Author: Lars Mueller <lmuelle at SuSE dot de>
Subject: Potential mem leak in Samba print_cups code
Bugzilla: #49999; bugzilla.Samba.org #2270

Index: source/printing/print_cups.c
===================================================================
--- source/printing/print_cups.c	(revision 4865)
+++ source/printing/print_cups.c	(working copy)
@@ -122,6 +122,8 @@
 	{
 		DEBUG(0,("Unable to get printer list - %s\n",
 			 ippErrorString(cupsLastError())));
+		ippDelete(request);
+		cupsLangFree(language);
 		httpClose(http);
 		return False;
 	}
@@ -166,7 +168,9 @@
 			break;
 
 		if (!pcap_cache_add(name, info)) {
+			ippDelete(request);
 			ippDelete(response);
+			cupsLangFree(language);
 			httpClose(http);
 			return False;
 		}
@@ -184,13 +188,9 @@
 	*    requested-attributes
 	*/
 
-	request = ippNew();
-
 	request->request.op.operation_id = CUPS_GET_CLASSES;
 	request->request.op.request_id   = 1;
 
-	language = cupsLangDefault();
-
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
                      "attributes-charset", NULL, cupsLangEncoding(language));
 
@@ -210,6 +210,8 @@
 	{
 		DEBUG(0,("Unable to get printer list - %s\n",
 			 ippErrorString(cupsLastError())));
+		ippDelete(request);
+		cupsLangFree(language);
 		httpClose(http);
 		return False;
 	}
@@ -254,18 +256,22 @@
 			break;
 
 		if (!pcap_cache_add(name, info)) {
+			ippDelete(request);
 			ippDelete(response);
+			cupsLangFree(language);
 			httpClose(http);
 			return False;
 		}
 	}
 
+	ippDelete(request);
 	ippDelete(response);
 
        /*
         * Close the connection to the server...
 	*/
 
+	cupsLangFree(language);
 	httpClose(http);
 	return True;
 }
@@ -355,6 +361,8 @@
 	  DEBUG(0,("Unable to cancel job %d - %s\n", pjob->sysjob,
 		   ippErrorString(cupsLastError())));
 
+	ippDelete(request);
+	cupsLangFree(language);
 	httpClose(http);
 
 	return (ret);
@@ -445,6 +453,8 @@
 	  DEBUG(0,("Unable to hold job %d - %s\n", pjob->sysjob,
 		   ippErrorString(cupsLastError())));
 
+	ippDelete(request);
+	cupsLangFree(language);
 	httpClose(http);
 
 	return (ret);
@@ -535,6 +545,8 @@
 	  DEBUG(0,("Unable to release job %d - %s\n", pjob->sysjob,
 		   ippErrorString(cupsLastError())));
 
+	ippDelete(request);
+	cupsLangFree(language);
 	httpClose(http);
 
 	return (ret);
@@ -659,6 +671,8 @@
 		DEBUG(0,("Unable to print file to `%s' - %s\n", PRINTERNAME(snum),
 			 ippErrorString(cupsLastError())));
 
+	ippDelete(request);
+	cupsLangFree(language);
 	httpClose(http);
 
 	if ( ret == 0 )
@@ -777,6 +791,8 @@
 	{
 		DEBUG(0,("Unable to get jobs for %s - %s\n", uri,
 			 ippErrorString(cupsLastError())));
+		ippDelete(request);
+		cupsLangFree(language);
 		httpClose(http);
 		return (0);
 	}
@@ -785,7 +801,9 @@
 	{
 		DEBUG(0,("Unable to get jobs for %s - %s\n", uri,
 			 ippErrorString(response->request.status.status_code)));
+		ippDelete(request);
 		ippDelete(response);
+		cupsLangFree(language);
 		httpClose(http);
 
 		return (0);
@@ -823,6 +841,7 @@
 			if (temp == NULL)
 			{
 				DEBUG(0,("cups_queue_get: Not enough memory!"));
+				ippDelete(request);
 				ippDelete(response);
 				httpClose(http);
 
@@ -928,13 +947,9 @@
 	*    printer-uri
 	*/
 
-	request = ippNew();
-
 	request->request.op.operation_id = IPP_GET_PRINTER_ATTRIBUTES;
 	request->request.op.request_id   = 1;
 
-	language = cupsLangDefault();
-
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
                      "attributes-charset", NULL, cupsLangEncoding(language));
 
@@ -957,6 +972,8 @@
 	{
 		DEBUG(0,("Unable to get printer status for %s - %s\n", printer_name,
 			 ippErrorString(cupsLastError())));
+		ippDelete(request);
+		cupsLangFree(language);
 		httpClose(http);
 		*q = queue;
 		return (qcount);
@@ -966,7 +983,9 @@
 	{
 		DEBUG(0,("Unable to get printer status for %s - %s\n", printer_name,
 			 ippErrorString(response->request.status.status_code)));
+		ippDelete(request);
 		ippDelete(response);
+		cupsLangFree(language);
 		httpClose(http);
 		*q = queue;
 		return (qcount);
@@ -988,12 +1007,14 @@
 	                             IPP_TAG_TEXT)) != NULL)
 	        fstrcpy(status->message, attr->values[0].string.text);
 
+	ippDelete(request);
         ippDelete(response);
 
        /*
         * Return the job queue...
 	*/
 
+	cupsLangFree(language);
 	httpClose(http);
 
 	*q = queue;
@@ -1087,6 +1108,8 @@
 	  DEBUG(0,("Unable to pause printer %s - %s\n", PRINTERNAME(snum),
 		   ippErrorString(cupsLastError())));
 
+	ippDelete(request);
+	cupsLangFree(language);
 	httpClose(http);
 
 	return (ret);
@@ -1179,6 +1202,8 @@
 	  DEBUG(0,("Unable to resume printer %s - %s\n", PRINTERNAME(snum),
 		   ippErrorString(cupsLastError())));
 
+	ippDelete(request);
+	cupsLangFree(language);
 	httpClose(http);
 
 	return (ret);