ITS#8585 Fail ldap_result if handle is already bad

[openldap] / libraries / librewrite / subst.c

diff --git a/libraries/librewrite/subst.c b/libraries/librewrite/subst.c
index 8de7f7894051a94b45376d9fdbcca8f18b60c09d..8efed1422090277d06a2b4428ec6d51e59c39088 100644 (file)
--- a/libraries/librewrite/subst.c
+++ b/libraries/librewrite/subst.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2000-2004 The OpenLDAP Foundation.
+ * Copyright 2000-2017 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -55,11 +55,11 @@ rewrite_subst_compile(
                /*
                 * Keep only single escapes '%'
                 */
-               if ( p[ 0 ] != REWRITE_SUBMATCH_ESCAPE ) {
+               if (  !IS_REWRITE_SUBMATCH_ESCAPE( p[ 0 ] ) ) {
                        continue;
                } 
 
-               if ( p[ 1 ] == REWRITE_SUBMATCH_ESCAPE ) {
+               if (  IS_REWRITE_SUBMATCH_ESCAPE( p[ 1 ] ) ) {
                        /* Pull &p[1] over p, including the trailing '\0' */
                        AC_MEMCPY((char *)p, &p[ 1 ], strlen( p ) );
                        continue;
@@ -155,6 +155,7 @@ rewrite_subst_compile(
                        tmpsm = ( struct rewrite_submatch * )realloc( submatch,
                                        sizeof( struct rewrite_submatch )*( nsub + 1 ) );
                        if ( tmpsm == NULL ) {
+                               rewrite_map_destroy( &map );
                                goto cleanup;
                        }
                        submatch = tmpsm;
@@ -193,6 +194,9 @@ rewrite_subst_compile(
                subs_len += l;
                subs[ nsub ].bv_len = l;
                subs[ nsub ].bv_val = malloc( l + 1 );
+               if ( subs[ nsub ].bv_val == NULL ) {
+                       goto cleanup;
+               }
                AC_MEMCPY( subs[ nsub ].bv_val, begin, l );
                subs[ nsub ].bv_val[ l ] = '\0';
        } else {
@@ -206,11 +210,25 @@ rewrite_subst_compile(
        }
 
        s->lt_subs_len = subs_len;
-        s->lt_subs = subs;
-        s->lt_num_submatch = nsub;
-        s->lt_submatch = submatch;
+       s->lt_subs = subs;
+       s->lt_num_submatch = nsub;
+       s->lt_submatch = submatch;
+       subs = NULL;
+       submatch = NULL;
 
 cleanup:;
+       if ( subs ) {
+               for ( l=0; l<nsub; l++ ) {
+                       free( subs[nsub].bv_val );
+               }
+               free( subs );
+       }
+       if ( submatch ) {
+               for ( l=0; l<nsub; l++ ) {
+                       free( submatch[nsub].ls_map );
+               }
+               free( submatch );
+       }
        free( result );
 
        return s;
@@ -387,6 +405,7 @@ rewrite_subst_apply(
 
                if ( rc != REWRITE_SUCCESS ) {
                        rc = REWRITE_REGEXEC_ERR;
+                       goto cleanup;
                }
                
                /*
@@ -452,8 +471,8 @@ rewrite_subst_destroy(
        int                     n;
        struct rewrite_subst    *subst;
 
-       assert( psubst );
-       assert( *psubst );
+       assert( psubst != NULL );
+       assert( *psubst != NULL );
 
        subst = *psubst;