Fix segfault caused by calling free() on memory allocated in wbcSidToString()

which was recently converted internally to talloc().

diff --git a/source/nsswitch/libwbclient/wbclient.c b/source/nsswitch/libwbclient/wbclient.c
index 5a9c96507b625b63547c3dd102faccfaad71609d..8ad471829b768c3b9f942a472c4fea05f70762dd 100644 (file)
--- a/source/nsswitch/libwbclient/wbclient.c
+++ b/source/nsswitch/libwbclient/wbclient.c
@@ -268,7 +268,7 @@ wbcErr wbcLookupSid(const struct wbcDomainSid *sid,
        BAIL_ON_WBC_ERROR(wbc_ret);
 
        strncpy(request.data.sid, sid_string, sizeof(request.data.sid)-1);
-       free(sid_string);
+       wbcFreeMemory(sid_string);
 
        /* Make request */
 
@@ -341,7 +341,7 @@ wbcErr wbcSidToUid(const struct wbcDomainSid *sid, uid_t *puid)
        BAIL_ON_WBC_ERROR(wbc_ret);
 
        strncpy(request.data.sid, sid_string, sizeof(request.data.sid)-1);
-       free(sid_string);
+       wbcFreeMemory(sid_string);
 
        /* Make request */
 
@@ -431,7 +431,7 @@ wbcErr wbcSidToGid(const struct wbcDomainSid *sid, gid_t *pgid)
        BAIL_ON_WBC_ERROR(wbc_ret);
 
        strncpy(request.data.sid, sid_string, sizeof(request.data.sid)-1);
-       free(sid_string);
+       wbcFreeMemory(sid_string);
 
        /* Make request */
 
@@ -637,6 +637,7 @@ wbcErr wbcLookupRids(struct wbcDomainSid *dom_sid,
        BAIL_ON_WBC_ERROR(ret);
 
        strncpy(request.data.sid, sid_string, sizeof(request.data.sid)-1);
+       wbcFreeMemory(sid_string);
 
        /* Even if all the Rids were of maximum 32bit values,
           we would only have 11 bytes per rid in the final array