printing: don't leak cache_path onto talloc tos

Also check for allocation failures.

Reported-by: Franz Pförtsch <franz.pfoertsch@brose.com>
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/printing/printing.c b/source3/printing/printing.c
index dcfd2a2dc5e471c08921a576647a9a09eebf353b..d8b619162e9b3c45e0b39cddbd6cf2c0a10f3670 100644 (file)
--- a/source3/printing/printing.c
+++ b/source3/printing/printing.c
@@ -198,17 +198,28 @@ bool print_backend_init(struct messaging_context *msg_ctx)
        int services = lp_numservices();
        int snum;
        bool ok;
+       char *print_cache_path;
 
        if (!printer_list_parent_init()) {
                return false;
        }
 
-       ok = directory_create_or_exist(cache_path("printing"), 0755);
+       print_cache_path = cache_path("printing");
+       if (print_cache_path == NULL) {
+               return false;
+       }
+       ok = directory_create_or_exist(print_cache_path, 0755);
+       TALLOC_FREE(print_cache_path);
        if (!ok) {
                return false;
        }
 
-       unlink(cache_path("printing.tdb"));
+       print_cache_path = cache_path("printing.tdb");
+       if (print_cache_path == NULL) {
+               return false;
+       }
+       unlink(print_cache_path);
+       TALLOC_FREE(print_cache_path);
 
        /* handle a Samba upgrade */
 

diff --git a/source3/printing/printing_db.c b/source3/printing/printing_db.c
index b721317e5d6816a14b8b54dda9381e5feae4f1ac..1a129eaad3b7ea0cebd77eb2e339f0150b06274c 100644 (file)
--- a/source3/printing/printing_db.c
+++ b/source3/printing/printing_db.c
@@ -38,6 +38,8 @@ struct tdb_print_db *get_print_db_byname(const char *printername)
        int num_open = 0;
        char *printdb_path = NULL;
        bool done_become_root = False;
+       char *print_cache_path;
+       int ret;
 
        SMB_ASSERT(printername != NULL);
 
@@ -93,9 +95,16 @@ struct tdb_print_db *get_print_db_byname(const char *printername)
                DLIST_ADD(print_db_head, p);
        }
 
-       if (asprintf(&printdb_path, "%s%s.tdb",
-                               cache_path("printing/"),
-                               printername) < 0) {
+       print_cache_path = cache_path("printing/");
+       if (print_cache_path == NULL) {
+               DLIST_REMOVE(print_db_head, p);
+               SAFE_FREE(p);
+               return NULL;
+       }
+       ret = asprintf(&printdb_path, "%s%s.tdb",
+                      print_cache_path, printername);
+       TALLOC_FREE(print_cache_path);
+       if (ret < 0) {
                DLIST_REMOVE(print_db_head, p);
                SAFE_FREE(p);
                return NULL;