From 1ae1434feecf96823bbe8d40fb15513fc9372c5f Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Wed, 6 May 2026 17:23:39 +0200
Subject: [PATCH 10/27] CVE-2026-4480/CVE-2026-4408: s3:lib: fix potential
 memory leak in talloc_sub_basic()

This makes the code easier to understand...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---
 source3/lib/substitute.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c
index a941b89f82a..fb47b10875d 100644
--- a/source3/lib/substitute.c
+++ b/source3/lib/substitute.c
@@ -307,6 +307,7 @@ char *talloc_sub_basic(TALLOC_CTX *mem_ctx,
 	}
 
 	tmp_ctx = talloc_stackframe();
+	a_string = talloc_steal(tmp_ctx, a_string);
 
 	for (s = a_string; (p = strchr_m(s, '%')); s = a_string + (p - b)) {
 
@@ -468,6 +469,7 @@ error:
 	TALLOC_FREE(a_string);
 
 done:
+	a_string = talloc_steal(mem_ctx, a_string);
 	TALLOC_FREE(tmp_ctx);
 	return a_string;
 }
-- 
2.43.0


