Do not assume that asprintf() clears the pointer on failure, which

is non-portable.  Also add missing asprintf() return value checks.
OK deraadt@ guenther@ doug@

4 files changed, 22 insertions, 10 deletions

diff --git a/usr.sbin/ldapd/btree.c b/usr.sbin/ldapd/btree.c
index cbba2ba5c54..eaf0d2fb7c7 100644
--- a/usr.sbin/ldapd/btree.c
+++ b/usr.sbin/ldapd/btree.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: btree.c,v 1.32 2015/01/16 16:04:38 deraadt Exp $ */
+/*	$OpenBSD: btree.c,v 1.33 2015/06/03 02:24:36 millert Exp $ */
 
 /*
  * Copyright (c) 2009, 2010 Martin Hedenfalk <martin@bzero.se>
@@ -3071,7 +3071,10 @@ btree_compact(struct btree *bt)
 	if ((txn = btree_txn_begin(bt, 0)) == NULL)
 		return BT_FAIL;
 
-	asprintf(&compact_path, "%s.compact.XXXXXX", bt->path);
+	if (asprintf(&compact_path, "%s.compact.XXXXXX", bt->path) == -1) {
+		btree_txn_abort(txn);
+		return BT_FAIL;
+	}
 	fd = mkstemp(compact_path);
 	if (fd == -1) {
 		free(compact_path);
diff --git a/usr.sbin/ldapd/index.c b/usr.sbin/ldapd/index.c
index 8d1b0f8d320..c8dbb7f6198 100644
--- a/usr.sbin/ldapd/index.c
+++ b/usr.sbin/ldapd/index.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: index.c,v 1.8 2010/11/26 14:44:01 martinh Exp $ */
+/*	$OpenBSD: index.c,v 1.9 2015/06/03 02:24:36 millert Exp $ */
 
 /*
  * Copyright (c) 2009 Martin Hedenfalk <martin@bzero.se>
@@ -107,6 +107,8 @@ index_attribute(struct namespace *ns, char *attr, struct btval *dn,
 		bzero(&key, sizeof(key));
 		key.size = asprintf(&t, "%s=%s,%.*s", attr, s, dnsz,
 		    (char *)dn->data);
+		if (key.size == (size_t)-1)
+			return -1;
 		key.data = t;
 		normalize_dn(key.data);
 		rc = btree_txn_put(NULL, ns->indx_txn, &key, &val,
@@ -141,7 +143,9 @@ index_rdn_key(struct namespace *ns, struct btval *dn, struct btval *key)
 		++parent_dn;
 	}
 
-	asprintf(&t, "@%.*s,%.*s", pdnsz, parent_dn, rdnsz, (char *)dn->data);
+	if (asprintf(&t, "@%.*s,%.*s", pdnsz, parent_dn, rdnsz,
+	    (char *)dn->data) == -1)
+		return -1;
 
 	normalize_dn(t);
 	key->data = t;
diff --git a/usr.sbin/ldapd/ldape.c b/usr.sbin/ldapd/ldape.c
index 58a698fcf14..48bc298db74 100644
--- a/usr.sbin/ldapd/ldape.c
+++ b/usr.sbin/ldapd/ldape.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ldape.c,v 1.19 2015/01/16 16:04:38 deraadt Exp $ */
+/*	$OpenBSD: ldape.c,v 1.20 2015/06/03 02:24:36 millert Exp $ */
 
 /*
  * Copyright (c) 2009, 2010 Martin Hedenfalk <martin@bzero.se>
@@ -143,11 +143,11 @@ ldap_refer(struct request *req, const char *basedn, struct search *search,
 	ber_set_header(ref_root, BER_CLASS_CONTEXT, LDAP_REQ_SEARCH);
 	SLIST_FOREACH(ref, refs, next) {
 		if (search != NULL)
-			asprintf(&url, "%s/%s??%s", ref->url, basedn,
+			rc = asprintf(&url, "%s/%s??%s", ref->url, basedn,
 			    scope_str);
 		else
-			asprintf(&url, "%s/%s", ref->url, basedn);
-		if (url == NULL) {
+			rc = asprintf(&url, "%s/%s", ref->url, basedn);
+		if (rc == -1) {
 			log_warn("asprintf");
 			goto fail;
 		}
diff --git a/usr.sbin/ldapd/search.c b/usr.sbin/ldapd/search.c
index 3afd62561c0..d2fa8bab8cf 100644
--- a/usr.sbin/ldapd/search.c
+++ b/usr.sbin/ldapd/search.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: search.c,v 1.14 2010/11/10 08:00:54 martinh Exp $ */
+/*	$OpenBSD: search.c,v 1.15 2015/06/03 02:24:36 millert Exp $ */
 
 /*
  * Copyright (c) 2009, 2010 Martin Hedenfalk <martin@bzero.se>
@@ -619,13 +619,18 @@ add_index(struct plan *plan, const char *fmt, ...)
 {
 	struct index		*indx;
 	va_list			 ap;
+	int			 rc;
 
 	if ((indx = calloc(1, sizeof(*indx))) == NULL)
 		return -1;
 
 	va_start(ap, fmt);
-	vasprintf(&indx->prefix, fmt, ap);
+	rc = vasprintf(&indx->prefix, fmt, ap);
 	va_end(ap);
+	if (rc == -1) {
+		free(indx);
+		return -1;
+	}
 
 	normalize_dn(indx->prefix);