There are *very* few places where assuming a tmpl is talloced is a go…

…od idea

There are clearly two variants of some tmpl functions, one takes a stack allocated tmpl, the other doesn't.

We don't malloc memory when we don't have to, and we don't have to for tmpls or cursors or maps.

src/main/map.c

@@ -65,7 +65,6 @@ static bool map_cast_from_hex(value_pair_map_t *map, FR_TOKEN rhs_type, char con
 	rad_assert(map->dst != NULL);
 	rad_assert(map->src == NULL);
 	rad_assert(rhs != NULL);
-	VERIFY_MAP(map);
 
 	/*
 	 *	If the attribute is still unknown, go parse the RHS.
@@ -375,7 +374,6 @@ value_pair_map_t *map_from_cp(TALLOC_CTX *ctx, CONF_PAIR *cp,
 		}
 	}
 
-	VERIFY_MAP(map);
 	return map;
 
 error:
@@ -464,7 +462,6 @@ int map_from_cs(CONF_SECTION *cs, value_pair_map_t **head,
 
 		ctx = *tail = map;
 		tail = &(map->next);
-		VERIFY_MAP(map);
 	}
 
 	return 0;
@@ -537,7 +534,6 @@ value_pair_map_t *map_from_fields_unknown(TALLOC_CTX *ctx, char const *lhs, FR_T
 		goto error;
 	}
 
-	VERIFY_MAP(map);
 	return map;
 }
 
@@ -595,7 +591,6 @@ value_pair_map_t *map_from_fields(TALLOC_CTX *ctx, char const *lhs, FR_TOKEN lhs
 	map->src = tmpl_afrom_str(map, rhs, rhs_type, src_request_def, src_list_def);
 	if (!map->src) goto error;
 
-	VERIFY_MAP(map);
 	return map;
 }
 
@@ -656,7 +651,6 @@ int map_from_vp_str(value_pair_map_t **out, REQUEST *request, char const *vp_str
 	}
 	*out = map;
 
-	VERIFY_MAP(map);
 	return 0;
 }
 
@@ -679,7 +673,6 @@ static int map_exec_to_vp(VALUE_PAIR **out, REQUEST *request, value_pair_map_t c
 	VALUE_PAIR *output_pairs = NULL;
 
 	*out = NULL;
-	VERIFY_MAP(map);
 
 	rad_assert(map->src->type == TMPL_TYPE_EXEC);
 	rad_assert((map->dst->type == TMPL_TYPE_ATTR) || (map->dst->type == TMPL_TYPE_LIST));
@@ -754,7 +747,6 @@ int map_to_vp(VALUE_PAIR **out, REQUEST *request, value_pair_map_t const *map, U
 	vp_cursor_t cursor;
 
 	*out = NULL;
-	VERIFY_MAP(map);
 
 	/*
 	 *	Special case for !*, we don't need to parse RHS as this is a unary operator.
@@ -1003,8 +995,6 @@ int map_to_request(REQUEST *request, value_pair_map_t const *map, radius_map_get
 	TALLOC_CTX *parent;
 	vp_cursor_t dst_list, src_list;
 
-	VERIFY_MAP(map);
-
 	/*
 	 *	Sanity check inputs.  We can have a list or attribute
 	 *	as a destination.
@@ -1355,8 +1345,6 @@ bool map_dst_valid(REQUEST *request, value_pair_map_t const *map)
 {
 	REQUEST *context = request;
 
-	VERIFY_MAP(map);
-
 	if (radius_request(&context, map->dst->tmpl_request) < 0) return false;
 	if (!radius_list(context, map->dst->tmpl_list)) return false;
 
@@ -1376,8 +1364,6 @@ size_t map_prints(char *buffer, size_t bufsize, value_pair_map_t const *map)
 	char *p = buffer;
 	char *end = buffer + bufsize;
 
-	VERIFY_MAP(map);
-
 	len = tmpl_prints(buffer, bufsize, map->dst);
 	p += len;
 
@@ -1424,8 +1410,6 @@ void map_debug_log(REQUEST *request, value_pair_map_t const *map, VALUE_PAIR con
 
 	rad_assert(vp || (map->src->type == TMPL_TYPE_NULL));
 
-	VERIFY_MAP(map);
-
 	switch (map->src->type) {
 	/*
 	 *	Just print the value being assigned

src/main/tmpl.c

@@ -438,11 +438,7 @@ int tmpl_from_attr_str(value_pair_tmpl_t *vpt, char const *name, request_refs_t
 	DICT_ATTR const *da;
 
 	memset(vpt, 0, sizeof(*vpt));
-#ifndef WITH_VERIFY_PTR
 	vpt->name = name;
-#else
-	vpt->name = talloc_typed_strdup(vpt, name);
-#endif
 	p = name;
 
 	if (*p == '&') {
@@ -536,8 +532,6 @@ int tmpl_from_attr_str(value_pair_tmpl_t *vpt, char const *name, request_refs_t
 		return -2;
 	}
 
-	VERIFY_TMPL(vpt);
-
 	return 0;
 }
 
@@ -569,8 +563,6 @@ value_pair_tmpl_t *tmpl_afrom_attr_str(TALLOC_CTX *ctx, char const *name, reques
 		return NULL;
 	}
 
-	VERIFY_TMPL(vpt);
-
 	return vpt;
 }
 
@@ -611,8 +603,6 @@ size_t tmpl_prints(char *buffer, size_t bufsize, value_pair_tmpl_t const *vpt)
 		return 0;
 	}
 
-	VERIFY_TMPL(vpt);
-
 	switch (vpt->type) {
 	default:
 		return 0;
@@ -858,8 +848,6 @@ bool tmpl_cast_in_place(value_pair_tmpl_t *vpt, DICT_ATTR const *da)
 	rad_assert(da != NULL);
 	rad_assert(vpt->type == TMPL_TYPE_LITERAL);
 
-	VERIFY_TMPL(vpt);
-
 	vp = pairalloc(vpt, da);
 	if (!vp) return false;
 
@@ -903,7 +891,6 @@ int tmpl_cast_to_vp(VALUE_PAIR **out, REQUEST *request,
 
 	if (vpt->type == TMPL_TYPE_DATA) {
 		VERIFY_VP(vp);
-		VERIFY_TMPL(vpt);
 		rad_assert(vp->da->type == vpt->tmpl_da->type);
 		pairdatacpy(vp, vpt->tmpl_da, vpt->tmpl_value, vpt->tmpl_length);
 		*out = vp;
@@ -949,8 +936,6 @@ VALUE_PAIR *tmpl_cursor_init(int *err, vp_cursor_t *cursor, REQUEST *request, va
 
 	if (err) *err = 0;
 
-	VERIFY_TMPL(vpt);
-
 	if (radius_request(&request, vpt->tmpl_request) < 0) {
 		if (err) *err = -3;
 		return NULL;
@@ -1015,8 +1000,6 @@ VALUE_PAIR *tmpl_cursor_next(vp_cursor_t *cursor, value_pair_tmpl_t const *vpt)
 {
 	rad_assert((vpt->type == TMPL_TYPE_ATTR) || (vpt->type == TMPL_TYPE_LIST));
 
-	VERIFY_TMPL(vpt);
-
 	switch (vpt->type) {
 	/*
 	 *	May not may not be found, but it *is* a known name.
@@ -1051,8 +1034,6 @@ int tmpl_copy_vps(TALLOC_CTX *ctx, VALUE_PAIR **out, REQUEST *request, value_pai
 
 	rad_assert((vpt->type == TMPL_TYPE_ATTR) || (vpt->type == TMPL_TYPE_LIST));
 
-	VERIFY_TMPL(vpt);
-
 	*out = NULL;
 
 	fr_cursor_init(&to, out);

src/main/valuepair.c

@@ -729,25 +729,16 @@ void rdebug_pair_list(int level, REQUEST *request, VALUE_PAIR *vp)
 int radius_get_vp(VALUE_PAIR **out, REQUEST *request, char const *name)
 {
 	int rcode;
-	value_pair_tmpl_t *vpt;
-#ifndef WITH_VERIFY_PTR
-	value_pair_tmpl_t my_vpt;
-
-	vpt = &my_vpt;
-#else
-	vpt = talloc_zero(request, value_pair_tmpl_t);
-#endif
+	value_pair_tmpl_t vpt;
 
 	*out = NULL;
 
-	if (tmpl_from_attr_str(vpt, name, REQUEST_CURRENT, PAIR_LIST_REQUEST) < 0) {
+	if (tmpl_from_attr_str(&vpt, name, REQUEST_CURRENT, PAIR_LIST_REQUEST) < 0) {
 		return -4;
 	}
 
-	rcode = tmpl_find_vp(out, request, vpt);
-#ifdef WITH_VERIFY_PTR
-	talloc_free(vpt);
-#endif
+	rcode = tmpl_find_vp(out, request, &vpt);
+
 	return rcode;
 }