From bab600baf660b035b4ffbd8389e74be3f5c9e330 Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Thu, 3 Jan 2002 03:11:14 +0000 Subject: [PATCH] Safety checks for bvec's in previous patch --- libraries/liblber/decode.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/libraries/liblber/decode.c b/libraries/liblber/decode.c index 1504e04a1a..33dff6bec7 100644 --- a/libraries/liblber/decode.c +++ b/libraries/liblber/decode.c @@ -296,7 +296,7 @@ typedef struct bgbvr { ber_tag_t ber_get_stringbvr( bgbvr *b, int n ) { - struct berval bv; + struct berval bv, *bvp = NULL; if ( n ) b->tag = ber_next_element( b->ber, &b->len, b->last ); @@ -327,8 +327,13 @@ ber_get_stringbvr( bgbvr *b, int n ) return 0; } - if ( ber_get_stringbv( b->ber, &bv ) == LBER_DEFAULT ) + if ( b->choice == BvVec ) + bvp = LBER_MALLOC( sizeof( struct berval )); + + if ( ber_get_stringbv( b->ber, &bv ) == LBER_DEFAULT ) { + if ( bvp ) LBER_FREE( bvp ); return LBER_DEFAULT; + } b->tag = ber_get_stringbvr( b, n+1 ); if ( b->tag == 0 ) @@ -342,10 +347,12 @@ ber_get_stringbvr( bgbvr *b, int n ) (*b->res.ba)[n] = bv; break; case BvVec: - (*b->res.bv)[n] = ber_bvdup( &bv ); + (*b->res.bv)[n] = bvp; + *bvp = bv; break; } } else { + if ( bvp ) LBER_FREE( bvp ); LBER_FREE( bv.bv_val ); } return b->tag; -- 2.39.5