Fix realloc() bugs

libraries/liblber/memory.c

@@ -674,22 +674,32 @@ ber_bvarray_add( BerVarray *a, BerValue *bv )
 			return 0;
 		}
 		n = 0;
+
 		*a = (BerValue *) LBER_MALLOC( 2 * sizeof(BerValue) );
+		if ( *a == NULL ) {
+			return -1;
+		}
+
 	} else {
+		BerVarray *atmp;
 		BER_MEM_VALID( a );
 
 		for ( n = 0; *a != NULL && (*a)[n].bv_val != NULL; n++ ) {
-			;	/* NULL */
+			;	/* just count them */
 		}
 
 		if (bv == NULL) {
 			return n;
 		}
-		*a = (BerValue *) LBER_REALLOC( (char *) *a,
+
+		*atmp = (BerValue *) LBER_REALLOC( (char *) *a,
 		    (n + 2) * sizeof(BerValue) );
-	}
-	if ( *a == NULL ) {
-		return -1;
+
+		if( *atmp == NULL ) {
+			return -1;
+		}
+
+		*a = *atmp;
 	}
 
 	(*a)[n++] = *bv;

libraries/libldap/dnssrv.c

@@ -121,46 +121,49 @@ int ldap_domain2dn(
 	LDAP_CONST char *domain_in,
 	char **dnp)
 {
-    char *domain, *s, *tok_r, *dn;
-    size_t loc;
+	char *domain, *s, *tok_r, *dn, *dntmp;
+	size_t loc;
 
 	assert( domain_in != NULL );
 	assert( dnp != NULL );
 
-    domain = LDAP_STRDUP(domain_in);
-    if (domain == NULL) {
+	domain = LDAP_STRDUP(domain_in);
+	if (domain == NULL) {
 		return LDAP_NO_MEMORY;
-    }
-    dn = NULL;
-    loc = 0;
-
-    for (s = ldap_pvt_strtok(domain, ".", &tok_r);
-	 s != NULL;
-	 s = ldap_pvt_strtok(NULL, ".", &tok_r)) {
-	size_t len = strlen(s);
-
-	dn = (char *) LDAP_REALLOC(dn, loc + sizeof(",dc=") + len );
-	if (dn == NULL) {
-	    LDAP_FREE(domain);
-	    return LDAP_NO_MEMORY;
-	}
-	if (loc > 0) {
-	    /* not first time. */
-	    strcpy(dn + loc, ",");
-	    loc++;
 	}
-	strcpy(dn + loc, "dc=");
-	loc += sizeof("dc=")-1;
+	dn = NULL;
+	loc = 0;
+
+	for (s = ldap_pvt_strtok(domain, ".", &tok_r);
+		s != NULL;
+		s = ldap_pvt_strtok(NULL, ".", &tok_r))
+	{
+		size_t len = strlen(s);
+
+		dntmp = (char *) LDAP_REALLOC(dn, loc + sizeof(",dc=") + len );
+		if (dn == NULL) {
+			LDAP_FREE(dn);
+		    LDAP_FREE(domain);
+		    return LDAP_NO_MEMORY;
+		}
 
-	strcpy(dn + loc, s);
-	loc += len;
-    }
+		dn = dntmp;
 
-    LDAP_FREE(domain);
+		if (loc > 0) {
+		    /* not first time. */
+		    strcpy(dn + loc, ",");
+		    loc++;
+		}
+		strcpy(dn + loc, "dc=");
+		loc += sizeof("dc=")-1;
 
-    *dnp = dn;
+		strcpy(dn + loc, s);
+		loc += len;
+    }
 
-    return LDAP_SUCCESS;
+	LDAP_FREE(domain);
+	*dnp = dn;
+	return LDAP_SUCCESS;
 }
 
 /*