From 585d9101b752e4ec525339e5c5addfddb519760d Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@gmail.com>
Date: Sun, 16 Nov 2014 23:06:03 +0100
Subject: [PATCH] Fixed memory leaks.

---
 libfreerdp/core/gateway/rpc.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/libfreerdp/core/gateway/rpc.c b/libfreerdp/core/gateway/rpc.c
index 0dbb4efd9..ad2b787e0 100644
--- a/libfreerdp/core/gateway/rpc.c
+++ b/libfreerdp/core/gateway/rpc.c
@@ -357,7 +357,7 @@ int rpc_in_write(rdpRpc* rpc, const BYTE* data, int length)
 
 int rpc_write(rdpRpc* rpc, BYTE* data, int length, UINT16 opnum)
 {
-	BYTE* buffer;
+	BYTE* buffer = NULL;
 	UINT32 offset;
 	rdpNtlm* ntlm;
 	UINT32 stub_data_pad;
@@ -365,7 +365,7 @@ int rpc_write(rdpRpc* rpc, BYTE* data, int length, UINT16 opnum)
 	SecBufferDesc Message;
 	RpcClientCall* clientCall;
 	SECURITY_STATUS encrypt_status;
-	rpcconn_request_hdr_t* request_pdu;
+	rpcconn_request_hdr_t* request_pdu = NULL;
 	ntlm = rpc->ntlm;
 
 	if (!ntlm || !ntlm->table)
@@ -437,7 +437,9 @@ int rpc_write(rdpRpc* rpc, BYTE* data, int length, UINT16 opnum)
 	Buffers[1].pvBuffer = calloc(1, Buffers[1].cbBuffer);
 
 	if (!Buffers[1].pvBuffer)
-		return -1;
+	{
+		goto out_free_pdu;
+	}
 
 	Message.cBuffers = 2;
 	Message.ulVersion = SECBUFFER_VERSION;
@@ -447,8 +449,7 @@ int rpc_write(rdpRpc* rpc, BYTE* data, int length, UINT16 opnum)
 	if (encrypt_status != SEC_E_OK)
 	{
 		WLog_ERR(TAG,  "EncryptMessage status: 0x%08X", encrypt_status);
-		free(request_pdu);
-		return -1;
+		goto out_free_pdu;
 	}
 
 	CopyMemory(&buffer[offset], Buffers[1].pvBuffer, Buffers[1].cbBuffer);
@@ -458,12 +459,19 @@ int rpc_write(rdpRpc* rpc, BYTE* data, int length, UINT16 opnum)
 	if (rpc_send_enqueue_pdu(rpc, buffer, request_pdu->frag_length) < 0)
 		length = -1;
 
+	free (buffer);
 	free(request_pdu);
 	return length;
+
 out_free_clientCall:
 	rpc_client_call_free(clientCall);
 out_free_pdu:
-	free(request_pdu);
+	if (buffer)
+		free (buffer);
+	if (Buffers[1].pvBuffer)
+		free (Buffers[1].pvBuffer);
+	if (request_pdu)
+		free(request_pdu);
 	return -1;
 }