob_free(&sig);
        *ppbuf_out = buf_out;
        return NT_STATUS_OK;
 }
@@ -388,10 +389,17 @@ void common_free_encryption_state(struct smb_trans_enc_state **pp_es)
 
 void common_free_enc_buffer(struct smb_trans_enc_state *es, char *buf)
 {
+       uint16_t enc_ctx_num;
+
        if (!common_encryption_on(es)) {
                return;
        }
 
+       if (!NT_STATUS_IS_OK(get_enc_ctx_num((const uint8_t *)buf,
+                       &enc_ctx_num))) {
+               return;
+       }
+
        if (es->smb_enc_type == SMB_TRANS_ENC_NTLM) {
                SAFE_FREE(buf);
                return;
@@ -483,15 +491,15 @@ NTSTATUS cli_decrypt_message(struct cli_state *cli)
  Encrypt an outgoing buffer. Return the encrypted pointer in buf_out.
 ******************************************************************************/
 
-NTSTATUS cli_encrypt_message(struct cli_state *cli, char **buf_out)
+NTSTATUS cli_encrypt_message(struct cli_state *cli, char *buf, char **buf_out)
 {
        /* Ignore non-session messages. */
-       if(CVAL(cli->outbuf,0)) {
+       if (CVAL(buf,0)) {
                return NT_STATUS_OK;
        }
 
        /* If we supported multiple encrytion contexts
         * here we'd look up based on tid.
         */
-       return common_encrypt_buffer(cli->trans_enc_state, cli->outbuf, buf_out);
+       return common_encrypt_buffer(cli->trans_enc_state, buf, buf_out);
 }