Merge from the Sendmail CVS: fix potential memory leak: only set

up data after all allocations succeeded, free previously allocated
data if later allocation fails.

Prompted by parfait and based on a patch from jsg@; additional bits
from me and Claus Assmann of Sendmail.  ok deraadt@

2 files changed, 21 insertions, 11 deletions

diff --git a/gnu/usr.sbin/sendmail/libsmdb/smdb1.c b/gnu/usr.sbin/sendmail/libsmdb/smdb1.c
index 8e158c4e11d..07390d23a6a 100644
--- a/gnu/usr.sbin/sendmail/libsmdb/smdb1.c
+++ b/gnu/usr.sbin/sendmail/libsmdb/smdb1.c
@@ -1,5 +1,5 @@
 /*
-** Copyright (c) 1999-2002 Sendmail, Inc. and its suppliers.
+** Copyright (c) 1999-2002, 2004, 2009 Sendmail, Inc. and its suppliers.
 **	All rights reserved.
 **
 ** By using this file, you agree to the terms and conditions set
@@ -8,7 +8,7 @@
 */
 
 #include <sm/gen.h>
-SM_RCSID("@(#)$Sendmail: smdb1.c,v 8.59 2004/08/03 20:58:39 ca Exp $")
+SM_RCSID("@(#)$Sendmail: smdb1.c,v 8.62 2009/11/12 23:04:18 ca Exp $")
 
 #include <unistd.h>
 #include <stdlib.h>
@@ -397,15 +397,19 @@ smdb1_cursor(database, cursor, flags)
 	if (db1->smdb1_cursor_in_use)
 		return SMDBE_ONLY_SUPPORTS_ONE_CURSOR;
 
-	db1->smdb1_cursor_in_use = true;
 	db1_cursor = (SMDB_DB1_CURSOR *) malloc(sizeof(SMDB_DB1_CURSOR));
-	db1_cursor->db = db1;
+	if (db1_cursor == NULL)
+		return SMDBE_MALLOC;
 
 	cur = (SMDB_CURSOR *) malloc(sizeof(SMDB_CURSOR));
-
 	if (cur == NULL)
+	{
+		free(db1_cursor);
 		return SMDBE_MALLOC;
+	}
 
+	db1->smdb1_cursor_in_use = true;
+	db1_cursor->db = db1;
 	cur->smdbc_impl = db1_cursor;
 	cur->smdbc_close = smdb1_cursor_close;
 	cur->smdbc_del = smdb1_cursor_del;
@@ -502,7 +506,12 @@ smdb_db_open(database, db_name, mode, mode_mask, sff, type, user_info,
 	smdb_db = smdb_malloc_database();
 	db1 = smdb1_malloc_database();
 	if (smdb_db == NULL || db1 == NULL)
+	{
+		(void) smdb_unlock_file(lock_fd);
+		smdb_free_database(smdb_db);
+		free(db1);
 		return SMDBE_MALLOC;
+	}
 	db1->smdb1_lock_fd = lock_fd;
 
 	params = NULL;
diff --git a/gnu/usr.sbin/sendmail/libsmdb/smdb2.c b/gnu/usr.sbin/sendmail/libsmdb/smdb2.c
index 1b23458d3d0..3eb135579e9 100644
--- a/gnu/usr.sbin/sendmail/libsmdb/smdb2.c
+++ b/gnu/usr.sbin/sendmail/libsmdb/smdb2.c
@@ -1,5 +1,5 @@
 /*
-** Copyright (c) 1999-2003 Sendmail, Inc. and its suppliers.
+** Copyright (c) 1999-2003, 2009 Sendmail, Inc. and its suppliers.
 **	All rights reserved.
 **
 ** By using this file, you agree to the terms and conditions set
@@ -8,7 +8,7 @@
 */
 
 #include <sm/gen.h>
-SM_RCSID("@(#)$Sendmail: smdb2.c,v 8.79 2003/06/13 21:33:11 ca Exp $")
+SM_RCSID("@(#)$Sendmail: smdb2.c,v 8.80 2009/11/12 23:07:49 ca Exp $")
 
 #include <fcntl.h>
 #include <stdlib.h>
@@ -620,12 +620,13 @@ smdb_db_open(database, db_name, mode, mode_mask, sff, type, user_info, db_params
 	}
 
 	smdb_db = smdb_malloc_database();
-	if (smdb_db == NULL)
-		return SMDBE_MALLOC;
-
 	db2 = smdb2_malloc_database();
-	if (db2 == NULL)
+	if (db2 == NULL || smdb_db == NULL)
+	{
+		smdb_unlock_file(lock_fd);
+		smdb_free_database(smdb_db);	/* ok to be NULL */
 		return SMDBE_MALLOC;
+	}
 
 	db2->smdb2_lock_fd = lock_fd;