librpc/rpc: handle dcerpc_binding->host == NULL in dcerpc_floor_get_rhs_data()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

diff --git a/librpc/rpc/binding.c b/librpc/rpc/binding.c
index 1c15b975ca8390f09a8a5b2342302dbdd1953dcc..8f85854008d95008ea28299d3d622b17328107fb 100644 (file)
--- a/librpc/rpc/binding.c
+++ b/librpc/rpc/binding.c
@@ -697,6 +697,7 @@ _PUBLIC_ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx,
        binding->transport = dcerpc_transport_by_tower(tower);
 
        if (binding->transport == (unsigned int)-1) {
+               talloc_free(binding);
                return NT_STATUS_NOT_SUPPORTED;
        }
 
@@ -705,6 +706,7 @@ _PUBLIC_ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx,
 
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1, ("Error pulling object uuid and version: %s", nt_errstr(status)));
+               talloc_free(binding);
                return status;
        }
 
@@ -713,18 +715,28 @@ _PUBLIC_ NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx,
        binding->options = NULL;
 
        /* Set endpoint */
+       errno = 0;
        if (tower->num_floors >= 4) {
                binding->endpoint = dcerpc_floor_get_rhs_data(binding, &tower->floors[3]);
-       } else {
-               binding->endpoint = NULL;
+       }
+       if (errno != 0) {
+               int saved_errno = errno;
+               talloc_free(binding);
+               return map_nt_error_from_unix_common(saved_errno);
        }
 
        /* Set network address */
+       errno = 0;
        if (tower->num_floors >= 5) {
                binding->host = dcerpc_floor_get_rhs_data(binding, &tower->floors[4]);
-               NT_STATUS_HAVE_NO_MEMORY(binding->host);
-               binding->target_hostname = binding->host;
        }
+       if (errno != 0) {
+               int saved_errno = errno;
+               talloc_free(binding);
+               return map_nt_error_from_unix_common(saved_errno);
+       }
+       binding->target_hostname = binding->host;
+
        *b_out = binding;
        return NT_STATUS_OK;
 }