ITS#8585 Fail ldap_result if handle is already bad

[openldap] / libraries / librewrite / subst.c

diff --git a/libraries/librewrite/subst.c b/libraries/librewrite/subst.c
index 5ab89cd7f646706cecf6d3f1de43d4b2921fd7af..8efed1422090277d06a2b4428ec6d51e59c39088 100644 (file)
--- a/libraries/librewrite/subst.c
+++ b/libraries/librewrite/subst.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2000-2005 The OpenLDAP Foundation.
+ * Copyright 2000-2017 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -155,6 +155,7 @@ rewrite_subst_compile(
                        tmpsm = ( struct rewrite_submatch * )realloc( submatch,
                                        sizeof( struct rewrite_submatch )*( nsub + 1 ) );
                        if ( tmpsm == NULL ) {
+                               rewrite_map_destroy( &map );
                                goto cleanup;
                        }
                        submatch = tmpsm;
@@ -193,6 +194,9 @@ rewrite_subst_compile(
                subs_len += l;
                subs[ nsub ].bv_len = l;
                subs[ nsub ].bv_val = malloc( l + 1 );
+               if ( subs[ nsub ].bv_val == NULL ) {
+                       goto cleanup;
+               }
                AC_MEMCPY( subs[ nsub ].bv_val, begin, l );
                subs[ nsub ].bv_val[ l ] = '\0';
        } else {
@@ -206,11 +210,25 @@ rewrite_subst_compile(
        }
 
        s->lt_subs_len = subs_len;
-        s->lt_subs = subs;
-        s->lt_num_submatch = nsub;
-        s->lt_submatch = submatch;
+       s->lt_subs = subs;
+       s->lt_num_submatch = nsub;
+       s->lt_submatch = submatch;
+       subs = NULL;
+       submatch = NULL;
 
 cleanup:;
+       if ( subs ) {
+               for ( l=0; l<nsub; l++ ) {
+                       free( subs[nsub].bv_val );
+               }
+               free( subs );
+       }
+       if ( submatch ) {
+               for ( l=0; l<nsub; l++ ) {
+                       free( submatch[nsub].ls_map );
+               }
+               free( submatch );
+       }
        free( result );
 
        return s;
@@ -453,8 +471,8 @@ rewrite_subst_destroy(
        int                     n;
        struct rewrite_subst    *subst;
 
-       assert( psubst );
-       assert( *psubst );
+       assert( psubst != NULL );
+       assert( *psubst != NULL );
 
        subst = *psubst;