r19732: The 'res' from ldb_search is only valid if the call returns LDB_SUCCESS.

This seems to show up (as an abort() from talloc) particularly under
ldb_ildap.

Andrew Bartlett

diff --git a/source/dsdb/samdb/ldb_modules/samldb.c b/source/dsdb/samdb/ldb_modules/samldb.c
index e86a3bfde4bb059263e48bd3a9e52bdc7f808238..3ce5cc1b5cb3e158f1f385de98983228f34d007e 100644 (file)
--- a/source/dsdb/samdb/ldb_modules/samldb.c
+++ b/source/dsdb/samdb/ldb_modules/samldb.c
@@ -200,9 +200,12 @@ static struct ldb_dn *samldb_search_domain(struct ldb_module *module, TALLOC_CTX
        do {
                ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE, 
                                 "(|(objectClass=domain)(objectClass=builtinDomain))", attrs, &res);
-               talloc_steal(local_ctx, res);
-               if (ret == LDB_SUCCESS && res->count == 1)
-                       break;
+               if (ret == LDB_SUCCESS) {
+                       talloc_steal(local_ctx, res);
+                       if (res->count == 1) {
+                               break;
+                       }
+               }
        } while ((sdn = ldb_dn_get_parent(local_ctx, sdn)));
 
        if (ret != LDB_SUCCESS || res->count != 1) {

diff --git a/source/scripting/ejs/smbcalls_ldb.c b/source/scripting/ejs/smbcalls_ldb.c
index f8296b9d36026bc42de64da2f5738284b8d7bed8..0af9738b60c62e17c97598f584cb36c6062b661b 100644 (file)
--- a/source/scripting/ejs/smbcalls_ldb.c
+++ b/source/scripting/ejs/smbcalls_ldb.c
@@ -111,8 +111,8 @@ static int ejs_ldbSearch(MprVarHandle eid, int argc, struct MprVar **argv)
                mpr_Return(eid, mprCreateUndefinedVar());
        } else {
                mpr_Return(eid, mprLdbArray(ldb, res->msgs, res->count, "ldb_message"));
+               talloc_free(res);
        }
-       talloc_free(res);
        talloc_free(tmp_ctx);
        return 0;