s4:ldb - fixed dangling pointer in ldb_request_add_control()

diff --git a/source4/lib/ldb/common/ldb_controls.c b/source4/lib/ldb/common/ldb_controls.c
index 32b2c0f66dfc7fe8a0abd057e99b883a9f4cee42..a8dd6b585984a0b3c3fcfb9e9eebafad37229bf6 100644 (file)
--- a/source4/lib/ldb/common/ldb_controls.c
+++ b/source4/lib/ldb/common/ldb_controls.c
@@ -123,7 +123,7 @@ int check_critical_controls(struct ldb_control **controls)
 
 int ldb_request_add_control(struct ldb_request *req, const char *oid, bool critical, void *data)
 {
 
 int ldb_request_add_control(struct ldb_request *req, const char *oid, bool critical, void *data)
 {

-       unsigned n;
+       unsigned i, n;

        struct ldb_control **ctrls;
        struct ldb_control *ctrl;
 
        struct ldb_control **ctrls;
        struct ldb_control *ctrl;
 


@@ -135,10 +135,15 @@ int ldb_request_add_control(struct ldb_request *req, const char *oid, bool criti
                n++; 
        }
 
                n++; 
        }
 

-       ctrls = talloc_realloc(req, req->controls,
+       ctrls = talloc_array(req,

                               struct ldb_control *,
                               n + 2);
        if (!ctrls) return LDB_ERR_OPERATIONS_ERROR;
                               struct ldb_control *,
                               n + 2);
        if (!ctrls) return LDB_ERR_OPERATIONS_ERROR;

+
+       for (i=0; i<n; i++) {
+               ctrls[i] = req->controls[i];
+       }
+

        req->controls = ctrls;
        ctrls[n] = NULL;
        ctrls[n+1] = NULL;
        req->controls = ctrls;
        ctrls[n] = NULL;
        ctrls[n+1] = NULL;