Attachment #26942 for bug #64119

View | Details | Raw Unified | Return to bug 64119
Collapse All | Expand All

Lines 58-64 Link Here

(-)samba-3.0.9-orig/examples/VFS/shadow_copy_test.c (-1 / +1 lines)
58	shadow_copy_data->num_volumes = num;	58	shadow_copy_data->num_volumes = num;
59		59
60	if (labels) {	60	if (labels) {
61	shadow_copy_data->labels = (SHADOW_COPY_LABEL )talloc_zero(shadow_copy_data->mem_ctx,(num)sizeof(SHADOW_COPY_LABEL));	61	shadow_copy_data->labels = TALLOC_ZERO_ARRAY(shadow_copy_data->mem_ctx,SHADOW_COPY_LABEL,num);
62	for (i=0;i<num;i++) {	62	for (i=0;i<num;i++) {
63	snprintf(shadow_copy_data->labels[i], sizeof(SHADOW_COPY_LABEL), "@GMT-2003.08.05-12.%02u.00",i);	63	snprintf(shadow_copy_data->labels[i], sizeof(SHADOW_COPY_LABEL), "@GMT-2003.08.05-12.%02u.00",i);
64	}	64	}

Lines 49-55 Link Here

(-)samba-3.0.9-orig/source/auth/auth.c (-2 / +2 lines)
49	return NT_STATUS_OBJECT_NAME_COLLISION;	49	return NT_STATUS_OBJECT_NAME_COLLISION;
50	}	50	}
51		51
52	entry = smb_xmalloc(sizeof(struct auth_init_function_entry));	52	entry = SMB_XMALLOC_P(struct auth_init_function_entry);
53	entry->name = smb_xstrdup(name);	53	entry->name = smb_xstrdup(name);
54	entry->init = init;	54	entry->init = init;
55		55
Lines 347-353 Link Here
347		347
348	mem_ctx = talloc_init("authentication context");	348	mem_ctx = talloc_init("authentication context");
349		349
350	auth_context = talloc(mem_ctx, sizeof(*auth_context));	350	*auth_context = TALLOC_P(mem_ctx, struct auth_context);
351	if (!*auth_context) {	351	if (!*auth_context) {
352	DEBUG(0,("make_auth_context: talloc failed!\n"));	352	DEBUG(0,("make_auth_context: talloc failed!\n"));
353	talloc_destroy(mem_ctx);	353	talloc_destroy(mem_ctx);

Lines 135-141 Link Here

(-)samba-3.0.9-orig/source/auth/auth_ntlmssp.c (-1 / +1 lines)
135		135
136	mem_ctx = talloc_init("AUTH NTLMSSP context");	136	mem_ctx = talloc_init("AUTH NTLMSSP context");
137		137
138	auth_ntlmssp_state = talloc_zero(mem_ctx, sizeof(*auth_ntlmssp_state));	138	*auth_ntlmssp_state = TALLOC_ZERO_P(mem_ctx, AUTH_NTLMSSP_STATE);
139	if (!*auth_ntlmssp_state) {	139	if (!*auth_ntlmssp_state) {
140	DEBUG(0,("auth_ntlmssp_start: talloc failed!\n"));	140	DEBUG(0,("auth_ntlmssp_start: talloc failed!\n"));
141	talloc_destroy(mem_ctx);	141	talloc_destroy(mem_ctx);





	DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));

	*user_info = SMB_MALLOC_P(auth_usersupplied_info);
	if (!user_info) {
		DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info)));
		return NT_STATUS_NO_MEMORY;


	DEBUG(5,("making strings for %s's user_info struct\n", internal_username));

	(*user_info)->smb_name.str = SMB_STRDUP(smb_name);
	if ((*user_info)->smb_name.str) { 
		(*user_info)->smb_name.len = strlen(smb_name);
	} else {

		return NT_STATUS_NO_MEMORY;
	}
	
	(*user_info)->internal_username.str = SMB_STRDUP(internal_username);
	if ((*user_info)->internal_username.str) { 
		(*user_info)->internal_username.len = strlen(internal_username);
	} else {

		return NT_STATUS_NO_MEMORY;
	}

	(*user_info)->domain.str = SMB_STRDUP(domain);
	if ((*user_info)->domain.str) { 
		(*user_info)->domain.len = strlen(domain);
	} else {

		return NT_STATUS_NO_MEMORY;
	}

	(*user_info)->client_domain.str = SMB_STRDUP(client_domain);
	if ((*user_info)->client_domain.str) { 
		(*user_info)->client_domain.len = strlen(client_domain);
	} else {

		return NT_STATUS_NO_MEMORY;
	}

	(*user_info)->wksta_name.str = SMB_STRDUP(wksta_name);
	if ((*user_info)->wksta_name.str) { 
		(*user_info)->wksta_name.len = strlen(wksta_name);
	} else {

	int i;
	int sid_ndx;
	
	if ((ptoken = SMB_MALLOC_P(NT_USER_TOKEN)) == NULL) {
		DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
		nt_status = NT_STATUS_NO_MEMORY;
		return nt_status;


	ptoken->num_sids = n_groupSIDs + 5;

	if ((ptoken->user_sids = SMB_MALLOC_ARRAY( DOM_SID, ptoken->num_sids )) == NULL) {
		DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
		nt_status = NT_STATUS_NO_MEMORY;
		return nt_status;

		return NULL;
	}

	group_sids = SMB_MALLOC_ARRAY(DOM_SID, ngroups);
	if (!group_sids) {
		DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
		return NULL;

		
		n_unix_groups = groups_max();
		
		if ((*unix_groups = SMB_MALLOC_ARRAY( gid_t, n_unix_groups ) ) == NULL) {
			DEBUG(0, ("get_user_groups: Out of memory allocating unix group list\n"));
			return NT_STATUS_NO_MEMORY;
		}

		
			gid_t *groups_tmp;
			
			groups_tmp = SMB_REALLOC_ARRAY(*unix_groups, gid_t, n_unix_groups);
			
			if (!groups_tmp) {
				SAFE_FREE(*unix_groups);

	
	if (n_unix_groups > 0) {
	
		*groups   = SMB_MALLOC_ARRAY(DOM_SID, n_unix_groups);
		
		if (!*groups) {
			DEBUG(0, ("get_user_group: malloc() failed for DOM_SID list!\n"));


static NTSTATUS make_server_info(auth_serversupplied_info **server_info)
{
	*server_info = SMB_MALLOC_P(auth_serversupplied_info);
	if (!*server_info) {
		DEBUG(0,("make_server_info: malloc failed!\n"));
		return NT_STATUS_NO_MEMORY;

	
	/* Create a 'combined' list of all SIDs we might want in the SD */
	
	all_group_SIDs = SMB_MALLOC_ARRAY(DOM_SID,info3->num_groups2 + info3->num_other_sids + n_lgroupSIDs);
	
	if (!all_group_SIDs) {
		DEBUG(0, ("malloc() failed for DOM_SID list!\n"));

		smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
	}

	*auth_method = TALLOC_P(auth_context->mem_ctx, auth_methods);
	if (!*auth_method) {
		DEBUG(0,("make_auth_method: malloc failed!\n"));
		return False;

	if (!ptoken)
		return NULL;

    if ((token = SMB_MALLOC_P(NT_USER_TOKEN)) == NULL)
        return NULL;

    ZERO_STRUCTP(token);




{
	reset_do_list_queue();
	do_list_queue_size = 1024;
	do_list_queue = SMB_MALLOC(do_list_queue_size);
	if (do_list_queue == 0) { 
		d_printf("malloc fail for size %d\n",
			 (int)do_list_queue_size);

		do_list_queue_size *= 2;
		DEBUG(4,("enlarging do_list_queue to %d\n",
			 (int)do_list_queue_size));
		dlq = SMB_REALLOC(do_list_queue, do_list_queue_size);
		if (! dlq) {
			d_printf("failure enlarging do_list_queue to %d bytes\n",
				 (int)do_list_queue_size);

	DEBUG(1,("getting file %s of size %.0f as %s ", 
		 rname, (double)size, lname));

	if(!(data = (char *)SMB_MALLOC(read_size))) { 
		d_printf("malloc fail for size %d\n", read_size);
		cli_close(cli, fnum);
		return 1;

	DEBUG(1,("putting file %s as %s ",lname,
		 rname));
  
	buf = (char *)SMB_MALLOC(maxwrite);
	if (!buf) {
		d_printf("ERROR: Not enough memory!\n");
		return 1;

					return -1;
				}
			}
			entry = SMB_MALLOC_P(struct file_list);
			if (!entry) {
				d_printf("Out of memory in file_find\n");
				closedir(dir);


	if ((info->count < MAX_COMPLETIONS - 1) && (strncmp(info->text, f->name, info->len) == 0) && (strcmp(f->name, ".") != 0) && (strcmp(f->name, "..") != 0)) {
		if ((info->dirmask[0] == 0) && !(f->mode & aDIR))
			info->matches[info->count] = SMB_STRDUP(f->name);
		else {
			pstring tmp;


			pstrcat(tmp, f->name);
			if (f->mode & aDIR)
				pstrcat(tmp, "/");
			info->matches[info->count] = SMB_STRDUP(tmp);
		}
		if (info->matches[info->count] == NULL)
			return;

	if (len >= PATH_MAX)
		return(NULL);

	info.matches = SMB_MALLOC_ARRAY(char *,MAX_COMPLETIONS);
	if (!info.matches) return NULL;
	info.matches[0] = NULL;


		goto cleanup;

	if (info.count == 2)
		info.matches[0] = SMB_STRDUP(info.matches[1]);
	else {
		info.matches[0] = SMB_MALLOC(info.samelen+1);
		if (!info.matches[0])
			goto cleanup;
		strncpy(info.matches[0], info.matches[1], info.samelen);

		char **matches;
		int i, len, samelen, count=1;

		matches = SMB_MALLOC_ARRAY(char *, MAX_COMPLETIONS);
		if (!matches) return NULL;
		matches[0] = NULL;

		len = strlen(text);
		for (i=0;commands[i].fn && count < MAX_COMPLETIONS-1;i++) {
			if (strncmp(text, commands[i].name, len) == 0) {
				matches[count] = SMB_STRDUP(commands[i].name);
				if (!matches[count])
					goto cleanup;
				if (count == 1)

		case 1:
			goto cleanup;
		case 2:
			matches[0] = SMB_STRDUP(matches[1]);
			break;
		default:
			matches[0] = SMB_MALLOC(samelen+1);
			if (!matches[0])
				goto cleanup;
			strncpy(matches[0], matches[1], samelen);




{
	char *tmp;

	tmp = (char *)SMB_MALLOC(size+1);

	if (tmp == NULL) {
		DEBUG(0, ("Out of memory in string_create_s\n"));

	if (l+2 >= NAMSIZ) {
		/* write a GNU tar style long header */
		char *b;
		b = (char *)SMB_MALLOC(l+TBLOCK+100);
		if (!b) {
			DEBUG(0,("out of memory\n"));
			exit(1);

{
	/* initialize tar buffer */
	tbufsiz=blocksize*TBLOCK;
	tarbuf=SMB_MALLOC(tbufsiz);      /* FIXME: We might not get the buffer */

	/* reset tar buffer pointer and tar file counter and total dumped */
	tp=0; ntarf=0; ttarf=0;

	/* finfo.size here is the length of the filename as written by the "/./@LongLink" name
	 * header call. */
	int namesize = finfo.size + strlen(cur_dir) + 2;
	char *longname = SMB_MALLOC(namesize);
	int offset = 0, left = finfo.size;
	BOOL first = True;


	while ((! error) && (x_fgets(buf, sizeof(buf)-1, inclusion))) {
		if (inclusion_buffer == NULL) {
			inclusion_buffer_size = 1024;
			if ((inclusion_buffer = SMB_MALLOC(inclusion_buffer_size)) == NULL) {
				DEBUG(0,("failure allocating buffer to read inclusion file\n"));
				error = 1;
				break;

		if ((strlen(buf) + 1 + inclusion_buffer_sofar) >= inclusion_buffer_size) {
			char *ib;
			inclusion_buffer_size *= 2;
			ib = SMB_REALLOC(inclusion_buffer,inclusion_buffer_size);
			if (! ib) {
				DEBUG(0,("failure enlarging inclusion buffer to %d bytes\n",
						inclusion_buffer_size));


	if (! error) {
		/* Allocate an array of clipn + 1 char*'s for cliplist */
		cliplist = SMB_MALLOC_ARRAY(char *, clipn + 1);
		if (cliplist == NULL) {
			DEBUG(0,("failure allocating memory for cliplist\n"));
			error = 1;

				/* set current item to NULL so array will be null-terminated even if
						* malloc fails below. */
				cliplist[i] = NULL;
				if ((tmpstr = (char *)SMB_MALLOC(strlen(p)+1)) == NULL) {
					DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", i));
					error = 1;
				} else {

		clipn=argc-Optind-1;
		clipcount = clipn;

		if ((tmplist=SMB_MALLOC_ARRAY(char *,clipn)) == NULL) {
			DEBUG(0, ("Could not allocate space to process cliplist, count = %i\n", clipn));
			return 0;
		}


			DEBUG(5, ("Processing an item, %s\n", cliplist[clipcount]));

			if ((tmpstr = (char *)SMB_MALLOC(strlen(cliplist[clipcount])+1)) == NULL) {
				DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", clipcount));
				return 0;
			}

#ifdef HAVE_REGEX_H
		int errcode;

		if ((preg = (regex_t *)SMB_MALLOC(65536)) == NULL) {

			DEBUG(0, ("Could not allocate buffer for regular expression search\n"));
			return;




		decode_sid_name_use(group_type, map.sid_name_use);
		DEBUG(11,("enum_group_mapping: returning group %s of type %s\n", map.nt_name ,group_type));

		mapt= SMB_REALLOC_ARRAY((*rmap), GROUP_MAP, entries+1);
		if (!mapt) {
			DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
			SAFE_FREE(*rmap);

		asprintf(&new_memberstring, "%s %s", (char *)(dbuf.dptr),
			 string_sid);
	} else {
		new_memberstring = SMB_STRDUP(string_sid);
	}

	if (new_memberstring == NULL)

		return tdb_delete(tdb, kbuf) == 0 ?
			NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;

	member_string = SMB_STRDUP("");

	if (member_string == NULL) {
		SAFE_FREE(sids);

	if (*num_aliases > max_entries)
		*num_aliases = max_entries;

	*info = SMB_MALLOC_ARRAY(struct acct_info, *num_aliases);

	for (i=0; i<*num_aliases; i++) {
		fstrcpy((*info)[i].acct_name, map[i+start_idx].nt_name);




#define _BOOL       /* So we don't typedef BOOL again in vfs.h */
#endif

/* limiting size of ipc replies */
#define REALLOC(ptr,size) Realloc(ptr,MAX((size),4*1024))

#define SIZEOFWORD 2

#ifndef DEF_CREATE_MASK

#define SAFE_NETBIOS_CHARS ". -_"

/* generic iconv conversion structure */
typedef struct _smb_iconv_t {
	size_t (*direct)(void *cd, const char **inbuf, size_t *inbytesleft,
			 char **outbuf, size_t *outbytesleft);
	size_t (*pull)(void *cd, const char **inbuf, size_t *inbytesleft,





#define IS_DC  (lp_server_role()==ROLE_DOMAIN_PDC || lp_server_role()==ROLE_DOMAIN_BDC) 

/*****************************************************************************
 Safe allocation macros.
*****************************************************************************/

#define SMB_MALLOC_ARRAY(type,count) (type *)malloc_array(sizeof(type),(count))
#define SMB_REALLOC(p,s) Realloc((p),(s))
#define SMB_REALLOC_ARRAY(p,type,count) (type *)realloc_array((p),sizeof(type),(count))
#define SMB_CALLOC_ARRAY(type,count) (type *)calloc_array(sizeof(type),(count))
#define SMB_XMALLOC_P(type) (type *)smb_xmalloc_array(sizeof(type),1)
#define SMB_XMALLOC_ARRAY(type,count) (type *)smb_xmalloc_array(sizeof(type),(count))

/* limiting size of ipc replies */
#define SMB_REALLOC_LIMIT(ptr,size) SMB_REALLOC(ptr,MAX((size),4*1024))

/* #define PARANOID_MALLOC_CHECKER 1 */

#if defined(PARANOID_MALLOC_CHECKER)

#define TALLOC(ctx, size) talloc_((ctx),(size))
#define TALLOC_P(ctx, type) (type *)talloc_((ctx),sizeof(type))
#define TALLOC_ARRAY(ctx, type, count) (type *)talloc_array_((ctx),sizeof(type),(count))
#define TALLOC_MEMDUP(ctx, ptr, size) talloc_memdup_((ctx),(ptr),(size))
#define TALLOC_ZERO(ctx, size) talloc_zero_((ctx),(size))
#define TALLOC_ZERO_P(ctx, type) (type *)talloc_zero_((ctx),sizeof(type))
#define TALLOC_ZERO_ARRAY(ctx, type, count) (type *)talloc_zero_array_((ctx),sizeof(type),(count))
#define TALLOC_REALLOC(ctx, ptr, count) talloc_realloc_((ctx),(ptr),(count))
#define TALLOC_REALLOC_ARRAY(ctx, ptr, type, count) (type *)talloc_realloc_array_((ctx),(ptr),sizeof(type),(count))

#define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem_((ps),sizeof(type),(count))

/* Get medieval on our ass about malloc.... */

/* Restrictions on malloc/realloc/calloc. */
#ifdef malloc
#undef malloc
#endif
#define malloc(s) __ERROR_DONT_USE_MALLOC_DIRECTLY

#ifdef realloc
#undef realloc
#endif
#define realloc(p,s) __ERROR_DONT_USE_REALLOC_DIRECTLY

#ifdef calloc
#undef calloc
#endif
#define calloc(n,s) __ERROR_DONT_USE_CALLOC_DIRECTLY

#ifdef strndup
#undef strndup
#endif
#define strndup(s,n) __ERROR_DONT_USE_STRNDUP_DIRECTLY

#ifdef strdup
#undef strdup
#endif
#define strdup(s) __ERROR_DONT_USE_STRDUP_DIRECTLY

#define SMB_MALLOC(s) malloc_(s)
#define SMB_MALLOC_P(type) (type *)malloc_(sizeof(type))

#define SMB_STRDUP(s) smb_xstrdup(s)
#define SMB_STRNDUP(s,n) smb_xstrndup(s,n)

#else

#define TALLOC(ctx, size) talloc((ctx),(size))
#define TALLOC_P(ctx, type) (type *)talloc((ctx),sizeof(type))
#define TALLOC_ARRAY(ctx, type, count) (type *)talloc_array((ctx),sizeof(type),(count))
#define TALLOC_MEMDUP(ctx, ptr, size) talloc_memdup((ctx),(ptr),(size))
#define TALLOC_ZERO(ctx, size) talloc_zero((ctx),(size))
#define TALLOC_ZERO_P(ctx, type) (type *)talloc_zero((ctx),sizeof(type))
#define TALLOC_ZERO_ARRAY(ctx, type, count) (type *)talloc_zero_array((ctx),sizeof(type),(count))
#define TALLOC_REALLOC(ctx, ptr, count) talloc_realloc((ctx),(ptr),(count))
#define TALLOC_REALLOC_ARRAY(ctx, ptr, type, count) (type *)talloc_realloc_array((ctx),(ptr),sizeof(type),(count))

#define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem((ps),sizeof(type),(count))

/* Regular malloc code. */

#define SMB_MALLOC(s) malloc(s)
#define SMB_MALLOC_P(type) (type *)malloc(sizeof(type))

#define SMB_STRDUP(s) strdup(s)
#define SMB_STRNDUP(s,n) strndup(s,n)

#endif

#endif /* _SMB_MACROS_H */




				   strerror(errno)));
			goto done;
		}
		current_lang = SMB_STRDUP(lang);
		result = True;
		goto done;
	}

		tdb_store_int32(tdb, "/LOADTIME/", (int)time(NULL));
	}

	current_lang = SMB_STRDUP(lang);
	result = True;

 done:

			count++;
	}

	if (!(msgid_quoted = SMB_MALLOC(strlen(msgid) + count + 1)))
		return msgid;

	/* string_sub() is unsuitable here as it replaces some punctuation

	/* if the message isn't found then we still need to return a pointer
	   that can be freed. Pity. */
	if (!data.dptr)
		return SMB_STRDUP(msgid);

	return (const char *)data.dptr;
}

Lines 86-92 Link Here

(-)samba-3.0.9-orig/source/lib/access.c (-1 / +1 lines)
86	DEBUG(0,("Unable to get default yp domain.\n"));	86	DEBUG(0,("Unable to get default yp domain.\n"));
87	return False;	87	return False;
88	}	88	}
89	if (!(hostname = strdup(s))) {	89	if (!(hostname = SMB_STRDUP(s))) {
90	DEBUG(1,("out of memory for strdup!\n"));	90	DEBUG(1,("out of memory for strdup!\n"));
91	return False;	91	return False;
92	}	92	}

Lines 88-94 Link Here

(-)samba-3.0.9-orig/source/lib/account_pol.c (-1 / +1 lines)
88	len += strlen(account_policy_names[i].string) + 1;	88	len += strlen(account_policy_names[i].string) + 1;
89	}	89	}
90	len++;	90	len++;
91	nl = malloc(len);	91	nl = SMB_MALLOC(len);
92	if (!nl) {	92	if (!nl) {
93	return NULL;	93	return NULL;
94	}	94	}




{
	SORTED_TREE *tree = NULL;
	
	if ( !(tree = SMB_MALLOC_P(SORTED_TREE)) )
		return NULL;
		
	ZERO_STRUCTP( tree );

	tree->compare = cmp_fn;
	tree->free_func    = free_fn;
	
	if ( !(tree->root = SMB_MALLOC_P(TREE_NODE)) ) {
		SAFE_FREE( tree );
		return NULL;
	}

	TREE_NODE **siblings;
	int i;
	
	if ( !(infant = SMB_MALLOC_P(TREE_NODE)) )
		return NULL;
	
	ZERO_STRUCTP( infant );
		
	infant->key = SMB_STRDUP( key );
	infant->parent = node;
	
	siblings = SMB_REALLOC_ARRAY( node->children, TREE_NODE *, node->num_children+1 );
	
	if ( siblings )
		node->children = siblings;

	/* move past the first '/' */
	
	path++;	
	path2 = SMB_STRDUP( path );
	if ( !path2 ) {
		DEBUG(0,("sorted_tree_add: strdup() failed on string [%s]!?!?!\n", path));
		return False;

	/* make a copy to play with */
	
	if ( *key == '/' )
		keystr = SMB_STRDUP( key+1 );
	else
		keystr = SMB_STRDUP( key );
	
	if ( !keystr ) {
		DEBUG(0,("sorted_tree_find: strdup() failed on string [%s]!?!?!\n", key));




{
	struct bitmap *bm;

	bm = SMB_MALLOC_P(struct bitmap);

	if (!bm) return NULL;
	
	bm->n = n;
	bm->b = SMB_MALLOC_ARRAY(uint32, (n+31)/32);
	if (!bm->b) {
		SAFE_FREE(bm);
		return NULL;


	if (!mem_ctx) return NULL;

	bm = TALLOC_P(mem_ctx, struct bitmap);

	if (!bm) return NULL;
	
	bm->n = n;
	bm->b = TALLOC_ARRAY(mem_ctx, uint32, (n+31)/32);
	if (!bm->b) {
		return NULL;
	}




	}

	if (ctx)
		ob = (char *)TALLOC_REALLOC(ctx, ob, destlen);
	else
		ob = (char *)SMB_REALLOC(ob, destlen);

	if (!ob) {
		DEBUG(0, ("convert_string_allocate: realloc failed!\n"));


	destlen = destlen - o_len;
	if (ctx)
		*dest = (char *)TALLOC_REALLOC(ctx,ob,destlen);
	else
		*dest = (char *)SMB_REALLOC(ob,destlen);
	if (destlen && !*dest) {
		DEBUG(0, ("convert_string_allocate: out of memory!\n"));
		if (!ctx)

		}
	}

	return SMB_STRDUP(out_buffer);
}

size_t unix_strlower(const char *src, size_t srclen, char *dest, size_t destlen)




	if (p) {
		ret.data = smb_xmemdup(p, length);
	} else {
		ret.data = SMB_XMALLOC_ARRAY(char, length);
	}
	ret.length = length;
	ret.free = free_data_blob;

	}

	if (p) {
		ret.data = TALLOC_MEMDUP(mem_ctx, p, length);
		if (ret.data == NULL)
			smb_panic("data_blob_talloc: talloc_memdup failed.\n");
	} else {
		ret.data = TALLOC(mem_ctx, length);
		if (ret.data == NULL)
			smb_panic("data_blob_talloc: talloc failed.\n");
	}




	if (DEBUGLEVEL_CLASS == &debug_all_class_hack)
		return NULL;

	list = SMB_CALLOC_ARRAY(char *, debug_num_classes + 1);
	if (!list)
		return NULL;


	}

	/* create single string list - add space for newline */
	b = buf = SMB_MALLOC(dim+1);
	if (!buf) {
		err = True;
		goto done;

		/* Initial loading... */
		new_ptr = NULL;
	}
	new_ptr = SMB_REALLOC_ARRAY(new_ptr, int, debug_num_classes + 1);
	if (!new_ptr)
		return -1;
	DEBUGLEVEL_CLASS = new_ptr;

	if (new_ptr == &debug_all_class_isset_hack) {
		new_ptr = NULL;
	}
	new_ptr = SMB_REALLOC_ARRAY(new_ptr, BOOL, debug_num_classes + 1);
	if (!new_ptr)
		return -1;
	DEBUGLEVEL_CLASS_ISSET = new_ptr;
	DEBUGLEVEL_CLASS_ISSET[ndx] = False;

	new_ptr = SMB_REALLOC_ARRAY(classname_table, char *, debug_num_classes + 1);
			  sizeof(char *) * (debug_num_classes + 1));
	if (!new_ptr)
		return -1;
	classname_table = new_ptr;

	classname_table[ndx] = SMB_STRDUP(classname);
	if (! classname_table[ndx])
		return -1;
	

Lines 54-60 Link Here

(-)samba-3.0.9-orig/source/lib/dprintf.c (-1 / +1 lines)
54	charset, but beware of it growing */	54	charset, but beware of it growing */
55	maxlen = ret*2;	55	maxlen = ret*2;
56	again:	56	again:
57	p2 = malloc(maxlen);	57	p2 = SMB_MALLOC(maxlen);
58	if (!p2) {	58	if (!p2) {
59	SAFE_FREE(p);	59	SAFE_FREE(p);
60	return -1;	60	return -1;




	if (!valstr)
		return False;

	keybuf.dptr = SMB_STRDUP(keystr);
	keybuf.dsize = strlen(keystr)+1;
	databuf.dptr = SMB_STRDUP(valstr);
	databuf.dsize = strlen(valstr)+1;
	DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
	           " %s (%d seconds %s)\n", keybuf.dptr, value,ctime(&timeout),

	           = %s\n", keystr, old_valstr, ctime(&old_timeout)));

	asprintf(&datastr, CACHE_DATA_FMT, (int)timeout, valstr);
	keybuf.dptr = SMB_STRDUP(keystr);
	keybuf.dsize = strlen(keystr)+1;
	databuf.dptr = SMB_STRDUP(datastr);
	databuf.dsize = strlen(datastr)+1;
	DEBUGADD(10, ("New value = %s, new timeout = %s (%d seconds %s)", valstr,
	              ctime(&timeout), (int)(timeout - time(NULL)),


	if (!gencache_init()) return False;	
	
	keybuf.dptr = SMB_STRDUP(keystr);
	keybuf.dsize = strlen(keystr)+1;
	DEBUG(10, ("Deleting cache entry (key = %s)\n", keystr));
	ret = tdb_delete(cache, keybuf);

	if (!gencache_init())
		return False;
	
	keybuf.dptr = SMB_STRDUP(keystr);
	keybuf.dsize = strlen(keystr)+1;
	databuf = tdb_fetch(cache, keybuf);
	SAFE_FREE(keybuf.dptr);
	
	if (databuf.dptr && databuf.dsize > TIMEOUT_LEN) {
		char* entry_buf = SMB_STRNDUP(databuf.dptr, databuf.dsize);
		char *v;
		time_t t;

		v = SMB_MALLOC(databuf.dsize - TIMEOUT_LEN);
				  (databuf.dsize - TIMEOUT_LEN));
				
		SAFE_FREE(databuf.dptr);
		sscanf(entry_buf, CACHE_DATA_FMT, (int*)&t, v);

	
	while (node) {
		/* ensure null termination of the key string */
		keystr = SMB_STRNDUP(node->node_key.dptr, node->node_key.dsize);
		
		/* 
		 * We don't use gencache_get function, because we need to iterate through

			node = node->next;
			continue;
		}
		entry = SMB_STRNDUP(databuf.dptr, databuf.dsize);
		SAFE_FREE(databuf.dptr);
		valstr = SMB_MALLOC(databuf.dsize - TIMEOUT_LEN);
		sscanf(entry, CACHE_DATA_FMT, (int*)(&timeout), valstr);
		
		DEBUG(10, ("Calling function with arguments (key = %s, value = %s, timeout = %s)\n",




	from = charsets;
	to = charsets;

	ret = SMB_MALLOC_P(struct _smb_iconv_t);
	if (!ret) {
		errno = ENOMEM;
		return (smb_iconv_t)-1;
	}
	memset(ret, 0, sizeof(struct _smb_iconv_t));

	ret->from_name = SMB_STRDUP(fromcode);
	ret->to_name = SMB_STRDUP(tocode);

	/* check for the simplest null conversion */
	if (strcasecmp(fromcode, tocode) == 0) {

Lines 65-71 Link Here

(-)samba-3.0.9-orig/source/lib/interface.c (-2 / +2 lines)
65	return;	65	return;
66	}	66	}
67		67
68	iface = (struct interface )malloc(sizeof(iface));	68	iface = SMB_MALLOC_P(struct interface);
69	if (!iface) return;	69	if (!iface) return;
70		70
71	ZERO_STRUCTPN(iface);	71	ZERO_STRUCTPN(iface);
Lines 207-213 Link Here
207		207
208	if (ptr) {	208	if (ptr) {
209	while (*ptr) {	209	while (*ptr) {
210	char ptr_cpy = strdup(ptr);	210	char ptr_cpy = SMB_STRDUP(ptr);
211	if (ptr_cpy) {	211	if (ptr_cpy) {
212	interpret_interface(ptr_cpy);	212	interpret_interface(ptr_cpy);
213	free(ptr_cpy);	213	free(ptr_cpy);

Lines 36-42 Link Here

(-)samba-3.0.9-orig/source/lib/ldap_escape.c (-2 / +2 lines)
36	char escape_ldap_string_alloc(const char s)	36	char escape_ldap_string_alloc(const char s)
37	{	37	{
38	size_t len = strlen(s)+1;	38	size_t len = strlen(s)+1;
39	char *output = malloc(len);	39	char *output = SMB_MALLOC(len);
40	char *output_tmp;	40	char *output_tmp;
41	const char *sub;	41	const char *sub;
42	int i = 0;	42	int i = 0;
Lines 65-71 Link Here
65		65
66	if (sub) {	66	if (sub) {
67	len = len + 3;	67	len = len + 3;
68	output_tmp = realloc(output, len);	68	output_tmp = SMB_REALLOC(output, len);
69	if (!output_tmp) {	69	if (!output_tmp) {
70	SAFE_FREE(output);	70	SAFE_FREE(output);
71	return NULL;	71	return NULL;

Lines 190-196 Link Here

(-)samba-3.0.9-orig/source/lib/messages.c (-2 / +2 lines)
190		190
191	kbuf = message_key_pid(pid);	191	kbuf = message_key_pid(pid);
192		192
193	dbuf.dptr = (void *)malloc(len + sizeof(rec));	193	dbuf.dptr = (void *)SMB_MALLOC(len + sizeof(rec));
194	if (!dbuf.dptr)	194	if (!dbuf.dptr)
195	return False;	195	return False;
196		196
Lines 468-474 Link Here
468	{	468	{
469	struct dispatch_fns *dfn;	469	struct dispatch_fns *dfn;
470		470
471	dfn = (struct dispatch_fns )malloc(sizeof(dfn));	471	dfn = SMB_MALLOC_P(struct dispatch_fns);
472		472
473	if (dfn != NULL) {	473	if (dfn != NULL) {
474		474

Lines 172-178 Link Here

(-)samba-3.0.9-orig/source/lib/module.c (-2 / +2 lines)
172	return SMB_EVENT_ID_INVALID;	172	return SMB_EVENT_ID_INVALID;
173	}	173	}
174		174
175	event = (struct smb_idle_list_ent *)malloc(sizeof(struct smb_idle_list_ent));	175	event = SMB_MALLOC_P(struct smb_idle_list_ent);
176	if (!event) {	176	if (!event) {
177	DEBUG(0,("malloc() failed!\n"));	177	DEBUG(0,("malloc() failed!\n"));
178	return SMB_EVENT_ID_INVALID;	178	return SMB_EVENT_ID_INVALID;
Lines 254-260 Link Here
254	return SMB_EVENT_ID_INVALID;	254	return SMB_EVENT_ID_INVALID;
255	}	255	}
256		256
257	event = (struct smb_exit_list_ent *)malloc(sizeof(struct smb_exit_list_ent));	257	event = SMB_MALLOC_P(struct smb_exit_list_ent);
258	if (!event) {	258	if (!event) {
259	DEBUG(0,("malloc() failed!\n"));	259	DEBUG(0,("malloc() failed!\n"));
260	return SMB_EVENT_ID_INVALID;	260	return SMB_EVENT_ID_INVALID;

Lines 195-201 Link Here

(-)samba-3.0.9-orig/source/lib/ms_fnmatch.c (-1 / +1 lines)
195	}	195	}
196		196
197	if (count != 0) {	197	if (count != 0) {
198	max_n = calloc(sizeof(struct max_n), count);	198	max_n = SMB_CALLOC_ARRAY(struct max_n, count);
199	if (!max_n) {	199	if (!max_n) {
200	return -1;	200	return -1;
201	}	201	}




	if ( !old_la )
		return NT_STATUS_OK;

	*new_la = TALLOC_P(mem_ctx, LUID_ATTR);
	ALLOC_CHECK(new_la, ret, done, "dupalloc_luid_attr");

	(*new_la)->luid.high = old_la->luid.high;

	TALLOC_CTX *mem_ctx = talloc_init("privilege set");
	ALLOC_CHECK(mem_ctx, ret, done, "init_privilege");

	*priv_set = TALLOC_ZERO_P(mem_ctx, PRIVILEGE_SET);
	ALLOC_CHECK(*priv_set, ret, done, "init_privilege");

	(*priv_set)->mem_ctx = mem_ctx;

{
	NTSTATUS ret;

	*priv_set = TALLOC_ZERO_P(mem_ctx, PRIVILEGE_SET);
	ALLOC_CHECK(*priv_set, ret, done, "init_privilege");

	(*priv_set)->mem_ctx = mem_ctx;


	/* we can allocate memory to add the new privilege */

	new_set = TALLOC_REALLOC_ARRAY(priv_set->mem_ctx, priv_set->set, LUID_ATTR, priv_set->count + 1);
	ALLOC_CHECK(new_set, ret, done, "add_privilege");

	new_set[priv_set->count].luid.high = set.luid.high;


	old_set = priv_set->set;

	new_set = TALLOC_ARRAY(priv_set->mem_ctx, LUID_ATTR, priv_set->count - 1);
	ALLOC_CHECK(new_set, ret, done, "remove_privilege");

	for (i=0, j=0; i < priv_set->count; i++) {


	old_set = priv_set->set;

	new_set = TALLOC_ARRAY(new_priv_set->mem_ctx, LUID_ATTR, priv_set->count - 1);
	ALLOC_CHECK(new_set, ret, done, "dup_priv_set");

	for (i=0; i < priv_set->count; i++) {

Lines 80-86 Link Here

(-)samba-3.0.9-orig/source/lib/secace.c (-2 / +2 lines)
80		80
81	*num += 1;	81	*num += 1;
82		82
83	if((new[0] = (SEC_ACE ) talloc_zero(ctx, (num) * sizeof(SEC_ACE))) == 0)	83	if((new[0] = TALLOC_ZERO_ARRAY(ctx, SEC_ACE, *num )) == 0)
84	return NT_STATUS_NO_MEMORY;	84	return NT_STATUS_NO_MEMORY;
85		85
86	for (i = 0; i < *num - 1; i ++)	86	for (i = 0; i < *num - 1; i ++)
Lines 124-130 Link Here
124		124
125	if (!ctx \|\| !new \|\| !old \|\| !sid \|\| !num) return NT_STATUS_INVALID_PARAMETER;	125	if (!ctx \|\| !new \|\| !old \|\| !sid \|\| !num) return NT_STATUS_INVALID_PARAMETER;
126		126
127	if((new[0] = (SEC_ACE ) talloc_zero(ctx, (num) * sizeof(SEC_ACE))) == 0)	127	if((new[0] = TALLOC_ZERO_ARRAY(ctx, SEC_ACE, *num )) == 0)
128	return NT_STATUS_NO_MEMORY;	128	return NT_STATUS_NO_MEMORY;
129		129
130	for (i = 0; i < *num; i ++) {	130	for (i = 0; i < *num; i ++) {

Lines 32-38 Link Here

(-)samba-3.0.9-orig/source/lib/secacl.c (-2 / +2 lines)
32	SEC_ACL *dst;	32	SEC_ACL *dst;
33	int i;	33	int i;
34		34
35	if((dst = (SEC_ACL *)talloc_zero(ctx,sizeof(SEC_ACL))) == NULL)	35	if((dst = TALLOC_ZERO_P(ctx,SEC_ACL)) == NULL)
36	return NULL;	36	return NULL;
37		37
38	dst->revision = revision;	38	dst->revision = revision;
Lines 46-52 Link Here
46	positive number. */	46	positive number. */
47		47
48	if ((num_aces) &&	48	if ((num_aces) &&
49	((dst->ace = (SEC_ACE )talloc(ctx, sizeof(SEC_ACE) num_aces))	49	((dst->ace = TALLOC_ARRAY(ctx, SEC_ACE, num_aces))
50	== NULL)) {	50	== NULL)) {
51	return NULL;	51	return NULL;
52	}	52	}





	*sd_size = 0;

	if(( dst = TALLOC_ZERO_P(ctx, SEC_DESC)) == NULL)
		return NULL;

	dst->revision = revision;

{
	SEC_DESC_BUF *dst;

	if((dst = TALLOC_ZERO_P(ctx, SEC_DESC_BUF)) == NULL)
		return NULL;

	/* max buffer size (allocated size) */


	the_acl = parent_ctr->dacl;

	if (!(new_ace_list = TALLOC_ARRAY(ctx, SEC_ACE, the_acl->num_aces))) 
		return NULL;

	for (i = 0; the_acl && i < the_acl->num_aces; i++) {

Lines 33-39 Link Here

(-)samba-3.0.9-orig/source/lib/server_mutex.c (-1 / +1 lines)
33		33
34	BOOL grab_server_mutex(const char *name)	34	BOOL grab_server_mutex(const char *name)
35	{	35	{
36	mutex_server_name = strdup(name);	36	mutex_server_name = SMB_STRDUP(name);
37	if (!mutex_server_name) {	37	if (!mutex_server_name) {
38	DEBUG(0,("grab_server_mutex: malloc failed for %s\n", name));	38	DEBUG(0,("grab_server_mutex: malloc failed for %s\n", name));
39	return False;	39	return False;




		i++;
	i++;

	names = SMB_MALLOC_ARRAY( char*, i );
	if ( !names ) {
		DEBUG(0,("get_attr_list: out of memory\n"));
		return NULL;


	i = 0;
	while ( table[i].attrib != LDAP_ATTR_LIST_END ) {
		names[i] = SMB_STRDUP( table[i].name );
		i++;
	}
	names[i] = NULL;

	if (!size) {
		/* Upgrade 2.2 style entry */
		char *p;
	        char* old_style_key = SMB_STRDUP(*dn);
		char *data;
		fstring old_style_pw;
		

#endif

	if (mods == NULL) {
		mods = SMB_MALLOC_P(LDAPMod *);
		if (mods == NULL) {
			DEBUG(0, ("make_a_mod: out of memory!\n"));
			return;

	}

	if (mods[i] == NULL) {
		mods = SMB_REALLOC_ARRAY (mods, LDAPMod *, i + 2);
		if (mods == NULL) {
			DEBUG(0, ("make_a_mod: out of memory!\n"));
			return;
		}
		mods[i] = SMB_MALLOC_P(LDAPMod);
		if (mods[i] == NULL) {
			DEBUG(0, ("make_a_mod: out of memory!\n"));
			return;
		}
		mods[i]->mod_op = modop;
		mods[i]->mod_values = NULL;
		mods[i]->mod_type = SMB_STRDUP(attribute);
		mods[i + 1] = NULL;
	}


		if (mods[i]->mod_values != NULL) {
			for (; mods[i]->mod_values[j] != NULL; j++);
		}
		mods[i]->mod_values = SMB_REALLOC_ARRAY(mods[i]->mod_values, char *, j + 2);
					       (j + 2) * sizeof (char *));
					       
		if (mods[i]->mod_values == NULL) {
			DEBUG (0, ("make_a_mod: Memory allocation failure!\n"));

		return;
	}

	t = SMB_XMALLOC_P(struct smbldap_state_lookup);
	ZERO_STRUCTP(t);
	
	DLIST_ADD_END(smbldap_state_lookup_list, t, tmp);

		DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n", 
			  ldap_state->bind_dn));

		*whop = SMB_STRDUP(ldap_state->bind_dn);
		if (!*whop) {
			return LDAP_NO_MEMORY;
		}
		*credp = SMB_STRDUP(ldap_state->bind_secret);
		if (!*credp) {
			SAFE_FREE(*whop);
			return LDAP_NO_MEMORY;


NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx, const char *location, struct smbldap_state **smbldap_state) 
{
	*smbldap_state = TALLOC_ZERO_P(mem_ctx, struct smbldap_state);
	if (!*smbldap_state) {
		DEBUG(0, ("talloc() failed for ldapsam private_data!\n"));
		return NT_STATUS_NO_MEMORY;





	r = p + 3;
	copylen = q - r;
	envname = (char *)SMB_MALLOC(copylen + 1 + 4); /* reserve space for use later add %$() chars */
	if (envname == NULL) return NULL;
	strncpy(envname,r,copylen);
	envname[copylen] = '\0';

		return NULL;
	}
	
	a_string = SMB_STRDUP(str);
	if (a_string == NULL) {
		DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));
		return NULL;

			t = realloc_string_sub(t, "%U", r);
			break;
		case 'G' :
			r = SMB_STRDUP(smb_name);
			if (r == NULL) goto error;
			if ((pass = Get_Pwnam(r))!=NULL) {
				t = realloc_string_sub(t, "%G", gidtoname(pass->pw_gid));

	char *a_string, *ret_string;
	char *b, *p, *s, *t;

	a_string = SMB_STRDUP(input_string);
	if (a_string == NULL) {
		DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));
		return NULL;

	char *a_string, *ret_string;
	char *b, *p, *s, *t, *h;

	a_string = SMB_STRDUP(str);
	if (a_string == NULL) {
		DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));
		return NULL;

Lines 1031-1037 Link Here

(-)samba-3.0.9-orig/source/lib/system.c (-2 / +2 lines)
1031	for( argcl = 1; ptr; ptr = strtok(NULL, " \t"))	1031	for( argcl = 1; ptr; ptr = strtok(NULL, " \t"))
1032	argcl++;	1032	argcl++;
1033		1033
1034	if((argl = (char *)malloc((argcl + 1) sizeof(char *))) == NULL)	1034	if((argl = (char *)SMB_MALLOC((argcl + 1) sizeof(char *))) == NULL)
1035	return NULL;	1035	return NULL;
1036		1036
1037	/*	1037	/*
Lines 1113-1119 Link Here
1113	goto err_exit;	1113	goto err_exit;
1114	}	1114	}
1115		1115
1116	if((entry = (popen_list *)malloc(sizeof(popen_list))) == NULL)	1116	if((entry = SMB_MALLOC_P(popen_list)) == NULL)
1117	goto err_exit;	1117	goto err_exit;
1118		1118
1119	ZERO_STRUCTP(entry);	1119	ZERO_STRUCTP(entry);

Lines 53-59 Link Here

(-)samba-3.0.9-orig/source/lib/system_smbd.c (-1 / +1 lines)
53	return -1;	53	return -1;
54	}	54	}
55		55
56	gids_saved = (gid_t )malloc(sizeof(gid_t) (ngrp_saved+1));	56	gids_saved = SMB_MALLOC_ARRAY(gid_t, ngrp_saved+1);
57	if (!gids_saved) {	57	if (!gids_saved) {
58	errno = ENOMEM;	58	errno = ENOMEM;
59	return -1;	59	return -1;

Lines 54-59 Link Here

(-)samba-3.0.9-orig/source/lib/talloc.c (-11 / +73 lines)
54		54
55	#include "includes.h"	55	#include "includes.h"
56		56
		57	/* Max allowable allococation - 256mb - 0x10000000 */
		58	#define MAX_TALLOC_SIZE (10241024256)
57		59
58	/**	60	/**
59	* Start of linked list of all talloc pools.	61	* Start of linked list of all talloc pools.
Lines 100-106 Link Here
100	{	102	{
101	TALLOC_CTX *t;	103	TALLOC_CTX *t;
102		104
103	t = (TALLOC_CTX *)malloc(sizeof(TALLOC_CTX));	105	t = (TALLOC_CTX *)SMB_MALLOC(sizeof(TALLOC_CTX));
104	if (t) {	106	if (t) {
105	t->list = NULL;	107	t->list = NULL;
106	t->total_alloc_size = 0;	108	t->total_alloc_size = 0;
Lines 143-158 Link Here
143		145
144		146
145	/ Allocate a bit of memory from the specified pool /	147	/ Allocate a bit of memory from the specified pool /
		148	#if defined(PARANOID_MALLOC_CHECKER)
		149	void talloc_(TALLOC_CTX t, size_t size)
		150	#else
146	void talloc(TALLOC_CTX t, size_t size)	151	void talloc(TALLOC_CTX t, size_t size)
		152	#endif
147	{	153	{
148	void *p;	154	void *p;
149	struct talloc_chunk *tc;	155	struct talloc_chunk *tc;
150		156
151	if (!t \|\| size == 0) return NULL;	157	if (!t \|\| size == 0) return NULL;
152		158
153	p = malloc(size);	159	p = SMB_MALLOC(size);
154	if (p) {	160	if (p) {
155	tc = malloc(sizeof(*tc));	161	tc = SMB_MALLOC(sizeof(*tc));
156	if (tc) {	162	if (tc) {
157	tc->ptr = p;	163	tc->ptr = p;
158	tc->size = size;	164	tc->size = size;
Lines 167-174 Link Here
167	return p;	173	return p;
168	}	174	}
169		175
		176	/** Allocate an array of count elements of size x */
		177	#if defined(PARANOID_MALLOC_CHECKER)
		178	void talloc_array_(TALLOC_CTX ctx, size_t el_size, unsigned int count)
		179	#else
		180	void talloc_array(TALLOC_CTX ctx, size_t el_size, unsigned int count)
		181	#endif
		182	{
		183	if (count >= MAX_TALLOC_SIZE/el_size) {
		184	return NULL;
		185	}
		186	return TALLOC(ctx, el_size * count);
		187	}
		188
170	/** A talloc version of realloc */	189	/** A talloc version of realloc */
		190	#if defined(PARANOID_MALLOC_CHECKER)
		191	void talloc_realloc_(TALLOC_CTX t, void *ptr, size_t size)
		192	#else
171	void talloc_realloc(TALLOC_CTX t, void *ptr, size_t size)	193	void talloc_realloc(TALLOC_CTX t, void *ptr, size_t size)
		194	#endif
172	{	195	{
173	struct talloc_chunk *tc;	196	struct talloc_chunk *tc;
174	void *new_ptr;	197	void *new_ptr;
Lines 179-189 Link Here
179		202
180	/* realloc(NULL) is equavalent to malloc() */	203	/* realloc(NULL) is equavalent to malloc() */
181	if (ptr == NULL)	204	if (ptr == NULL)
182	return talloc(t, size);	205	return TALLOC(t, size);
183		206
184	for (tc=t->list; tc; tc=tc->next) {	207	for (tc=t->list; tc; tc=tc->next) {
185	if (tc->ptr == ptr) {	208	if (tc->ptr == ptr) {
186	new_ptr = Realloc(ptr, size);	209	new_ptr = SMB_REALLOC(ptr, size);
187	if (new_ptr) {	210	if (new_ptr) {
188	t->total_alloc_size += (size - tc->size);	211	t->total_alloc_size += (size - tc->size);
189	tc->size = size;	212	tc->size = size;
Lines 195-200 Link Here
195	return NULL;	218	return NULL;
196	}	219	}
197		220
		221	/** Re-allocate an array of count elements of size x */
		222	#if defined(PARANOID_MALLOC_CHECKER)
		223	void talloc_realloc_array_(TALLOC_CTX ctx, void *ptr, size_t el_size, unsigned int count)
		224	#else
		225	void talloc_realloc_array(TALLOC_CTX ctx, void *ptr, size_t el_size, unsigned int count)
		226	#endif
		227	{
		228	if (count >= MAX_TALLOC_SIZE/el_size) {
		229	return NULL;
		230	}
		231	return TALLOC_REALLOC(ctx, ptr, el_size * count);
		232	}
		233
198	/** Destroy all the memory allocated inside @p t, but not @p t	234	/** Destroy all the memory allocated inside @p t, but not @p t
199	* itself. */	235	* itself. */
200	void talloc_destroy_pool(TALLOC_CTX *t)	236	void talloc_destroy_pool(TALLOC_CTX *t)
Lines 246-254 Link Here
246		282
247		283
248	/** talloc and zero memory. */	284	/** talloc and zero memory. */
		285	#if defined(PARANOID_MALLOC_CHECKER)
		286	void talloc_zero_(TALLOC_CTX t, size_t size)
		287	#else
249	void talloc_zero(TALLOC_CTX t, size_t size)	288	void talloc_zero(TALLOC_CTX t, size_t size)
		289	#endif
250	{	290	{
251	void *p = talloc(t, size);	291	void *p = TALLOC(t, size);
252		292
253	if (p)	293	if (p)
254	memset(p, '\0', size);	294	memset(p, '\0', size);
Lines 256-265 Link Here
256	return p;	296	return p;
257	}	297	}
258		298
		299	#if defined(PARANOID_MALLOC_CHECKER)
		300	void talloc_zero_array_(TALLOC_CTX t, size_t el_size, unsigned int count)
		301	#else
		302	void talloc_zero_array(TALLOC_CTX t, size_t el_size, unsigned int count)
		303	#endif
		304	{
		305	#if defined(PARANOID_MALLOC_CHECKER)
		306	void *p = talloc_array_(t, el_size, count);
		307	#else
		308	void *p = talloc_array(t, el_size, count);
		309	#endif
		310
		311	if (p)
		312	memset(p, '\0', el_size*count);
		313
		314	return p;
		315	}
		316
259	/** memdup with a talloc. */	317	/** memdup with a talloc. */
		318	#if defined(PARANOID_MALLOC_CHECKER)
		319	void talloc_memdup_(TALLOC_CTX t, const void *p, size_t size)
		320	#else
260	void talloc_memdup(TALLOC_CTX t, const void *p, size_t size)	321	void talloc_memdup(TALLOC_CTX t, const void *p, size_t size)
		322	#endif
261	{	323	{
262	void *newp = talloc(t,size);	324	void *newp = TALLOC(t,size);
263		325
264	if (newp)	326	if (newp)
265	memcpy(newp, p, size);	327	memcpy(newp, p, size);
Lines 271-277 Link Here
271	char talloc_strdup(TALLOC_CTX t, const char *p)	333	char talloc_strdup(TALLOC_CTX t, const char *p)
272	{	334	{
273	if (p)	335	if (p)
274	return talloc_memdup(t, p, strlen(p) + 1);	336	return TALLOC_MEMDUP(t, p, strlen(p) + 1);
275	else	337	else
276	return NULL;	338	return NULL;
277	}	339	}
Lines 298-304 Link Here
298	smb_ucs2_t talloc_strdup_w(TALLOC_CTX t, const smb_ucs2_t *p)	360	smb_ucs2_t talloc_strdup_w(TALLOC_CTX t, const smb_ucs2_t *p)
299	{	361	{
300	if (p)	362	if (p)
301	return talloc_memdup(t, p, (strlen_w(p) + 1) * sizeof(smb_ucs2_t));	363	return TALLOC_MEMDUP(t, p, (strlen_w(p) + 1) * sizeof(smb_ucs2_t));
302	else	364	else
303	return NULL;	365	return NULL;
304	}	366	}
Lines 329-335 Link Here
329		391
330	len = vsnprintf(NULL, 0, fmt, ap2);	392	len = vsnprintf(NULL, 0, fmt, ap2);
331		393
332	ret = talloc(t, len+1);	394	ret = TALLOC(t, len+1);
333	if (ret) {	395	if (ret) {
334	VA_COPY(ap2, ap);	396	VA_COPY(ap2, ap);
335	vsnprintf(ret, len+1, fmt, ap2);	397	vsnprintf(ret, len+1, fmt, ap2);
Lines 373-379 Link Here
373	s_len = strlen(s);	435	s_len = strlen(s);
374	len = vsnprintf(NULL, 0, fmt, ap2);	436	len = vsnprintf(NULL, 0, fmt, ap2);
375		437
376	s = talloc_realloc(t, s, s_len + len+1);	438	s = TALLOC_REALLOC(t, s, s_len + len+1);
377	if (!s) return NULL;	439	if (!s) return NULL;
378		440
379	VA_COPY(ap2, ap);	441	VA_COPY(ap2, ap);

Lines 190-197 Link Here

(-)samba-3.0.9-orig/source/lib/time.c (-2 / +1 lines)
190	time_t low,high;	190	time_t low,high;
191		191
192	zone = TimeZone(t);	192	zone = TimeZone(t);
193	tdt = (struct dst_table *)Realloc(dst_table,	193	tdt = SMB_REALLOC_ARRAY(dst_table, struct dst_table, i+1);
194	sizeof(dst_table[0])*(i+1));
195	if (!tdt) {	194	if (!tdt) {
196	DEBUG(0,("TimeZoneFaster: out of memory!\n"));	195	DEBUG(0,("TimeZoneFaster: out of memory!\n"));
197	SAFE_FREE(dst_table);	196	SAFE_FREE(dst_table);

Lines 23-28 Link Here

(-)samba-3.0.9-orig/source/lib/util.c (-27 / +131 lines)
23		23
24	#include "includes.h"	24	#include "includes.h"
25		25
		26	/* Max allowable allococation - 256mb - 0x10000000 */
		27	#define MAX_ALLOC_SIZE (10241024256)
		28
26	#if (defined(HAVE_NETGROUP) && defined (WITH_AUTOMOUNT))	29	#if (defined(HAVE_NETGROUP) && defined (WITH_AUTOMOUNT))
27	#ifdef WITH_NISPLUS_HOME	30	#ifdef WITH_NISPLUS_HOME
28	#ifdef BROKEN_NISPLUS_INCLUDE_FILES	31	#ifdef BROKEN_NISPLUS_INCLUDE_FILES
Lines 79-85 Link Here
79	BOOL set_global_myname(const char *myname)	82	BOOL set_global_myname(const char *myname)
80	{	83	{
81	SAFE_FREE(smb_myname);	84	SAFE_FREE(smb_myname);
82	smb_myname = strdup(myname);	85	smb_myname = SMB_STRDUP(myname);
83	if (!smb_myname)	86	if (!smb_myname)
84	return False;	87	return False;
85	strupper_m(smb_myname);	88	strupper_m(smb_myname);
Lines 98-104 Link Here
98	BOOL set_global_myworkgroup(const char *myworkgroup)	101	BOOL set_global_myworkgroup(const char *myworkgroup)
99	{	102	{
100	SAFE_FREE(smb_myworkgroup);	103	SAFE_FREE(smb_myworkgroup);
101	smb_myworkgroup = strdup(myworkgroup);	104	smb_myworkgroup = SMB_STRDUP(myworkgroup);
102	if (!smb_myworkgroup)	105	if (!smb_myworkgroup)
103	return False;	106	return False;
104	strupper_m(smb_myworkgroup);	107	strupper_m(smb_myworkgroup);
Lines 117-123 Link Here
117	BOOL set_global_scope(const char *scope)	120	BOOL set_global_scope(const char *scope)
118	{	121	{
119	SAFE_FREE(smb_scope);	122	SAFE_FREE(smb_scope);
120	smb_scope = strdup(scope);	123	smb_scope = SMB_STRDUP(scope);
121	if (!smb_scope)	124	if (!smb_scope)
122	return False;	125	return False;
123	strupper_m(smb_scope);	126	strupper_m(smb_scope);
Lines 151-157 Link Here
151	free_netbios_names_array();	154	free_netbios_names_array();
152		155
153	smb_num_netbios_names = number + 1;	156	smb_num_netbios_names = number + 1;
154	smb_my_netbios_names = (char *)malloc( sizeof(char ) * smb_num_netbios_names );	157	smb_my_netbios_names = SMB_MALLOC_ARRAY( char *, smb_num_netbios_names );
155		158
156	if (!smb_my_netbios_names)	159	if (!smb_my_netbios_names)
157	return False;	160	return False;
Lines 164-170 Link Here
164	{	167	{
165	SAFE_FREE(smb_my_netbios_names[i]);	168	SAFE_FREE(smb_my_netbios_names[i]);
166		169
167	smb_my_netbios_names[i] = strdup(name);	170	smb_my_netbios_names[i] = SMB_STRDUP(name);
168	if (!smb_my_netbios_names[i])	171	if (!smb_my_netbios_names[i])
169	return False;	172	return False;
170	strupper_m(smb_my_netbios_names[i]);	173	strupper_m(smb_my_netbios_names[i]);
Lines 301-307 Link Here
301	return;	304	return;
302	}	305	}
303		306
304	gids = Realloc(gids, (num+1) sizeof(gid_t));	307	gids = SMB_REALLOC_ARRAY(gids, gid_t, *num+1);
305		308
306	if (*gids == NULL)	309	if (*gids == NULL)
307	return;	310	return;
Lines 351-357 Link Here
351	while ((p = Atoic(p, &val, ":,")) != NULL && (*p) != ':') {	354	while ((p = Atoic(p, &val, ":,")) != NULL && (*p) != ':') {
352	uint32 *tn;	355	uint32 *tn;
353		356
354	tn = Realloc((num), ((count)+1) * sizeof(uint32));	357	tn = SMB_REALLOC_ARRAY((num), uint32, (count)+1);
355	if (tn == NULL) {	358	if (tn == NULL) {
356	SAFE_FREE(*num);	359	SAFE_FREE(*num);
357	return NULL;	360	return NULL;
Lines 727-733 Link Here
727	size_t num_to_read_thistime;	730	size_t num_to_read_thistime;
728	size_t num_written = 0;	731	size_t num_written = 0;
729		732
730	if ((buf = malloc(TRANSFER_BUF_SIZE)) == NULL)	733	if ((buf = SMB_MALLOC(TRANSFER_BUF_SIZE)) == NULL)
731	return -1;	734	return -1;
732		735
733	while (total < n) {	736	while (total < n) {
Lines 855-860 Link Here
855	return(False);	858	return(False);
856	}	859	}
857		860
		861	#if defined(PARANOID_MALLOC_CHECKER)
		862
		863	/****************************************************************************
		864	Internal malloc wrapper. Externally visible.
		865	****************************************************************************/
		866
		867	void *malloc_(size_t size)
		868	{
		869	#undef malloc
		870	/* If we don't add an amount here the glibc memset seems to write
		871	one byte over. */
		872	return malloc(size+16);
		873	#define malloc(s) __ERROR_DONT_USE_MALLOC_DIRECTLY
		874	}
		875
		876	/****************************************************************************
		877	Internal calloc wrapper. Not externally visible.
		878	****************************************************************************/
		879
		880	static void *calloc_(size_t count, size_t size)
		881	{
		882	#undef calloc
		883	/* If we don't add an amount here the glibc memset seems to write
		884	one byte over. */
		885	return calloc(count+1, size);
		886	#define calloc(n,s) __ERROR_DONT_USE_CALLOC_DIRECTLY
		887	}
		888
		889	/****************************************************************************
		890	Internal realloc wrapper. Not externally visible.
		891	****************************************************************************/
		892
		893	static void realloc_(void ptr, size_t size)
		894	{
		895	#undef realloc
		896	/* If we don't add an amount here the glibc memset seems to write
		897	one byte over. */
		898	return realloc(ptr, size+16);
		899	#define realloc(p,s) __ERROR_DONT_USE_RELLOC_DIRECTLY
		900	}
		901
		902	#endif /* PARANOID_MALLOC_CHECKER */
		903
		904	/****************************************************************************
		905	Type-safe malloc.
		906	****************************************************************************/
		907
		908	void *malloc_array(size_t el_size, unsigned int count)
		909	{
		910	if (count >= MAX_ALLOC_SIZE/el_size) {
		911	return NULL;
		912	}
		913
		914	#if defined(PARANOID_MALLOC_CHECKER)
		915	return malloc_(el_size*count);
		916	#else
		917	return malloc(el_size*count);
		918	#endif
		919	}
		920
		921	/****************************************************************************
		922	Type-safe calloc.
		923	****************************************************************************/
		924
925	void *calloc_array(size_t size, size_t nmemb)
926	{
927	if (nmemb >= MAX_ALLOC_SIZE/size) {
928	return NULL;
929	}
930	#if defined(PARANOID_MALLOC_CHECKER)
931	return calloc_(nmemb, size);
932	#else
933	return calloc(nmemb, size);
934	#endif
935	}
936
858	/****************************************************************************	937	/****************************************************************************
859	Expand a pointer to be a particular size.	938	Expand a pointer to be a particular size.
860	****************************************************************************/	939	****************************************************************************/
Lines 869-878 Link Here
869	return NULL;	948	return NULL;
870	}	949	}
871		950
		951	#if defined(PARANOID_MALLOC_CHECKER)
		952	if (!p)
		953	ret = (void *)malloc_(size);
		954	else
		955	ret = (void *)realloc_(p,size);
		956	#else
872	if (!p)	957	if (!p)
873	ret = (void *)malloc(size);	958	ret = (void *)malloc(size);
874	else	959	else
875	ret = (void *)realloc(p,size);	960	ret = (void *)realloc(p,size);
		961	#endif
876		962
877	if (!ret)	963	if (!ret)
878	DEBUG(0,("Memory allocation error: failed to expand to %d bytes\n",(int)size));	964	DEBUG(0,("Memory allocation error: failed to expand to %d bytes\n",(int)size));
Lines 880-896 Link Here
880	return(ret);	966	return(ret);
881	}	967	}
882		968
883	void Realloc_zero(void ptr, size_t size)	969	/****************************************************************************
884	{	970	Type-safe realloc.
885	void *tptr = NULL;	971	****************************************************************************/
886		972
887	tptr = Realloc(ptr, size);	973	void realloc_array(void p,size_t el_size, unsigned int count)
888	if(tptr == NULL)	974	{
		975	if (count >= MAX_ALLOC_SIZE/el_size) {
889	return NULL;	976	return NULL;
890		977	}
891	memset((char *)tptr,'\0',size);	978	return Realloc(p,el_size*count);
892
893	return tptr;
894	}	979	}
895		980
896	/****************************************************************************	981	/****************************************************************************
Lines 1595-1602 Link Here
1595	if(num_entries == 0)	1680	if(num_entries == 0)
1596	return;	1681	return;
1597		1682
1598	if(( (ppname_array) = (name_compare_entry )malloc(	1683	if(( (*ppname_array) = SMB_MALLOC_ARRAY(name_compare_entry, num_entries + 1)) == NULL) {
1599	(num_entries + 1) * sizeof(name_compare_entry))) == NULL) {
1600	DEBUG(0,("set_namearray: malloc fail\n"));	1684	DEBUG(0,("set_namearray: malloc fail\n"));
1601	return;	1685	return;
1602	}	1686	}
Lines 1619-1625 Link Here
1619	break;	1703	break;
1620		1704
1621	(*ppname_array)[i].is_wild = ms_has_wild(nameptr);	1705	(*ppname_array)[i].is_wild = ms_has_wild(nameptr);
1622	if(((*ppname_array)[i].name = strdup(nameptr)) == NULL) {	1706	if(((*ppname_array)[i].name = SMB_STRDUP(nameptr)) == NULL) {
1623	DEBUG(0,("set_namearray: malloc fail (1)\n"));	1707	DEBUG(0,("set_namearray: malloc fail (1)\n"));
1624	return;	1708	return;
1625	}	1709	}
Lines 2115-2128 Link Here
2115	malloc that aborts with smb_panic on fail or zero size.	2199	malloc that aborts with smb_panic on fail or zero size.
2116	*****************************************************************/	2200	*****************************************************************/
2117		2201
2118	void *smb_xmalloc(size_t size)	2202	void *smb_xmalloc_array(size_t size, unsigned int count)
2119	{	2203	{
2120	void *p;	2204	void *p;
2121	if (size == 0)	2205	if (size == 0)
2122	smb_panic("smb_xmalloc: called with zero size.\n");	2206	smb_panic("smb_xmalloc_array: called with zero size.\n");
2123	if ((p = malloc(size)) == NULL) {	2207	if (count >= MAX_ALLOC_SIZE/size) {
2124	DEBUG(0, ("smb_xmalloc() failed to allocate %lu bytes\n", (unsigned long)size));	2208	smb_panic("smb_xmalloc: alloc size too large.\n");
2125	smb_panic("smb_xmalloc: malloc fail.\n");	2209	}
		2210	if ((p = SMB_MALLOC(size*count)) == NULL) {
		2211	DEBUG(0, ("smb_xmalloc_array failed to allocate %lu * %lu bytes\n",
		2212	(unsigned long)size, (unsigned long)count));
		2213	smb_panic("smb_xmalloc_array: malloc fail.\n");
2126	}	2214	}
2127	return p;	2215	return p;
2128	}	2216	}
Lines 2134-2140 Link Here
2134	void smb_xmemdup(const void p, size_t size)	2222	void smb_xmemdup(const void p, size_t size)
2135	{	2223	{
2136	void *p2;	2224	void *p2;
2137	p2 = smb_xmalloc(size);	2225	p2 = SMB_XMALLOC_ARRAY(unsigned char,size);
2138	memcpy(p2, p, size);	2226	memcpy(p2, p, size);
2139	return p2;	2227	return p2;
2140	}	2228	}
Lines 2145-2151 Link Here
2145		2233
2146	char smb_xstrdup(const char s)	2234	char smb_xstrdup(const char s)
2147	{	2235	{
		2236	#if defined(PARANOID_MALLOC_CHECKER)
		2237	#ifdef strdup
		2238	#undef strdup
		2239	#endif
		2240	#endif
2148	char *s1 = strdup(s);	2241	char *s1 = strdup(s);
		2242	#if defined(PARANOID_MALLOC_CHECKER)
		2243	#define strdup(s) __ERROR_DONT_USE_STRDUP_DIRECTLY
		2244	#endif
2149	if (!s1)	2245	if (!s1)
2150	smb_panic("smb_xstrdup: malloc fail\n");	2246	smb_panic("smb_xstrdup: malloc fail\n");
2151	return s1;	2247	return s1;
Lines 2157-2163 Link Here
2157		2254
2158	char smb_xstrndup(const char s, size_t n)	2255	char smb_xstrndup(const char s, size_t n)
2159	{	2256	{
		2257	#if defined(PARANOID_MALLOC_CHECKER)
		2258	#ifdef strndup
		2259	#undef strndup
		2260	#endif
		2261	#endif
2160	char *s1 = strndup(s, n);	2262	char *s1 = strndup(s, n);
		2263	#if defined(PARANOID_MALLOC_CHECKER)
		2264	#define strndup(s,n) __ERROR_DONT_USE_STRNDUP_DIRECTLY
		2265	#endif
2161	if (!s1)	2266	if (!s1)
2162	smb_panic("smb_xstrndup: malloc fail\n");	2267	smb_panic("smb_xstrndup: malloc fail\n");
2163	return s1;	2268	return s1;
Lines 2189-2195 Link Here
2189	void *p2;	2294	void *p2;
2190	if (size == 0)	2295	if (size == 0)
2191	return NULL;	2296	return NULL;
2192	p2 = malloc(size);	2297	p2 = SMB_MALLOC(size);
2193	if (!p2)	2298	if (!p2)
2194	return NULL;	2299	return NULL;
2195	memcpy(p2, p, size);	2300	memcpy(p2, p, size);





	if (!s2) {
		maxlen = MIN(maxlen,8);
		s = (char *)SMB_MALLOC(maxlen);
	}

	if (!s) {

			char *t;
	  
			maxlen *= 2;
			t = (char *)SMB_REALLOC(s,maxlen);
			if (!t) {
				DEBUG(0,("fgets_slash: failed to expand buffer!\n"));
				SAFE_FREE(s);

	total = 0;

	while ((n = read(fd, buf, sizeof(buf))) > 0) {
		tp = SMB_REALLOC(p, total + n + 1);
		if (!tp) {
		        DEBUG(0,("file_pload: failed to expand buffer!\n"));
			close(fd);

		return NULL;
	}

	p = (char *)SMB_MALLOC(sbuf.st_size+1);
	if (!p) {
		return NULL;
	}

		if (s[0] == '\n') i++;
	}

	ret = SMB_MALLOC_ARRAY(char *, i+2);
	if (!ret) {
		SAFE_FREE(p);
		return NULL;




	struct sys_grent *gent;
	struct group *grp;
	
	gent = SMB_MALLOC_P(struct sys_grent);
	if (gent == NULL) {
		DEBUG (0, ("Out of memory in getgrent_list!\n"));
		return NULL;

		int i,num;
		
		if (grp->gr_name) {
			if ((gent->gr_name = SMB_STRDUP(grp->gr_name)) == NULL)
				goto err;
		}
		if (grp->gr_passwd) {
			if ((gent->gr_passwd = SMB_STRDUP(grp->gr_passwd)) == NULL)
				goto err;
		}
		gent->gr_gid = grp->gr_gid;

			;
		
		/* alloc space for gr_mem string pointers */
		if ((gent->gr_mem = SMB_MALLOC_ARRAY(char *, num+1)) == NULL)
			goto err;

		memset(gent->gr_mem, '\0', (num+1) * sizeof(char *));

		for (i=0; i < num; i++) {
			if ((gent->gr_mem[i] = SMB_STRDUP(grp->gr_mem[i])) == NULL)
				goto err;
		}
		gent->gr_mem[num] = NULL;
		
		grp = getgrent();
		if (grp) {
			gent->next = SMB_MALLOC_P(struct sys_grent);
			if (gent->next == NULL)
				goto err;
			gent = gent->next;

	struct sys_pwent *pent;
	struct passwd *pwd;
	
	pent = SMB_MALLOC_P(struct sys_pwent);
	if (pent == NULL) {
		DEBUG (0, ("Out of memory in getpwent_list!\n"));
		return NULL;

	while (pwd != NULL) {
		memset(pent, '\0', sizeof(struct sys_pwent));
		if (pwd->pw_name) {
			if ((pent->pw_name = SMB_STRDUP(pwd->pw_name)) == NULL)
				goto err;
		}
		if (pwd->pw_passwd) {
			if ((pent->pw_passwd = SMB_STRDUP(pwd->pw_passwd)) == NULL)
				goto err;
		}
		pent->pw_uid = pwd->pw_uid;
		pent->pw_gid = pwd->pw_gid;
		if (pwd->pw_gecos) {
			if ((pent->pw_gecos = SMB_STRDUP(pwd->pw_gecos)) == NULL)
				goto err;
		}
		if (pwd->pw_dir) {
			if ((pent->pw_dir = SMB_STRDUP(pwd->pw_dir)) == NULL)
				goto err;
		}
		if (pwd->pw_shell) {
			if ((pent->pw_shell = SMB_STRDUP(pwd->pw_shell)) == NULL)
				goto err;
		}

		pwd = getpwent();
		if (pwd) {
			pent->next = SMB_MALLOC_P(struct sys_pwent);
			if (pent->next == NULL)
				goto err;
			pent = pent->next;

		;

	for (i = 0; i < num_users; i++) {
		struct sys_userlist *entry = SMB_MALLOC_P(struct sys_userlist);
		if (entry == NULL) {
			free_userlist(list_head);
			return NULL;
		}
		entry->unix_name = (char *)SMB_STRDUP(grp->gr_mem[i]);
		if (entry->unix_name == NULL) {
			SAFE_FREE(entry);
			free_userlist(list_head);

Lines 24-30 Link Here

(-)samba-3.0.9-orig/source/lib/util_pw.c (-1 / +1 lines)
24		24
25	static struct passwd alloc_copy_passwd(const struct passwd from)	25	static struct passwd alloc_copy_passwd(const struct passwd from)
26	{	26	{
27	struct passwd *ret = smb_xmalloc(sizeof(struct passwd));	27	struct passwd *ret = SMB_XMALLOC_P(struct passwd);
28	ZERO_STRUCTP(ret);	28	ZERO_STRUCTP(ret);
29	ret->pw_name = smb_xstrdup(from->pw_name);	29	ret->pw_name = smb_xstrdup(from->pw_name);
30	ret->pw_passwd = smb_xstrdup(from->pw_passwd);	30	ret->pw_passwd = smb_xstrdup(from->pw_passwd);





	memset((char *)sidout, '\0', sizeof(DOM_SID));

	p = q = SMB_STRDUP(sidstr + 2);
	if (p == NULL) {
		DEBUG(0, ("string_to_sid: out of memory!\n"));
		return False;

{
	char *buf, *s;
	int len = sid_size(sid);
	buf = SMB_MALLOC(len);
	if (!buf)
		return NULL;
	sid_linearize(buf, len, sid);

	if(!src)
		return NULL;
	
	if((dst = TALLOC_ZERO_P(ctx, DOM_SID)) != NULL) {
		sid_copy( dst, src);
	}
	

Lines 49-55 Link Here

(-)samba-3.0.9-orig/source/lib/util_smbd.c (-2 / +2 lines)
49	if (!pwd) return False;	49	if (!pwd) return False;
50		50
51	max_grp = groups_max();	51	max_grp = groups_max();
52	temp_groups = (gid_t )malloc(sizeof(gid_t) max_grp);	52	temp_groups = SMB_MALLOC_ARRAY(gid_t, max_grp);
53	if (! temp_groups) {	53	if (! temp_groups) {
54	passwd_free(&pwd);	54	passwd_free(&pwd);
55	return False;	55	return False;
Lines 59-65 Link Here
59		59
60	gid_t *groups_tmp;	60	gid_t *groups_tmp;
61		61
62	groups_tmp = Realloc(temp_groups, sizeof(gid_t) * max_grp);	62	groups_tmp = SMB_REALLOC_ARRAY(temp_groups, gid_t, max_grp);
63		63
64	if (!groups_tmp) {	64	if (!groups_tmp) {
65	SAFE_FREE(temp_groups);	65	SAFE_FREE(temp_groups);




	*ctok=ictok;
	s=(char *)last_ptr;
	
	if (!(ret=iret=SMB_MALLOC_ARRAY(char *,ictok+1)))
		return NULL;
	
	while(ictok--) {    

	int i;
	char *hex_buffer;

	*out_hex_buffer = SMB_XMALLOC_ARRAY(char, (len*2)+1);
	hex_buffer = *out_hex_buffer;

	for (i = 0; i < len; i++)


	if (l == 0) {
		if (!null_string) {
			if((null_string = (char *)SMB_MALLOC(1)) == NULL) {
				DEBUG(0,("string_init: malloc fail for null_string.\n"));
				return False;
			}

		}
		*dest = null_string;
	} else {
		(*dest) = SMB_STRDUP(src);
		if ((*dest) == NULL) {
			DEBUG(0,("Out of memory in string_init\n"));
			return False;


	s = string;

	in = SMB_STRDUP(insert);
	if (!in) {
		DEBUG(0, ("realloc_string_sub: out of memory!\n"));
		return NULL;

	while ((p = strstr_m(s,pattern))) {
		if (ld > 0) {
			int offset = PTR_DIFF(s,string);
			char *t = SMB_REALLOC(string, ls + ld + 1);
			if (!t) {
				DEBUG(0, ("realloc_string_sub: out of memory!\n"));
				SAFE_FREE(in);

		}
	}

	r = rp = SMB_MALLOC_ARRAY(smb_ucs2_t, lt + 1);
	if (!r) {
		DEBUG(0, ("all_string_sub_w: out of memory!\n"));
		return NULL;

	char *s;
	int i, j;
	const char *hex = "0123456789ABCDEF";
	s = SMB_MALLOC(len * 3 + 1);
	if (!s)
		return NULL;
	for (j=i=0;i<len;i++) {

	char *ret;
	
	n = strnlen(s, n);
	ret = SMB_MALLOC(n+1);
	if (!ret)
		return NULL;
	memcpy(ret, s, n);

	
	if (!string || !*string)
		return NULL;
	s = SMB_STRDUP(string);
	if (!s) {
		DEBUG(0,("str_list_make: Unable to allocate memory"));
		return NULL;

	while (next_token(&str, tok, sep, sizeof(tok))) {		
		if (num == lsize) {
			lsize += S_LIST_ABS;
			rlist = SMB_REALLOC_ARRAY(list, char *, lsize +1);
			if (!rlist) {
				DEBUG(0,("str_list_make: Unable to allocate memory"));
				str_list_free(&list);

			memset (&list[num], 0, ((sizeof(char**)) * (S_LIST_ABS +1)));
		}
		
		list[num] = SMB_STRDUP(tok);
		if (!list[num]) {
			DEBUG(0,("str_list_make: Unable to allocate memory"));
			str_list_free(&list);

	while (src[num]) {
		if (num == lsize) {
			lsize += S_LIST_ABS;
			rlist = SMB_REALLOC_ARRAY(list, char *, lsize +1);
			if (!rlist) {
				DEBUG(0,("str_list_copy: Unable to re-allocate memory"));
				str_list_free(&list);

			memset (&list[num], 0, ((sizeof(char **)) * (S_LIST_ABS +1)));
		}
		
		list[num] = SMB_STRDUP(src[num]);
		if (!list[num]) {
			DEBUG(0,("str_list_copy: Unable to allocate memory"));
			str_list_free(&list);

			t = *list;
			d = p -t;
			if (ld) {
				t = (char *) SMB_MALLOC(ls +ld +1);
				if (!t) {
					DEBUG(0,("str_list_substitute: Unable to allocate memory"));
					return False;

		return 0;
	
	count = count_chars(ipstr_list, IPSTR_LIST_CHAR) + 1;
	if ( (*ip_list = SMB_MALLOC_ARRAY(struct ip_service, count)) == NULL ) {
		DEBUG(0,("ipstr_list_parse: malloc failed for %lu entries\n", (unsigned long)count));
		return 0;
	}

	size_t out_cnt = 0;
	size_t len = data.length;
	size_t output_len = data.length * 2;
	char *result = SMB_MALLOC(output_len); /* get us plenty of space */

	while (len-- && out_cnt < (data.length * 2) - 5) {
		int c = (unsigned char) *(data.data++);

	int new_len = strlen(right) + 1;

	if (*left == NULL) {
		*left = SMB_MALLOC(new_len);
		*left[0] = '\0';
	} else {
		new_len += strlen(*left);
		*left = SMB_REALLOC(*left, new_len);
	}

	if (*left == NULL)




	   not available */
	if (!upcase_table) {
		DEBUG(1,("creating lame upcase table\n"));
		upcase_table = SMB_MALLOC(0x20000);
		for (i=0;i<0x10000;i++) {
			smb_ucs2_t v;
			SSVAL(&v, 0, i);


	if (!lowcase_table) {
		DEBUG(1,("creating lame lowcase table\n"));
		lowcase_table = SMB_MALLOC(0x20000);
		for (i=0;i<0x10000;i++) {
			smb_ucs2_t v;
			SSVAL(&v, 0, i);

	if (valid_table) free(valid_table);

	DEBUG(2,("creating default valid table\n"));
	valid_table = SMB_MALLOC(0x10000);
	for (i=0;i<128;i++)
		valid_table[i] = isalnum(i) || strchr(allowed,i);
	

	char *s;
	int maxlen = (str->uni_str_len+1)*4;
	if (!str->buffer) return NULL;
	s = (char *)TALLOC(ctx, maxlen); /* convervative */
	if (!s) return NULL;
	pull_ucs2(NULL, s, str->buffer, maxlen, str->uni_str_len*2, 
		  STR_NOALIGN);

	smb_ucs2_t *dest;
	
	if (!len) len = strlen_w(src);
	dest = SMB_MALLOC_ARRAY(smb_ucs2_t, len + 1);
	if (!dest) {
		DEBUG(0,("strdup_w: out of memory!\n"));
		return NULL;

	
	/* allocate UNISTR2 destination if not given */
	if (!dst) {
		dst = TALLOC_P(ctx, UNISTR2);
		if (!dst)
			return NULL;
	}
	if (!dst->buffer) {
		dst->buffer = TALLOC_ARRAY(ctx, uint16, len + 1);
		if (!dst->buffer)
			return NULL;
	}




{
	char *keystr = NULL, *wins_ip_addr = NULL, *src_ip_addr = NULL;

	wins_ip_addr = SMB_STRDUP(inet_ntoa(wins_ip));
	src_ip_addr = SMB_STRDUP(inet_ntoa(src_ip));

	if ( !wins_ip_addr || !src_ip_addr ) {
		DEBUG(0,("wins_srv_keystr: malloc error\n"));

	if (lp_wins_support()) {
		/* give the caller something to chew on. This makes
		   the rest of the logic simpler (ie. less special cases) */
		ret = SMB_MALLOC_ARRAY(char *, 2);
		if (!ret) return NULL;
		ret[0] = SMB_STRDUP("*");
		ret[1] = NULL;
		return ret;
	}

		}

		/* add it to the list */
		ret = SMB_REALLOC_ARRAY(ret, char *, count+2);
		ret[count] = SMB_STRDUP(t_ip.tag);
		if (!ret[count]) break;
		count++;
	}

Lines 80-86 Link Here

(-)samba-3.0.9-orig/source/lib/xfile.c (-2 / +2 lines)
80	{	80	{
81	if (f->buf) return 1;	81	if (f->buf) return 1;
82	if (f->bufsize == 0) return 0;	82	if (f->bufsize == 0) return 0;
83	f->buf = malloc(f->bufsize);	83	f->buf = SMB_MALLOC(f->bufsize);
84	if (!f->buf) return 0;	84	if (!f->buf) return 0;
85	f->next = f->buf;	85	f->next = f->buf;
86	return 1;	86	return 1;
Lines 95-101 Link Here
95	{	95	{
96	XFILE *ret;	96	XFILE *ret;
97		97
98	ret = (XFILE *)malloc(sizeof(XFILE));	98	ret = SMB_MALLOC_P(XFILE);
99	if (!ret) return NULL;	99	if (!ret) return NULL;
100		100
101	memset(ret, 0, sizeof(XFILE));	101	memset(ret, 0, sizeof(XFILE));




	char *ret;
	int len;
	
	r = SMB_STRDUP(realm);

	if (!r || !*r)
		return r;


	len = (numbits+1)*(strlen(field)+1) + strlen(r) + 1;

	ret = SMB_MALLOC(len);
	if (!ret)
		return NULL;


{
	ADS_STRUCT *ads;
	
	ads = SMB_XMALLOC_P(ADS_STRUCT);
	ZERO_STRUCTP(ads);
	
	ads->server.realm = realm? SMB_STRDUP(realm) : NULL;
	ads->server.workgroup = workgroup ? SMB_STRDUP(workgroup) : NULL;
	ads->server.ldap_server = ldap_server? SMB_STRDUP(ldap_server) : NULL;

	/* we need to know if this is a foreign realm */
	if (realm && *realm && !strequal(lp_realm(), realm)) {




		return False;

	if (UNMARSHALLING(ps) && type_10->len) {
		type_10->username = PRS_ALLOC_MEM(ps, uint16, type_10->len);
		if (!type_10->username) {
			DEBUG(3, ("No memory available\n"));
			return False;

	depth++;

	if (UNMARSHALLING(ps)) {
		sid_and_attr->sid = PRS_ALLOC_MEM(ps, DOM_SID2, 1);
			(DOM_SID2 * ) prs_alloc_mem(ps, sizeof(DOM_SID2));
		if (!sid_and_attr->sid) {
			DEBUG(3, ("No memory available\n"));
			return False;

		return False;

	if (UNMARSHALLING(ps)) {
		array->krb_sid_and_attrs = PRS_ALLOC_MEM(ps, KRB_SID_AND_ATTRS, num);
			prs_alloc_mem(ps, sizeof(KRB_SID_AND_ATTRS) * num);
		if (!array->krb_sid_and_attrs) {
			DEBUG(3, ("No memory available\n"));
			return False;

		return False;

	if (UNMARSHALLING(ps)) {
		array->group_membership = PRS_ALLOC_MEM(ps, GROUP_MEMBERSHIP, num);
			prs_alloc_mem(ps, sizeof(GROUP_MEMBERSHIP) * num);
		if (!array->group_membership) {
			DEBUG(3, ("No memory available\n"));
			return False;

	if (!prs_uint32("type", ps, depth, &data->type))
		return False;
	if (UNMARSHALLING(ps)) {
		data->signature = PRS_ALLOC_MEM(ps, unsigned char, siglen);
		if (!data->signature) {
			DEBUG(3, ("No memory available\n"));
			return False;

	}

	if (UNMARSHALLING(ps) && hdr->size > 0) {
		hdr->ctr = PRS_ALLOC_MEM(ps, PAC_INFO_CTR, 1);
			prs_alloc_mem(ps, sizeof(PAC_INFO_CTR));
		if (!hdr->ctr) {
			DEBUG(3, ("No memory available\n"));
			return False;

	case PAC_TYPE_LOGON_INFO:
		DEBUG(5, ("PAC_TYPE_LOGON_INFO\n"));
		if (UNMARSHALLING(ps))
			hdr->ctr->pac.logon_info = PRS_ALLOC_MEM(ps, PAC_LOGON_INFO, 1);
				prs_alloc_mem(ps, sizeof(PAC_LOGON_INFO));
		if (!hdr->ctr->pac.logon_info) {
			DEBUG(3, ("No memory available\n"));
			return False;

	case PAC_TYPE_SERVER_CHECKSUM:
		DEBUG(5, ("PAC_TYPE_SERVER_CHECKSUM\n"));
		if (UNMARSHALLING(ps))
			hdr->ctr->pac.srv_cksum = PRS_ALLOC_MEM(ps, PAC_SIGNATURE_DATA, 1);
				prs_alloc_mem(ps, sizeof(PAC_SIGNATURE_DATA));
		if (!hdr->ctr->pac.srv_cksum) {
			DEBUG(3, ("No memory available\n"));
			return False;

	case PAC_TYPE_PRIVSVR_CHECKSUM:
		DEBUG(5, ("PAC_TYPE_PRIVSVR_CHECKSUM\n"));
		if (UNMARSHALLING(ps))
			hdr->ctr->pac.privsrv_cksum = PRS_ALLOC_MEM(ps, PAC_SIGNATURE_DATA, 1);
				prs_alloc_mem(ps, sizeof(PAC_SIGNATURE_DATA));
		if (!hdr->ctr->pac.privsrv_cksum) {
			DEBUG(3, ("No memory available\n"));
			return False;

	case PAC_TYPE_UNKNOWN_10:
		DEBUG(5, ("PAC_TYPE_UNKNOWN_10\n"));
		if (UNMARSHALLING(ps))
			hdr->ctr->pac.type_10 = PRS_ALLOC_MEM(ps, UNKNOWN_TYPE_10, 1);
				prs_alloc_mem(ps, sizeof(UNKNOWN_TYPE_10));
		if (!hdr->ctr->pac.type_10) {
			DEBUG(3, ("No memory available\n"));
			return False;

		return False;

	if (UNMARSHALLING(ps) && data->num_buffers > 0) {
		if ((data->pac_info_hdr_ptr = PRS_ALLOC_MEM(ps, PAC_INFO_HDR, data->num_buffers)) == NULL) {
		     prs_alloc_mem(ps, sizeof(PAC_INFO_HDR) * 
				   data->num_buffers)) == NULL) {
			return False;
		}
	}


	data_blob_free(&pac_data_blob);

	pac_data = TALLOC_ZERO_P(ctx, PAC_DATA);
	pac_io_pac_data("pac data", pac_data, &ps, 0);

	prs_mem_free(&ps);

Lines 546-552 Link Here

(-)samba-3.0.9-orig/source/libads/kerberos_keytab.c (-1 / +1 lines)
546	if (!found) {	546	if (!found) {
547	goto done;	547	goto done;
548	}	548	}
549	oldEntries = (char *) malloc(found sizeof(char *));	549	oldEntries = SMB_MALLOC_ARRAY(char *, found );
550	if (!oldEntries) {	550	if (!oldEntries) {
551	DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));	551	DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));
552	ret = -1;	552	ret = -1;

Lines 174-180 Link Here

(-)samba-3.0.9-orig/source/libads/kerberos_verify.c (-1 / +1 lines)
174	for (i=0;enctypes[i];i++) {	174	for (i=0;enctypes[i];i++) {
175	krb5_keyblock *key = NULL;	175	krb5_keyblock *key = NULL;
176		176
177	if (!(key = (krb5_keyblock )malloc(sizeof(key)))) {	177	if (!(key = SMB_MALLOC_P(krb5_keyblock))) {
178	goto out;	178	goto out;
179	}	179	}
180		180




	DATA_BLOB ret;


	princ = SMB_STRDUP(principal);

	if ((c = strchr_m(princ, '/')) == NULL) {
	    c = princ; 

		return ret;
	}

	packet->data = (char *)SMB_MALLOC(ap_req->length + cipherpw.length + 6);
	if (!packet->data)
		return -1;


	free(chpw_req.data);

	chpw_rep.length = 1500;
	chpw_rep.data = (char *) SMB_MALLOC(chpw_rep.length);
	if (!chpw_rep.data) {
	        close(sock);
	        free(ap_req.data);

    /* We have to obtain an INITIAL changepw ticket for changing password */
    asprintf(&chpw_princ, "kadmin/changepw@%s",
				(char *) krb5_princ_realm(context, princ));
    password = SMB_STRDUP(oldpw);
    ret = krb5_get_init_creds_password(context, &creds, princ, password,
					   kerb_prompter, NULL, 
					   0, chpw_princ, &opts);




	DEBUG(5,("ads_try_connect: trying ldap server '%s' port %u\n", server, port));

	/* this copes with inet_ntoa brokenness */
	srv = SMB_STRDUP(server);

	ads->ld = ldap_open_with_timeout(srv, port, lp_ldap_timeout());
	if (!ads->ld) {

	}

	if (!ads->auth.realm) {
		ads->auth.realm = SMB_STRDUP(ads->config.realm);
	}

	if (!ads->auth.kdc_server) {
		ads->auth.kdc_server = SMB_STRDUP(inet_ntoa(ads->ldap_ip));
	}

#if KRB5_DNS_HACK


	if (!in_val) return NULL;

	value = TALLOC_ZERO_P(ctx, struct berval);
	if (value == NULL)
		return NULL;
	if (in_val->bv_len == 0) return value;

	value->bv_len = in_val->bv_len;
	value->bv_val = TALLOC_MEMDUP(ctx, in_val->bv_val, in_val->bv_len);
	return value;
}


	int i;
       
	if (!in_vals) return NULL;
	for (i=0; in_vals[i]; i++)
		; /* count values */
	values = TALLOC_ZERO_ARRAY(ctx, struct berval *, i+1);
	if (!values) return NULL;

	for (i=0; in_vals[i]; i++) {

	int i;
       
	if (!in_vals) return NULL;
	for (i=0; in_vals[i]; i++)
		; /* count values */
	values = TALLOC_ZERO_ARRAY(ctx, char *, i+1);
	if (!values) return NULL;

	for (i=0; in_vals[i]; i++) {

	int i;
       
	if (!in_vals) return NULL;
	for (i=0; in_vals[i]; i++)
		; /* count values */
	values = TALLOC_ZERO_ARRAY(ctx, char *, i+1);
	if (!values) return NULL;

	for (i=0; in_vals[i]; i++) {

#define ADS_MODLIST_ALLOC_SIZE 10
	LDAPMod **mods;
	
	if ((mods = TALLOC_ZERO_ARRAY(ctx, LDAPMod *, ADS_MODLIST_ALLOC_SIZE + 1)))
					     (ADS_MODLIST_ALLOC_SIZE + 1))))
		/* -1 is safety to make sure we don't go over the end.
		   need to reset it to NULL before doing ldap modify */
		mods[ADS_MODLIST_ALLOC_SIZE] = (LDAPMod *) -1;

	for (curmod=0; modlist[curmod] && modlist[curmod] != (LDAPMod *) -1;
	     curmod++);
	if (modlist[curmod] == (LDAPMod *) -1) {
		if (!(modlist = TALLOC_REALLOC_ARRAY(ctx, modlist, LDAPMod *,
				curmod+ADS_MODLIST_ALLOC_SIZE+1)))
			return ADS_ERROR(LDAP_NO_MEMORY);
		memset(&modlist[curmod], 0, 
		       ADS_MODLIST_ALLOC_SIZE*sizeof(LDAPMod *));

		*mods = modlist;
	}
		
	if (!(modlist[curmod] = TALLOC_ZERO_P(ctx, LDAPMod)))
		return ADS_ERROR(LDAP_NO_MEMORY);
	modlist[curmod]->mod_type = talloc_strdup(ctx, name);
	if (mod_op & LDAP_MOD_BVALUES) {

		ret = ads_default_ou_string(ads, WELL_KNOWN_GUID_COMPUTERS);

		/* samba4 might not yet respond to a wellknownobject-query */
		return ret ? ret : SMB_STRDUP("cn=Computers");
	}
	
	if (strequal(org_unit, "Computers")) {
		return SMB_STRDUP("cn=Computers");
	}

	return ads_build_path(org_unit, "\\/", "ou=", 1);

	for (i=1; i < new_ln; i++) {
		char *s;
		asprintf(&s, "%s,%s", ret, wkn_dn_exp[i]);
		ret = SMB_STRDUP(s);
		free(s);
	}


	char *machine;

	/* machine name must be lowercase */
	machine = SMB_STRDUP(machine_name);
	strlower_m(machine);

	/*

	int rc;

	/* hostname must be lowercase */
	host = SMB_STRDUP(hostname);
	strlower_m(host);

	status = ads_find_machine_acct(ads, &res, host);

	if (!(mods = ads_init_mods(ctx))) return ADS_ERROR(LDAP_NO_MEMORY);

	bval.bv_len = prs_offset(&ps_wire);
	bval.bv_val = TALLOC(ctx, bval.bv_len);
	if (!bval.bv_val) {
		ret = ADS_ERROR(LDAP_NO_MEMORY);
		goto ads_set_sd_error;


	*num_values = ldap_count_values(values);

	ret = TALLOC_ARRAY(mem_ctx, char *, *num_values + 1);
	if (!ret) {
		ldap_value_free(values);
		return NULL;

		return NULL;
	}

	strings = TALLOC_REALLOC_ARRAY(mem_ctx, current_strings, char *,
				 *num_strings + num_new_strings);
				 (*num_strings + num_new_strings));
	
	if (strings == NULL) {
		ldap_memfree(range_attr);

	for (i=0; values[i]; i++)
		/* nop */ ;

	(*sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, i);
	if (!(*sids)) {
		ldap_value_free_len(values);
		return 0;


	SAFE_FREE(ads->config.ldap_server_name);

	ads->config.ldap_server_name = SMB_STRDUP(p+1);
	p = strchr(ads->config.ldap_server_name, '$');
	if (!p || p[1] != '@') {
		talloc_destroy(ctx);

	SAFE_FREE(ads->config.realm);
	SAFE_FREE(ads->config.bind_path);

	ads->config.realm = SMB_STRDUP(p+2);
	ads->config.bind_path = ads_build_dn(ads->config.realm);

	DEBUG(3,("got ldap server name %s@%s, using bind path: %s\n", 

Lines 161-170 Link Here

(-)samba-3.0.9-orig/source/libads/ldap_printer.c (-3 / +2 lines)
161	};	161	};
162		162
163	if (num_vals) {	163	if (num_vals) {
164	str_values = talloc(ctx,	164	str_values = TALLOC_ARRAY(ctx, char *, num_vals + 1);
165	(num_vals + 1) * sizeof(smb_ucs2_t *));
166	memset(str_values, '\0',	165	memset(str_values, '\0',
167	(num_vals + 1) * sizeof(smb_ucs2_t *));	166	(num_vals + 1) * sizeof(char *));
168		167
169	cur_str = (smb_ucs2_t *) value->data_p;	168	cur_str = (smb_ucs2_t *) value->data_p;
170	for (i=0; i < num_vals; i++)	169	for (i=0; i < num_vals; i++)

Lines 42-48 Link Here

(-)samba-3.0.9-orig/source/libads/ldap_utils.c (-1 / +1 lines)
42	return ADS_ERROR(LDAP_SERVER_DOWN);	42	return ADS_ERROR(LDAP_SERVER_DOWN);
43	}	43	}
44		44
45	bp = strdup(bind_path);	45	bp = SMB_STRDUP(bind_path);
46		46
47	if (!bp) {	47	if (!bp) {
48	return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);	48	return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);

Lines 374-380 Link Here

(-)samba-3.0.9-orig/source/libads/sasl.c (-1 / +1 lines)
374		374
375	gss_release_buffer(&minor_status, &output_token);	375	gss_release_buffer(&minor_status, &output_token);
376		376
377	output_token.value = malloc(strlen(ads->config.bind_path) + 8);	377	output_token.value = SMB_MALLOC(strlen(ads->config.bind_path) + 8);
378	p = output_token.value;	378	p = output_token.value;
379		379
380	p++ = 1; / no sign & seal selection */	380	p++ = 1; / no sign & seal selection */




	if (data->has_error) return False;
	if (data->length < data->ofs+len) {
		uint8 *newp;
		newp = SMB_REALLOC(data->data, data->ofs+len);
		if (!newp) {
			SAFE_FREE(data->data);
			data->has_error = True;

	struct nesting *nesting;

	asn1_write_uint8(data, tag);
	nesting = SMB_MALLOC_P(struct nesting);
	if (!nesting) {
		data->has_error = True;
		return False;

		data->has_error = True;
		return False;
	}
	nesting = SMB_MALLOC_P(struct nesting);
	if (!nesting) {
		data->has_error = True;
		return False;


	asn1_end_tag(data);

	*OID = SMB_STRDUP(oid_str);

	return !data->has_error;
}

		data->has_error = True;
		return False;
	}
	*s = SMB_MALLOC(len+1);
	if (! *s) {
		data->has_error = True;
		return False;

Lines 253-259 Link Here

(-)samba-3.0.9-orig/source/libsmb/clientgen.c (-3 / +3 lines)
253	}	253	}
254		254
255	if (!cli) {	255	if (!cli) {
256	cli = (struct cli_state )malloc(sizeof(cli));	256	cli = SMB_MALLOC_P(struct cli_state);
257	if (!cli)	257	if (!cli)
258	return NULL;	258	return NULL;
259	ZERO_STRUCTP(cli);	259	ZERO_STRUCTP(cli);
Lines 275-282 Link Here
275	cli->timeout = 20000; /* Timeout is in milliseconds. */	275	cli->timeout = 20000; /* Timeout is in milliseconds. */
276	cli->bufsize = CLI_BUFFER_SIZE+4;	276	cli->bufsize = CLI_BUFFER_SIZE+4;
277	cli->max_xmit = cli->bufsize;	277	cli->max_xmit = cli->bufsize;
278	cli->outbuf = (char *)malloc(cli->bufsize+SAFETY_MARGIN);	278	cli->outbuf = (char *)SMB_MALLOC(cli->bufsize+SAFETY_MARGIN);
279	cli->inbuf = (char *)malloc(cli->bufsize+SAFETY_MARGIN);	279	cli->inbuf = (char *)SMB_MALLOC(cli->bufsize+SAFETY_MARGIN);
280	cli->oplock_handler = cli_oplock_ack;	280	cli->oplock_handler = cli_oplock_ack;
281	cli->case_sensitive = False;	281	cli->case_sensitive = False;
282		282




		pstring path2;
		clistr_pull(cli, path2, p, 
			    sizeof(path2), len, STR_ASCII);
		*tmp_path = SMB_STRDUP(path2);
	}

	return SVAL(cli->inbuf,smb_vwv0);

	size_t ea_namelen = strlen(ea_name);

	data_len = 4 + 4 + ea_namelen + 1 + ea_len;
	data = SMB_MALLOC(data_len);
	if (!data) {
		return False;
	}

		goto out;
	}

	ea_list = TALLOC_ARRAY(ctx, struct ea_struct, num_eas);
	if (!ea_list) {
		goto out;
	}

Lines 282-288 Link Here

(-)samba-3.0.9-orig/source/libsmb/clilist.c (-2 / +2 lines)
282	}	282	}
283		283
284	/* and add them to the dirlist pool */	284	/* and add them to the dirlist pool */
285	tdl = Realloc(dirlist,dirlist_len + data_len);	285	tdl = SMB_REALLOC(dirlist,dirlist_len + data_len);
286		286
287	if (!tdl) {	287	if (!tdl) {
288	DEBUG(0,("cli_list_new: Failed to expand dirlist\n"));	288	DEBUG(0,("cli_list_new: Failed to expand dirlist\n"));
Lines 413-419 Link Here
413		413
414	first = False;	414	first = False;
415		415
416	tdl = Realloc(dirlist,(num_received + received)*DIR_STRUCT_SIZE);	416	tdl = SMB_REALLOC(dirlist,(num_received + received)*DIR_STRUCT_SIZE);
417		417
418	if (!tdl) {	418	if (!tdl) {
419	DEBUG(0,("cli_list_old: failed to expand dirlist"));	419	DEBUG(0,("cli_list_old: failed to expand dirlist"));




			goto cleanup;
		}

		if ((tmp_list_ent=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_LIST))==NULL) {
			DEBUG(0,("talloc_zero() failed\n"));
			return (-1);
		}

		if ((tmp_list_ent->quotas=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_STRUCT))==NULL) {
			DEBUG(0,("talloc_zero() failed\n"));
			return (-1);
		}

				goto cleanup;
			}

			if ((tmp_list_ent=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_LIST))==NULL) {
				DEBUG(0,("talloc_zero() failed\n"));
				talloc_destroy(mem_ctx);
				goto cleanup;
			}
	
			if ((tmp_list_ent->quotas=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_STRUCT))==NULL) {
				DEBUG(0,("talloc_zero() failed\n"));
				talloc_destroy(mem_ctx);
				goto cleanup;

Lines 256-263 Link Here

(-)samba-3.0.9-orig/source/libsmb/clireadwrite.c (-2 / +2 lines)
256	BOOL bigoffset = False;	256	BOOL bigoffset = False;
257		257
258	if (size > cli->bufsize) {	258	if (size > cli->bufsize) {
259	cli->outbuf = realloc(cli->outbuf, size + 1024);	259	cli->outbuf = SMB_REALLOC(cli->outbuf, size + 1024);
260	cli->inbuf = realloc(cli->inbuf, size + 1024);	260	cli->inbuf = SMB_REALLOC(cli->inbuf, size + 1024);
261	if (cli->outbuf == NULL \|\| cli->inbuf == NULL)	261	if (cli->outbuf == NULL \|\| cli->inbuf == NULL)
262	return False;	262	return False;
263	cli->bufsize = size + 1024;	263	cli->bufsize = size + 1024;





	/* allocate it */
	if (total_data!=0) {
		tdata = SMB_REALLOC(*data,total_data);
		if (!tdata) {
			DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
			cli_signing_trans_stop(cli);

	}

	if (total_param!=0) {
		tparam = SMB_REALLOC(*param,total_param);
		if (!tparam) {
			DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
			cli_signing_trans_stop(cli);


	/* allocate it */
	if (total_data) {
		tdata = SMB_REALLOC(*data,total_data);
		if (!tdata) {
			DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
			cli_signing_trans_stop(cli);

	}

	if (total_param) {
		tparam = SMB_REALLOC(*param,total_param);
		if (!tparam) {
			DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
			cli_signing_trans_stop(cli);

Lines 115-122 Link Here

(-)samba-3.0.9-orig/source/libsmb/conncache.c (-2 / +1 lines)
115		115
116	/* Create negative lookup cache entry for this domain and controller */	116	/* Create negative lookup cache entry for this domain and controller */
117		117
118	if ( !(fcc = (struct failed_connection_cache *)malloc(sizeof(struct failed_connection_cache))) )	118	if ( !(fcc = SMB_MALLOC_P(struct failed_connection_cache)) ) {
119	{
120	DEBUG(0, ("malloc failed in add_failed_connection_entry!\n"));	119	DEBUG(0, ("malloc failed in add_failed_connection_entry!\n"));
121	return;	120	return;
122	}	121	}




{
	struct smbc_server_cache * srvcache = NULL;

	if (!(srvcache = SMB_MALLOC_P(struct smbc_server_cache))) {
		errno = ENOMEM;
		DEBUG(3, ("Not enough space for server cache allocation\n"));
		return 1;


	srvcache->server = new;

	srvcache->server_name = SMB_STRDUP(server);
	if (!srvcache->server_name) {
		errno = ENOMEM;
		goto failed;
	}

	srvcache->share_name = SMB_STRDUP(share);
	if (!srvcache->share_name) {
		errno = ENOMEM;
		goto failed;
	}

	srvcache->workgroup = SMB_STRDUP(workgroup);
	if (!srvcache->workgroup) {
		errno = ENOMEM;
		goto failed;
	}

	srvcache->username = SMB_STRDUP(username);
	if (!srvcache->username) {
		errno = ENOMEM;
		goto failed;




    }

    /* make a copy of the old one */
    new_usegment = (char*)SMB_MALLOC( old_length * 3 + 1 );

    while( i < old_length ) {
	int bReencode = False;

	 * Let's find a free server_fd 
	 */

	srv = SMB_MALLOC_P(SMBCSRV);
	if (!srv) {
		errno = ENOMEM;
		goto failed;

                        return NULL;
                }

                ipc_srv = SMB_MALLOC_P(SMBCSRV);
                if (!ipc_srv) {
                        errno = ENOMEM;
                        cli_shutdown(ipc_cli);

	}
	else {
	  
		file = SMB_MALLOC_P(SMBCFILE);

		if (!file) {


		/* Fill in file struct */

		file->cli_fd  = fd;
		file->fname   = SMB_STRDUP(fname);
		file->srv     = srv;
		file->offset  = 0;
		file->file    = True;


	size = sizeof(struct smbc_dirent) + u_name_len + u_comment_len + 1;
    
	dirent = SMB_MALLOC(size);

	if (!dirent) {



	if (dir->dir_list == NULL) {

		dir->dir_list = SMB_MALLOC_P(struct smbc_dir_list);
		if (!dir->dir_list) {

			SAFE_FREE(dirent);

	}
	else {

		dir->dir_end->next = SMB_MALLOC_P(struct smbc_dir_list);
		
		if (!dir->dir_end->next) {
			


	pstrcpy(workgroup, context->workgroup);

	dir = SMB_MALLOC_P(SMBCFILE);

	if (!dir) {


	ZERO_STRUCTP(dir);

	dir->cli_fd   = 0;
	dir->fname    = SMB_STRDUP(fname);
	dir->srv      = NULL;
	dir->offset   = 0;
	dir->file     = False;

		return True;
	}

	aces = SMB_CALLOC_ARRAY(SEC_ACE, 1+(*the_acl)->num_aces);
	memcpy(aces, (*the_acl)->ace, (*the_acl)->num_aces * sizeof(SEC_ACE));
	memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
	new = make_sec_acl(ctx,(*the_acl)->revision,1+(*the_acl)->num_aces, aces);

		}

		if (StrnCaseCmp(tok,"OWNER:", 6) == 0) {
			owner_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
			if (!owner_sid ||
			    !convert_string_to_sid(ipc_cli, pol,
                                                   numeric,

		}

		if (StrnCaseCmp(tok,"OWNER+:", 7) == 0) {
			owner_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
			if (!owner_sid ||
			    !convert_string_to_sid(ipc_cli, pol,
                                                   False,

		}

		if (StrnCaseCmp(tok,"GROUP:", 6) == 0) {
			grp_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
			if (!grp_sid ||
			    !convert_string_to_sid(ipc_cli, pol,
                                                   numeric,

		}

		if (StrnCaseCmp(tok,"GROUP+:", 7) == 0) {
			grp_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
			if (!grp_sid ||
			    !convert_string_to_sid(ipc_cli, pol,
                                                   False,

{
        SMBCCTX * context;

        context = SMB_MALLOC_P(SMBCCTX);
        if (!context) {
                errno = ENOMEM;
                return NULL;


        ZERO_STRUCTP(context);

        context->internal = SMB_MALLOC_P(struct smbc_internal_data);
        if (!context->internal) {
                errno = ENOMEM;
                return NULL;

                 */
                user = getenv("USER");
                /* walk around as "guest" if no username can be found */
                if (!user) context->user = SMB_STRDUP("guest");
                else context->user = SMB_STRDUP(user);
        }

        if (!context->netbios_name) {

                 * back on constructing our netbios name from our hostname etc
                 */
                if (global_myname()) {
                        context->netbios_name = SMB_STRDUP(global_myname());
                }
                else {
                        /*
                         * Hmmm, I want to get hostname as well, but I am too lazy for the moment
                         */
                        pid = sys_getpid();
                        context->netbios_name = SMB_MALLOC(17);
                        if (!context->netbios_name) {
                                errno = ENOMEM;
                                return NULL;


        if (!context->workgroup) {
                if (lp_workgroup()) {
                        context->workgroup = SMB_STRDUP(lp_workgroup());
                }
                else {
                        /* TODO: Think about a decent default workgroup */
                        context->workgroup = SMB_STRDUP("samba");
                }
        }


Lines 73-79 Link Here

(-)samba-3.0.9-orig/source/libsmb/libsmb_compat.c (-1 / +1 lines)
73	return -1;	73	return -1;
74	}	74	}
75		75
76	f = malloc(sizeof(struct smbc_compat_fdlist));	76	f = SMB_MALLOC_P(struct smbc_compat_fdlist);
77	if (!f) {	77	if (!f) {
78	errno = ENOMEM;	78	errno = ENOMEM;
79	return -1;	79	return -1;




	if (*num_names == 0)
		return NULL;

	ret = SMB_MALLOC_ARRAY(struct node_status,*num_names);
	if (!ret)
		return NULL;


				continue;
			}
			
			tmp_ip_list = SMB_REALLOC_ARRAY( ip_list, struct in_addr,
						(*count) + nmb2->answers->rdlength/6 );
			
			if (!tmp_ip_list) {
				DEBUG(0,("name_query: Realloc failed.\n"));

		return False;
		
	/* copy the ip address; port will be PORT_NONE */
	if ( (*return_iplist = SMB_MALLOC_ARRAY(struct ip_service, count)) == NULL ) {
		DEBUG(0,("convert_ip2service: malloc failed for %d enetries!\n", count ));
		return False;
	}

		if ((name_type2 != -1) && (name_type != name_type2))
			continue;

		*return_iplist = SMB_REALLOC_ARRAY((*return_iplist), struct ip_service,
					(*return_count)+1);

		if ((*return_iplist) == NULL) {
			DEBUG(3,("resolve_lmhosts: malloc fail !\n"));

	if (((hp = sys_gethostbyname(name)) != NULL) && (hp->h_addr != NULL)) {
		struct in_addr return_ip;
		putip((char *)&return_ip,(char *)hp->h_addr);
		*return_iplist = SMB_MALLOC_P(struct ip_service);
		if(*return_iplist == NULL) {
			DEBUG(3,("resolve_hosts: malloc fail !\n"));
			return False;

			return False;
				
		count = count_chars(list, ' ') + 1;
		if ( (*return_iplist = SMB_MALLOC_ARRAY(struct ip_service, count)) == NULL ) {
			DEBUG(0,("resolve_hosts: malloc failed for %d entries\n", count ));
			return False;
		}


	if (allzeros || allones || is_address) {
  
		if ( (*return_iplist = SMB_MALLOC_P(struct ip_service)) == NULL ) {
			DEBUG(0,("internal_resolve_name: malloc fail !\n"));
			return False;
		}

			return False;
		}
		
		if ( (return_iplist = SMB_MALLOC_ARRAY(struct ip_service, num_addresses)) == NULL ) {
				malloc(num_addresses * sizeof(struct ip_service))) == NULL ) {
			DEBUG(3,("get_dc_list: malloc fail !\n"));
			return False;
		}




{
	int i;

	*recs = SMB_MALLOC_ARRAY(struct res_rec, count);
	if (!*recs)
		return(False);


	struct nmb_packet *copy_nmb;
	struct packet_struct *pkt_copy;

	if(( pkt_copy = SMB_MALLOC_P(struct packet_struct)) == NULL) {
		DEBUG(0,("copy_nmb_packet: malloc fail.\n"));
		return NULL;
	}

	/* Now copy any resource records. */

	if (nmb->answers) {
		if((copy_nmb->answers = SMB_MALLOC_ARRAY(struct res_rec,nmb->header.ancount)) == NULL)
					malloc(nmb->header.ancount * sizeof(struct res_rec))) == NULL)
			goto free_and_exit;
		memcpy((char *)copy_nmb->answers, (char *)nmb->answers, 
				nmb->header.ancount * sizeof(struct res_rec));
	}
	if (nmb->nsrecs) {
		if((copy_nmb->nsrecs = SMB_MALLOC_ARRAY(struct res_rec, nmb->header.nscount)) == NULL)
					malloc(nmb->header.nscount * sizeof(struct res_rec))) == NULL)
			goto free_and_exit;
		memcpy((char *)copy_nmb->nsrecs, (char *)nmb->nsrecs, 
				nmb->header.nscount * sizeof(struct res_rec));
	}
	if (nmb->additional) {
		if((copy_nmb->additional = SMB_MALLOC_ARRAY(struct res_rec, nmb->header.arcount)) == NULL)
					malloc(nmb->header.arcount * sizeof(struct res_rec))) == NULL)
			goto free_and_exit;
		memcpy((char *)copy_nmb->additional, (char *)nmb->additional, 
				nmb->header.arcount * sizeof(struct res_rec));

{ 
	struct packet_struct *pkt_copy;

	if(( pkt_copy = SMB_MALLOC_P(struct packet_struct)) == NULL) {
		DEBUG(0,("copy_dgram_packet: malloc fail.\n"));
		return NULL;
	}

	struct packet_struct *p;
	BOOL ok=False;

	p = SMB_MALLOC_P(struct packet_struct);
	if (!p)
		return(NULL);


Lines 766-772 Link Here

(-)samba-3.0.9-orig/source/libsmb/ntlmssp.c (-2 / +2 lines)
766		766
767	mem_ctx = talloc_init("NTLMSSP context");	767	mem_ctx = talloc_init("NTLMSSP context");
768		768
769	ntlmssp_state = talloc_zero(mem_ctx, sizeof(*ntlmssp_state));	769	*ntlmssp_state = TALLOC_ZERO_P(mem_ctx, NTLMSSP_STATE);
770	if (!*ntlmssp_state) {	770	if (!*ntlmssp_state) {
771	DEBUG(0,("ntlmssp_server_start: talloc failed!\n"));	771	DEBUG(0,("ntlmssp_server_start: talloc failed!\n"));
772	talloc_destroy(mem_ctx);	772	talloc_destroy(mem_ctx);
Lines 1075-1081 Link Here
1075		1075
1076	mem_ctx = talloc_init("NTLMSSP Client context");	1076	mem_ctx = talloc_init("NTLMSSP Client context");
1077		1077
1078	ntlmssp_state = talloc_zero(mem_ctx, sizeof(*ntlmssp_state));	1078	*ntlmssp_state = TALLOC_ZERO_P(mem_ctx, NTLMSSP_STATE);
1079	if (!*ntlmssp_state) {	1079	if (!*ntlmssp_state) {
1080	DEBUG(0,("ntlmssp_client_start: talloc failed!\n"));	1080	DEBUG(0,("ntlmssp_client_start: talloc failed!\n"));
1081	talloc_destroy(mem_ctx);	1081	talloc_destroy(mem_ctx);

Lines 188-194 Link Here

(-)samba-3.0.9-orig/source/libsmb/samlogon_cache.c (-1 / +1 lines)
188		188
189	if ( data.dptr ) {	189	if ( data.dptr ) {
190		190
191	if ( (user = (NET_USER_INFO_3*)malloc(sizeof(NET_USER_INFO_3))) == NULL )	191	if ( (user = SMB_MALLOC_P(NET_USER_INFO_3)) == NULL )
192	return NULL;	192	return NULL;
193		193
194	prs_init( &ps, 0, mem_ctx, UNMARSHALL );	194	prs_init( &ps, 0, mem_ctx, UNMARSHALL );




		}
	}

	t = SMB_XMALLOC_P(struct outstanding_packet_lookup);
	ZERO_STRUCTP(t);

	t->mid = mid;

		return False;
	}

	data = SMB_XMALLOC_P(struct smb_basic_signing_context);
	memset(data, '\0', sizeof(*data));

	cli->sign_info.signing_context = data;

	if (!cli->sign_info.doing_signing || !data)
		return;

	data->trans_info = SMB_XMALLOC_P(struct trans_info_context);
	ZERO_STRUCTP(data->trans_info);

	/* This ensures the sequence is pulled off the outstanding packet list */

	if (!data)
		return;

	data->trans_info = SMB_XMALLOC_P(struct trans_info_context);
	ZERO_STRUCTP(data->trans_info);

	data->trans_info->reply_seq_num = data->send_seq_num-1;

	
	srv_sign_info.doing_signing = True;

	data = SMB_XMALLOC_P(struct smb_basic_signing_context);
	memset(data, '\0', sizeof(*data));

	srv_sign_info.signing_context = data;




			asn1_start_tag(asn1, ASN1_CONTEXT(0));
			asn1_start_tag(asn1, ASN1_SEQUENCE(0));

			token->mechTypes = SMB_MALLOC_P(char *);
			for (i = 0; !asn1->has_error &&
				     0 < asn1_tag_remaining(asn1); i++) {
				token->mechTypes = 
					SMB_REALLOC_ARRAY(token->mechTypes, char *, i + 2);
						sizeof(*token->mechTypes));
				asn1_read_OID(asn1, token->mechTypes + i);
			}
			token->mechTypes[i] = NULL;

Lines 407-413 Link Here

(-)samba-3.0.9-orig/source/locking/brlock.c (-1 / +1 lines)
407	}	407	}
408		408
409	/* no conflicts - add it to the list of locks */	409	/* no conflicts - add it to the list of locks */
410	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(*locks));	410	tp = SMB_REALLOC(dbuf.dptr, dbuf.dsize + sizeof(*locks));
411	if (!tp) {	411	if (!tp) {
412	status = NT_STATUS_NO_MEMORY;	412	status = NT_STATUS_NO_MEMORY;
413	goto fail;	413	goto fail;




		pstrcat(fname, fsp->fsp_name);

		size = sizeof(*data) + sizeof(share_mode_entry) + strlen(fname) + 1;
		p = (char *)SMB_MALLOC(size);
		if (!p)
			return False;
		data = (struct locking_data *)p;

		fsp->fsp_name, data->u.num_share_mode_entries ));

	size = dbuf.dsize + sizeof(share_mode_entry);
	p = SMB_MALLOC(size);
	if (!p) {
		SAFE_FREE(dbuf.dptr);
		return False;

		/* we'll need to create a new record */

		size = sizeof(*data) + sizeof(deferred_open_entry) + strlen(fname) + 1;
		p = (char *)SMB_MALLOC(size);
		if (!p)
			return False;
		data = (struct deferred_open_data *)p;

		fname, data->u.num_deferred_open_entries ));

	size = dbuf.dsize + sizeof(deferred_open_entry);
	p = SMB_MALLOC(size);
	if (!p) {
		SAFE_FREE(dbuf.dptr);
		return False;





	dbuf = tdb_fetch(posix_pending_close_tdb, kbuf);

	tp = SMB_REALLOC(dbuf.dptr, dbuf.dsize + sizeof(int));
	if (!tp) {
		DEBUG(0,("add_fd_to_close_entry: Realloc fail !\n"));
		SAFE_FREE(dbuf.dptr);

	pl.size = size;
	pl.lock_type = lock_type;

	tp = SMB_REALLOC(dbuf.dptr, dbuf.dsize + sizeof(pl));
	if (!tp) {
		DEBUG(0,("add_posix_lock_entry: Realloc fail !\n"));
		goto fail;

        | l_curr|         | l_new   |
        +-------+         +---------+
**********************************************/
				struct lock_list *l_new = TALLOC_P(ctx, struct lock_list);
													sizeof(struct lock_list));

				if(l_new == NULL) {
					DEBUG(0,("posix_lock_list: talloc fail.\n"));

		return True; /* Not a fatal error. */
	}

	if ((ll = TALLOC_P(l_ctx, struct lock_list)) == NULL) {
		DEBUG(0,("set_posix_lock: unable to talloc unlock list.\n"));
		talloc_destroy(l_ctx);
		return True; /* Not a fatal error. */

		return True; /* Not a fatal error. */
	}

	if ((ul = TALLOC_P(ul_ctx, struct lock_list)) == NULL) {
		DEBUG(0,("release_posix_lock: unable to talloc unlock list.\n"));
		talloc_destroy(ul_ctx);
		return True; /* Not a fatal error. */




		}
	}

	if (!(new_list = SMB_CALLOC_ARRAY(name_compare_entry, (count == 0 ? 1 : count + 1))))
	  (count == 0 ? 1 : count + 1) * sizeof(name_compare_entry))))
		return;

	for (i = 0; i < count; i ++) {
		new_list[i].name    = SMB_STRDUP(cur_list[i].name);
		new_list[i].is_wild = cur_list[i].is_wild;
	}

	new_list[i].name    = SMB_STRDUP(APPLEDOUBLE);
	new_list[i].is_wild = False;

	free_namearray(*list);





	mode = S_IRUSR | S_IWUSR | S_IXUSR;

	tmp_str = SMB_STRDUP(dname);
	ALLOC_CHECK(tmp_str, done);
	tok_str = tmp_str;

	len = strlen(dname)+1;
	new_dir = (char *)SMB_MALLOC(len + 1);
	ALLOC_CHECK(new_dir, done);
	*new_dir = '\0';


	base = strrchr(file_name, '/');
	if (base == NULL) {
		base = file_name;
		path_name = SMB_STRDUP("/");
		ALLOC_CHECK(path_name, done);
	}
	else {
		path_name = SMB_STRDUP(file_name);
		ALLOC_CHECK(path_name, done);
		path_name[base - file_name] = '\0';
		base++;

	if (recycle_keep_dir_tree(handle) == True) {
		asprintf(&temp_name, "%s/%s", repository, path_name);
	} else {
		temp_name = SMB_STRDUP(repository);
	}
	ALLOC_CHECK(temp_name, done);





		return NULL;
	}

	dirp = SMB_MALLOC_P(shadow_copy_Dir);
	if (!dirp) {
		DEBUG(0,("shadow_copy_opendir: Out of memory\n"));
		SMB_VFS_NEXT_CLOSEDIR(handle,conn,p);


		DEBUG(10,("shadow_copy_opendir: not hide [%s]\n",d->d_name));

		r = SMB_REALLOC_ARRAY(dirp->dirs, struct dirent, dirp->num+1);
		if (!r) {
			DEBUG(0,("shadow_copy_opendir: Out of memory\n"));
			break;

			continue;
		}

		tlabels = (SHADOW_COPY_LABEL *)TALLOC_REALLOC(shadow_copy_data->mem_ctx,
									shadow_copy_data->labels,
									(shadow_copy_data->num_volumes+1)*sizeof(SHADOW_COPY_LABEL));
		if (tlabels == NULL) {

Lines 206-212 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_become_lmb.c (-2 / +2 lines)
206	struct userdata_struct *userdata;	206	struct userdata_struct *userdata;
207	size_t size = sizeof(struct userdata_struct) + sizeof(BOOL);	207	size_t size = sizeof(struct userdata_struct) + sizeof(BOOL);
208		208
209	if((userdata = (struct userdata_struct *)malloc(size)) == NULL) {	209	if((userdata = (struct userdata_struct *)SMB_MALLOC(size)) == NULL) {
210	DEBUG(0,("release_1d_name: malloc fail.\n"));	210	DEBUG(0,("release_1d_name: malloc fail.\n"));
211	return;	211	return;
212	}	212	}
Lines 545-551 Link Here
545	subrec->work_changed = True;	545	subrec->work_changed = True;
546		546
547	/* Setup the userdata_struct. */	547	/* Setup the userdata_struct. */
548	if((userdata = (struct userdata_struct *)malloc(size)) == NULL) {	548	if((userdata = (struct userdata_struct *)SMB_MALLOC(size)) == NULL) {
549	DEBUG(0,("become_local_master_browser: malloc fail.\n"));	549	DEBUG(0,("become_local_master_browser: malloc fail.\n"));
550	return;	550	return;
551	}	551	}

Lines 87-93 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_browserdb.c (-1 / +1 lines)
87	struct browse_cache_record *browc;	87	struct browse_cache_record *browc;
88	time_t now = time( NULL );	88	time_t now = time( NULL );
89		89
90	browc = (struct browse_cache_record )malloc( sizeof( browc ) );	90	browc = SMB_MALLOC_P(struct browse_cache_record);
91		91
92	if( NULL == browc ) {	92	if( NULL == browc ) {
93	DEBUG( 0, ("create_browser_in_lmb_cache: malloc fail !\n") );	93	DEBUG( 0, ("create_browser_in_lmb_cache: malloc fail !\n") );

Lines 324-330 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_browsesync.c (-1 / +1 lines)
324	/* Setup the userdata_struct - this is copied so we can use	324	/* Setup the userdata_struct - this is copied so we can use
325	a stack variable for this. */	325	a stack variable for this. */
326		326
327	if((userdata = (struct userdata_struct *)malloc(size)) == NULL) {	327	if((userdata = (struct userdata_struct *)SMB_MALLOC(size)) == NULL) {
328	DEBUG(0, ("find_domain_master_name_query_success: malloc fail.\n"));	328	DEBUG(0, ("find_domain_master_name_query_success: malloc fail.\n"));
329	return;	329	return;
330	}	330	}

Lines 516-522 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_incomingrequests.c (-1 / +1 lines)
516	if (namerec->data.num_ips == 1) {	516	if (namerec->data.num_ips == 1) {
517	prdata = rdata;	517	prdata = rdata;
518	} else {	518	} else {
519	if ((prdata = (char )malloc( namerec->data.num_ips 6 )) == NULL) {	519	if ((prdata = (char )SMB_MALLOC( namerec->data.num_ips 6 )) == NULL) {
520	DEBUG(0,("process_name_query_request: malloc fail !\n"));	520	DEBUG(0,("process_name_query_request: malloc fail !\n"));
521	return;	521	return;
522	}	522	}




	struct name_record *namerec;
	time_t time_now = time(NULL);

	namerec = SMB_MALLOC_P(struct name_record);
	if( NULL == namerec ) {
		DEBUG( 0, ( "add_name_to_subnet: malloc fail.\n" ) );
		return( NULL );
	}

	memset( (char *)namerec, '\0', sizeof(*namerec) );
	namerec->data.ip = SMB_MALLOC_ARRAY( struct in_addr, num_ips );
	if( NULL == namerec->data.ip ) {
		DEBUG( 0, ( "add_name_to_subnet: malloc fail when creating ip_flgs.\n" ) );
		ZERO_STRUCTP(namerec);

	if( find_ip_in_name_record( namerec, new_ip ) )
		return;
  
	new_list = SMB_MALLOC_ARRAY( struct in_addr, namerec->data.num_ips + 1);
	if( NULL == new_list ) {
		DEBUG(0,("add_ip_to_name_record: Malloc fail !\n"));
		return;

		/* Create an IP list containing all our known subnets. */

		num_ips = iface_count();
		iplist = SMB_MALLOC_ARRAY( struct in_addr, num_ips);
		if( NULL == iplist ) {
			DEBUG(0,("add_samba_names_to_subnet: Malloc fail !\n"));
			return;

Lines 306-312 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_nameregister.c (-2 / +2 lines)
306	struct in_addr wins_ip = wins_srv_ip_tag(tag, ip);	306	struct in_addr wins_ip = wins_srv_ip_tag(tag, ip);
307	fstring ip_str;	307	fstring ip_str;
308		308
309	userdata = (struct userdata_struct )malloc(sizeof(userdata) + strlen(tag) + 1);	309	userdata = (struct userdata_struct )SMB_MALLOC(sizeof(userdata) + strlen(tag) + 1);
310	if (!userdata) {	310	if (!userdata) {
311	DEBUG(0,("Failed to allocate userdata structure!\n"));	311	DEBUG(0,("Failed to allocate userdata structure!\n"));
312	return;	312	return;
Lines 423-429 Link Here
423	for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec) )	423	for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec) )
424	num_ips++;	424	num_ips++;
425		425
426	if((ip_list = (struct in_addr )malloc(num_ips sizeof(struct in_addr)))==NULL) {	426	if((ip_list = SMB_MALLOC_ARRAY(struct in_addr, num_ips))==NULL) {
427	DEBUG(0,("multihomed_register_name: malloc fail !\n"));	427	DEBUG(0,("multihomed_register_name: malloc fail !\n"));
428	return;	428	return;
429	}	429	}




	struct nmb_packet *nmb = NULL;

	/* Allocate the packet_struct we will return. */
	if((packet = SMB_MALLOC_P(struct packet_struct)) == NULL) {
		DEBUG(0,("create_and_init_netbios_packet: malloc fail (1) for packet struct.\n"));
		return NULL;
	}

{
	struct nmb_packet *nmb = &packet->packet.nmb;

	if((nmb->additional = SMB_MALLOC_P(struct res_rec)) == NULL) {
		DEBUG(0,("initiate_name_register_packet: malloc fail for additional record.\n"));
		return False;
	}

	DEBUG(6,("Refreshing name %s IP %s with WINS server %s using tag '%s'\n",
		 nmb_namestr(nmbname), ip_str, inet_ntoa(wins_ip), tag));

	userdata = (struct userdata_struct *)SMB_MALLOC(sizeof(*userdata) + strlen(tag) + 1);
	if (!userdata) {
		DEBUG(0,("Failed to allocate userdata structure!\n"));
		return;

	struct subnet_record *subrec = NULL;
	int count = 0;
	int num = 0;
	fd_set *pset = SMB_MALLOC_P(fd_set);

	if(pset == NULL) {
		DEBUG(0,("create_listen_fdset: malloc fail !\n"));

		return True;
	}

	if((sock_array = SMB_MALLOC_ARRAY(int, (count*2) + 2)) == NULL) {
		DEBUG(0,("create_listen_fdset: malloc fail for socket array.\n"));
		return True;
	}

Lines 577-584 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_processlogon.c (-2 / +1 lines)
577	return;	577	return;
578	}	578	}
579		579
580	db_info = (struct sam_database_info *)	580	db_info = SMB_MALLOC_ARRAY(struct sam_database_info, db_count);
581	malloc(sizeof(struct sam_database_info) * db_count);
582		581
583	if (db_info == NULL) {	582	if (db_info == NULL) {
584	DEBUG(3, ("out of memory allocating info for %d databases\n", db_count));	583	DEBUG(3, ("out of memory allocating info for %d databases\n", db_count));

Lines 105-111 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_responserecordsdb.c (-2 / +2 lines)
105	struct response_record *rrec;	105	struct response_record *rrec;
106	struct nmb_packet *nmb = &p->packet.nmb;	106	struct nmb_packet *nmb = &p->packet.nmb;
107		107
108	if (!(rrec = (struct response_record )malloc(sizeof(rrec)))) {	108	if (!(rrec = SMB_MALLOC_P(struct response_record))) {
109	DEBUG(0,("make_response_queue_record: malloc fail for response_record.\n"));	109	DEBUG(0,("make_response_queue_record: malloc fail for response_record.\n"));
110	return NULL;	110	return NULL;
111	}	111	}
Lines 133-139 Link Here
133	} else {	133	} else {
134	/* Primitive userdata, do a memcpy. */	134	/* Primitive userdata, do a memcpy. */
135	if((rrec->userdata = (struct userdata_struct *)	135	if((rrec->userdata = (struct userdata_struct *)
136	malloc(sizeof(struct userdata_struct)+userdata->userdata_len)) == NULL) {	136	SMB_MALLOC(sizeof(struct userdata_struct)+userdata->userdata_len)) == NULL) {
137	DEBUG(0,("make_response_queue_record: malloc fail for userdata.\n"));	137	DEBUG(0,("make_response_queue_record: malloc fail for userdata.\n"));
138	ZERO_STRUCTP(rrec);	138	ZERO_STRUCTP(rrec);
139	SAFE_FREE(rrec);	139	SAFE_FREE(rrec);

Lines 137-143 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_serverlistdb.c (-1 / +1 lines)
137	return NULL;	137	return NULL;
138	}	138	}
139		139
140	if((servrec = (struct server_record )malloc(sizeof(servrec))) == NULL) {	140	if((servrec = SMB_MALLOC_P(struct server_record)) == NULL) {
141	DEBUG(0,("create_server_entry_on_workgroup: malloc fail !\n"));	141	DEBUG(0,("create_server_entry_on_workgroup: malloc fail !\n"));
142	return NULL;	142	return NULL;
143	}	143	}

Lines 147-153 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_subnetdb.c (-2 / +2 lines)
147	set_socket_options(dgram_sock,"SO_BROADCAST");	147	set_socket_options(dgram_sock,"SO_BROADCAST");
148	}	148	}
149		149
150	subrec = (struct subnet_record )malloc(sizeof(subrec));	150	subrec = SMB_MALLOC_P(struct subnet_record);
151	if (!subrec) {	151	if (!subrec) {
152	DEBUG(0,("make_subnet: malloc fail !\n"));	152	DEBUG(0,("make_subnet: malloc fail !\n"));
153	close(nmb_sock);	153	close(nmb_sock);
Lines 160-166 Link Here
160	namelist_entry_compare,	160	namelist_entry_compare,
161	ubi_trOVERWRITE );	161	ubi_trOVERWRITE );
162		162
163	if((subrec->subnet_name = strdup(name)) == NULL) {	163	if((subrec->subnet_name = SMB_STRDUP(name)) == NULL) {
164	DEBUG(0,("make_subnet: malloc fail for subnet name !\n"));	164	DEBUG(0,("make_subnet: malloc fail for subnet name !\n"));
165	close(nmb_sock);	165	close(nmb_sock);
166	close(dgram_sock);	166	close(dgram_sock);

Lines 143-149 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_synclists.c (-1 / +1 lines)
143	return;	143	return;
144	}	144	}
145		145
146	s = (struct sync_record )malloc(sizeof(s));	146	s = SMB_MALLOC_P(struct sync_record);
147	if (!s) goto done;	147	if (!s) goto done;
148		148
149	ZERO_STRUCTP(s);	149	ZERO_STRUCTP(s);

Lines 59-65 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_winsproxy.c (-2 / +2 lines)
59	if(num_ips == 1) {	59	if(num_ips == 1) {
60	iplist = &ip;	60	iplist = &ip;
61	} else {	61	} else {
62	if((iplist = (struct in_addr )malloc( num_ips sizeof(struct in_addr) )) == NULL) {	62	if((iplist = SMB_MALLOC_ARRAY( struct in_addr, num_ips )) == NULL) {
63	DEBUG(0,("wins_proxy_name_query_request_success: malloc fail !\n"));	63	DEBUG(0,("wins_proxy_name_query_request_success: malloc fail !\n"));
64	return;	64	return;
65	}	65	}
Lines 131-137 Link Here
131	static struct userdata_struct wins_proxy_userdata_copy_fn(struct userdata_struct userdata)	131	static struct userdata_struct wins_proxy_userdata_copy_fn(struct userdata_struct userdata)
132	{	132	{
133	struct packet_struct p, copy_of_p;	133	struct packet_struct p, copy_of_p;
134	struct userdata_struct new_userdata = (struct userdata_struct )malloc( userdata->userdata_len );	134	struct userdata_struct new_userdata = (struct userdata_struct )SMB_MALLOC( userdata->userdata_len );
135		135
136	if(new_userdata == NULL)	136	if(new_userdata == NULL)
137	return NULL;	137	return NULL;




		}

		/* Allocate the space for the ip_list. */
		if((ip_list = SMB_MALLOC_ARRAY( struct in_addr, num_ips)) == NULL) {
			DEBUG(0,("initialise_wins: Malloc fail !\n"));
			return False;
		}

		return;
	}

	if((prdata = (char *)SMB_MALLOC( num_ips * 6 )) == NULL) {
		DEBUG(0,("process_wins_dmb_query_request: Malloc fail !.\n"));
		return;
	}

		if( namerec->data.num_ips == 1 ) {
			prdata = rdata;
		} else {
			if((prdata = (char *)SMB_MALLOC( namerec->data.num_ips * 6 )) == NULL) {
				DEBUG(0,("send_wins_name_query_response: malloc fail !\n"));
				return;
			}

Lines 71-77 Link Here

(-)samba-3.0.9-orig/source/nmbd/nmbd_workgroupdb.c (-1 / +1 lines)
71	struct subnet_record *subrec;	71	struct subnet_record *subrec;
72	int t = -1;	72	int t = -1;
73		73
74	if((work = (struct work_record )malloc(sizeof(work))) == NULL) {	74	if((work = SMB_MALLOC_P(struct work_record)) == NULL) {
75	DEBUG(0,("create_workgroup: malloc fail !\n"));	75	DEBUG(0,("create_workgroup: malloc fail !\n"));
76	return NULL;	76	return NULL;
77	}	77	}

Lines 326-332 Link Here

(-)samba-3.0.9-orig/source/nsswitch/wb_client.c (-1 / +1 lines)
326	/* Add group to list if necessary */	326	/* Add group to list if necessary */
327		327
328	if (!is_member) {	328	if (!is_member) {
329	tgr = (gid_t )Realloc(groups, sizeof(gid_t) ngroups + 1);	329	tgr = SMB_REALLOC_ARRAY(groups, gid_t, ngroups + 1);
330		330
331	if (!tgr) {	331	if (!tgr) {
332	errno = ENOMEM;	332	errno = ENOMEM;




		if ( num_gr_members ) {
			fstring buffer;
			
			gr_members = SMB_XMALLOC_ARRAY(char*, num_gr_members+1);
			
			i = 0;
			while ( next_token(&str, buffer, ",", sizeof(buffer)) && i<num_gr_members ) {

			member = grp->gr_mem[num_members];
		}
		
		gr_mem_str = SMB_XMALLOC_ARRAY(char, size);
	
		for ( i=0; i<num_members; i++ ) {
			snprintf( &gr_mem_str[idx], size-idx, "%s,", grp->gr_mem[i] );

	}
	else {
		/* no members */
		gr_mem_str = SMB_XMALLOC_ARRAY(char, sizeof(fstring));
		fstrcpy( gr_mem_str, "" );
	}


	}
	
	/* add one new slot and keep an extra for the terminating NULL */
	members = SMB_REALLOC_ARRAY( grp->gr_mem, char *, grp->num_gr_mem+2);
	if ( !members )
		return False;
		




	ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);

	SAFE_FREE(ads->auth.realm);
	ads->auth.realm = SMB_STRDUP(lp_realm());

	status = ads_connect(ads);
	if (!ADS_ERR_OK(status) || !ads->config.realm) {

		goto done;
	}

	(*info) = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, count);
	if (!*info) {
		status = NT_STATUS_NO_MEMORY;
		goto done;

			continue;
		}

		sid2 = TALLOC_P(mem_ctx, DOM_SID);
		if (!sid2) {
			status = NT_STATUS_NO_MEMORY;
			goto done;

		goto done;
	}

	(*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
	if (!*info) {
		status = NT_STATUS_NO_MEMORY;
		goto done;

		goto done;
	}
	
	sid2 = TALLOC_P(mem_ctx, DOM_SID);
	if (!sid2) {
		status = NT_STATUS_NO_MEMORY;
		goto done;

		goto done;
	}
	
	(*user_gids) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID *, count + 1);
	(*user_gids)[0] = primary_group;
	
	*num_groups = 1;

		
		if (sid_equal(&group_sid, primary_group)) continue;
		
		(*user_gids)[*num_groups] = TALLOC_P(mem_ctx, DOM_SID);
		if (!(*user_gids)[*num_groups]) {
			status = NT_STATUS_NO_MEMORY;
			goto done;

					     num_groups, user_gids);
	}

	(*user_gids) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID *, count + 1);
	(*user_gids)[0] = primary_group;
	
	*num_groups = 1;

	for (i=0;i<count;i++) {
		if (sid_equal(&sids[i], primary_group)) continue;
		
		(*user_gids)[*num_groups] = TALLOC_P(mem_ctx, DOM_SID);
		if (!(*user_gids)[*num_groups]) {
			status = NT_STATUS_NO_MEMORY;
			goto done;

	members = NULL;
	num_members = 0;

	attrs = TALLOC_ARRAY(mem_ctx, const char *, 3);
	attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
	attrs[2] = NULL;
		

	   the problem is that the members are in the form of distinguised names
	*/

	(*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID *, num_members);
	(*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
	(*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);

	for (i=0;i<num_members;i++) {
		uint32 name_type;

		if (dn_lookup(ads, mem_ctx, members[i], &name, &name_type, &sid)) {
		    (*names)[*num_names] = name;
		    (*name_types)[*num_names] = name_type;
		    (*sid_mem)[*num_names] = TALLOC_P(mem_ctx, DOM_SID);
		    if (!(*sid_mem)[*num_names]) {
			    status = NT_STATUS_NO_MEMORY;
			    goto done;

	
		/* Allocate memory for trusted domain names and sids */

		if ( !(*names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
			DEBUG(0, ("trusted_domains: out of memory\n"));
			result = NT_STATUS_NO_MEMORY;
			goto done;
		}

		if ( !(*alt_names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
			DEBUG(0, ("trusted_domains: out of memory\n"));
			result = NT_STATUS_NO_MEMORY;
			goto done;
		}

		if ( !(*dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, count)) ) {
			DEBUG(0, ("trusted_domains: out of memory\n"));
			result = NT_STATUS_NO_MEMORY;
			goto done;

Lines 357-364 Link Here

(-)samba-3.0.9-orig/source/nsswitch/winbindd.c (-2 / +1 lines)
357		357
358	/* Create new connection structure */	358	/* Create new connection structure */
359		359
360	if ((state = (struct winbindd_cli_state *)	360	if ((state = SMB_MALLOC_P(struct winbindd_cli_state)) == NULL)
361	malloc(sizeof(*state))) == NULL)
362	return;	361	return;
363		362
364	ZERO_STRUCTP(state);	363	ZERO_STRUCTP(state);




	if (ret)
		return ret;
	
	ret = SMB_XMALLOC_P(struct winbind_cache);
	ZERO_STRUCTP(ret);

	wcache = ret;

		smb_panic("centry_string");
	}

	ret = TALLOC(mem_ctx, len+1);
	if (!ret) {
		smb_panic("centry_string out of memory\n");
	}

	DOM_SID *sid;
	char *sid_string;

	sid = TALLOC_P(mem_ctx, DOM_SID);
	if (!sid)
		return NULL;
	

		return NULL;
	}

	centry = SMB_XMALLOC_P(struct cache_entry);
	centry->data = (unsigned char *)data.dptr;
	centry->len = data.dsize;
	centry->ofs = 0;

	if (centry->len - centry->ofs >= len)
		return;
	centry->len *= 2;
	p = SMB_REALLOC(centry->data, centry->len);
	if (!p) {
		DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
		smb_panic("out of memory in centry_expand");

	if (!wcache->tdb)
		return NULL;

	centry = SMB_XMALLOC_P(struct cache_entry);

	centry->len = 8192; /* reasonable default */
	centry->data = SMB_XMALLOC_ARRAY(char, centry->len);
	centry->ofs = 0;
	centry->sequence_number = domain->sequence_number;
	centry_put_uint32(centry, NT_STATUS_V(status));

	if (*num_entries == 0)
		goto do_cached;

	(*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
	if (! (*info))
		smb_panic("query_user_list out of memory");
	for (i=0; i<(*num_entries); i++) {

	if (*num_entries == 0)
		goto do_cached;

	(*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
	if (! (*info))
		smb_panic("enum_dom_groups out of memory");
	for (i=0; i<(*num_entries); i++) {

	if (*num_entries == 0)
		goto do_cached;

	(*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
	if (! (*info))
		smb_panic("enum_dom_groups out of memory");
	for (i=0; i<(*num_entries); i++) {

	if (*num_groups == 0)
		goto do_cached;

	(*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID *, *num_groups);
	if (! (*user_gids))
		smb_panic("lookup_usergroups out of memory");
	for (i=0; i<(*num_groups); i++) {

	if (*num_names == 0)
		goto do_cached;

	(*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID *, *num_names);
	(*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
	(*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);

	if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
		smb_panic("lookup_groupmem out of memory");

Lines 489-495 Link Here

(-)samba-3.0.9-orig/source/nsswitch/winbindd_cm.c (-1 / +1 lines)
489	struct winbindd_cm_conn *conn;	489	struct winbindd_cm_conn *conn;
490	NTSTATUS result;	490	NTSTATUS result;
491		491
492	if (!(conn = malloc(sizeof(*conn))))	492	if (!(conn = SMB_MALLOC_P(struct winbindd_cm_conn)))
493	return NT_STATUS_NO_MEMORY;	493	return NT_STATUS_NO_MEMORY;
494		494
495	ZERO_STRUCTP(conn);	495	ZERO_STRUCTP(conn);

Lines 117-123 Link Here

(-)samba-3.0.9-orig/source/nsswitch/winbindd_dual.c (-1 / +1 lines)
117		117
118	if (!background_process) return;	118	if (!background_process) return;
119		119
120	list = malloc(sizeof(*list));	120	list = SMB_MALLOC_P(struct dual_list);
121	if (!list) return;	121	if (!list) return;
122		122
123	list->next = NULL;	123	list->next = NULL;




	for ( i=0; i<num_members; i++ )
		len += strlen(members[i])+1;

	*buffer = SMB_XMALLOC_ARRAY(char, len);
	for ( i=0; i<num_members; i++ ) {
		snprintf( &(*buffer)[idx], len-idx, "%s,", members[i]);
		idx += strlen(members[i])+1;

	/* Allocate buffer */

	if (!buf && buf_len != 0) {
		if (!(buf = SMB_MALLOC(buf_len))) {
			DEBUG(1, ("out of memory\n"));
			result = False;
			goto done;

		}
						
		
		if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL) {
		     malloc(sizeof(struct getent_state))) == NULL) {
			DEBUG(1, ("winbindd_setgrent: malloc failed for domain_state!\n"));
			return WINBINDD_ERROR;
		}

	/* Copy entries into return buffer */

	if (num_entries) {
		if ( !(name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries)) ) {
			DEBUG(0,("get_sam_group_entries: Failed to malloc memory for %d domain groups!\n", 
				num_entries));
			result = False;

		/* Copy entries into return buffer */

		if ( num_entries ) {
			if ( !(tmp_name_list = SMB_REALLOC_ARRAY( name_list, struct acct_info, ent->num_sam_entries+num_entries)) )
			{
				DEBUG(0,("get_sam_group_entries: Failed to realloc more memory for %d local groups!\n", 
					num_entries));


	num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);

	if ((state->response.extra_data = SMB_MALLOC_ARRAY(struct winbindd_gr, num_groups)) == NULL)
	     malloc(num_groups * sizeof(struct winbindd_gr))) == NULL)
		return WINBINDD_ERROR;

	memset(state->response.extra_data, '\0',


		if (result) {
			/* Append to group membership list */
			new_gr_mem_list = SMB_REALLOC( gr_mem_list, gr_mem_list_len + gr_mem_len);
				gr_mem_list,
				gr_mem_list_len + gr_mem_len);

			if (!new_gr_mem_list && (group_list[group_list_ndx].num_gr_mem != 0)) {
				DEBUG(0, ("out of memory\n"));

	if (group_list_ndx == 0)
		goto done;

	new_extra_data = SMB_REALLOC(
		state->response.extra_data,
		group_list_ndx * sizeof(struct winbindd_gr) + gr_mem_list_len);


		
		/* Allocate some memory for extra data.  Note that we limit
		   account names to sizeof(fstring) = 128 characters.  */		
                ted = SMB_REALLOC(extra_data, sizeof(fstring) * total_entries);
 
		if (!ted) {
			DEBUG(0,("failed to enlarge buffer!\n"));

			return;
	}

	*sids = TALLOC_REALLOC_ARRAY(mem_ctx, *sids, DOM_SID *, *num_sids+1);

	if (*sids == NULL)
		return;

	(*sids)[*num_sids] = TALLOC_P(mem_ctx, DOM_SID);
	sid_copy((*sids)[*num_sids], sid);
	*num_sids += 1;
	return;

	}

	/* build the reply */
	ret = SMB_MALLOC(ret_size);
	if (!ret) goto done;
	ofs = 0;
	for (i = 0; i < num_groups; i++) {




		/* Add domain to list */

		total_entries++;
		ted = SMB_REALLOC(extra_data, sizeof(fstring) * 
                              total_entries);

		if (!ted) {

	state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';	
	which_domain = state->request.domain_name;

	extra_data = SMB_STRDUP("");

	/* this makes for a very simple data format, and is easily parsable as well
	   if that is ever needed */


	DEBUG(3, ("[%5lu]: request location of privileged pipe\n", (unsigned long)state->pid));
	
	state->response.extra_data = SMB_STRDUP(get_winbind_priv_pipe_dir());
	if (!state->response.extra_data)
		return WINBINDD_ERROR;





	}

	size = prs_data_size(&ps);
	state->response.extra_data = SMB_MALLOC(size);
	if (!state->response.extra_data) {
		prs_mem_free(&ps);
		return NT_STATUS_NO_MEMORY;

		return NT_STATUS_INVALID_PARAMETER;
	}

	all_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_all_sids);
	if (!all_sids)
		return NT_STATUS_NO_MEMORY;


	if ( NT_STATUS_IS_OK(result) &&
	     (state->request.flags & WBFLAG_PAM_AFS_TOKEN) ) {

		char *afsname = SMB_STRDUP(lp_afs_username_map());
		char *cell;

		if (afsname == NULL) goto no_token;


			DEBUG(5, ("Setting unix username to [%s]\n", username_out));

			state->response.extra_data = SMB_STRDUP(username_out);
			if (!state->response.extra_data) {
				result = NT_STATUS_NO_MEMORY;
				goto done;




		return NT_STATUS_OK;
	}

	talloced_info =	(struct acct_info *)TALLOC_MEMDUP(mem_ctx, *info,
		talloc_memdup(mem_ctx, *info,
			      *num_entries * sizeof(struct acct_info));

	SAFE_FREE(*info);

		nt_status = secrets_get_trusted_domains(mem_ctx, &enum_ctx, 1,
							&num_sec_domains,
							&domains);
		*names = TALLOC_REALLOC_ARRAY(mem_ctx, *names, char *,
					num_sec_domains + *num_domains);
		*alt_names = TALLOC_REALLOC_ARRAY(mem_ctx, *alt_names, char *,
					    num_sec_domains + *num_domains);
		*dom_sids = TALLOC_REALLOC_ARRAY(mem_ctx, *dom_sids, DOM_SID,
					   num_sec_domains + *num_domains);
		*dom_sids = talloc_realloc(mem_ctx, *dom_sids,
					   sizeof(**dom_sids) *
					   (num_sec_domains + *num_domains));

		for (i=0; i< num_sec_domains; i++) {
			if (pull_ucs2_talloc(mem_ctx, &(*names)[*num_domains],





		*num_entries += num_dom_users;

		*info = TALLOC_REALLOC_ARRAY( mem_ctx, *info, WINBIND_USERINFO, *num_entries);
			(*num_entries) * sizeof(WINBIND_USERINFO));

		if (!(*info)) {
			result = NT_STATUS_NO_MEMORY;

			break;
		}

		(*info) = TALLOC_REALLOC_ARRAY(mem_ctx, *info, struct acct_info, (*num_entries) + count);
					 sizeof(**info) * ((*num_entries) + count));
		if (! *info) {
			talloc_destroy(mem_ctx2);
			cli_samr_close(hnd->cli, mem_ctx, &dom_pol);

			break;
		}

		(*info) = TALLOC_REALLOC_ARRAY(mem_ctx, *info, struct acct_info, (*num_entries) + count);
					 sizeof(**info) * ((*num_entries) + count));
		if (! *info) {
			talloc_destroy(mem_ctx2);
			cli_samr_close(hnd->cli, mem_ctx, &dom_pol);

			
		*num_groups = user->num_groups;
				
		(*user_grpsids) = TALLOC_ARRAY(mem_ctx, DOM_SID*, *num_groups);
		for (i=0;i<(*num_groups);i++) {
			(*user_grpsids)[i] = rid_to_talloced_sid(domain, mem_ctx, user->gids[i].g_rid);
		}

	if (!NT_STATUS_IS_OK(result) || (*num_groups) == 0)
		goto done;

	(*user_grpsids) = TALLOC_ARRAY(mem_ctx, DOM_SID *, *num_groups);
	if (!(*user_grpsids)) {
		result = NT_STATUS_NO_MEMORY;
		goto done;


#define MAX_LOOKUP_RIDS 900

        *names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_names);
        *name_types = TALLOC_ZERO_ARRAY(mem_ctx, uint32, *num_names);
        *sid_mem = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID *, *num_names);

	for (j=0;j<(*num_names);j++) {
		(*sid_mem)[j] = rid_to_talloced_sid(domain, mem_ctx, (rid_mem)[j]);




						
		/* Create a state record for this domain */
                
		if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL)
		     malloc(sizeof(struct getent_state))) == NULL)
			return WINBINDD_ERROR;
                
		ZERO_STRUCTP(domain_state);

	if (num_entries) {
		struct getpwent_user *tnl;
		
		tnl = SMB_REALLOC_ARRAY(name_list, struct getpwent_user, ent->num_sam_entries + num_entries);
						      sizeof(struct getpwent_user) *
						      (ent->num_sam_entries + 
						       num_entries));
		
		if (!tnl) {
			DEBUG(0,("get_sam_user_entries realloc failed.\n"));


	num_users = MIN(MAX_GETPWENT_USERS, state->request.data.num_entries);
	
	if ((state->response.extra_data = SMB_MALLOC_ARRAY(struct winbindd_pw, num_users)) == NULL)
	     malloc(num_users * sizeof(struct winbindd_pw))) == NULL)
		return WINBINDD_ERROR;

	memset(state->response.extra_data, 0, num_users * 

		/* Allocate some memory for extra data */
		total_entries += num_entries;
			
		ted = SMB_REALLOC(extra_data, sizeof(fstring) * total_entries);
			
		if (!ted) {
			DEBUG(0,("failed to enlarge buffer!\n"));

Lines 139-145 Link Here

(-)samba-3.0.9-orig/source/nsswitch/winbindd_util.c (-2 / +2 lines)
139		139
140	/* Create new domain entry */	140	/* Create new domain entry */
141		141
142	if ((domain = (struct winbindd_domain )malloc(sizeof(domain))) == NULL)	142	if ((domain = SMB_MALLOC_P(struct winbindd_domain)) == NULL)
143	return NULL;	143	return NULL;
144		144
145	/* Fill in fields */	145	/* Fill in fields */
Lines 777-783 Link Here
777	uint32 rid)	777	uint32 rid)
778	{	778	{
779	DOM_SID *sid;	779	DOM_SID *sid;
780	sid = talloc(mem_ctx, sizeof(*sid));	780	sid = TALLOC_P(mem_ctx, DOM_SID);
781	if (!sid) {	781	if (!sid) {
782	smb_panic("rid_to_to_talloced_sid: talloc for DOM_SID failed!\n");	782	smb_panic("rid_to_to_talloced_sid: talloc for DOM_SID failed!\n");
783	}	783	}

Lines 97-103 Link Here

(-)samba-3.0.9-orig/source/nsswitch/winbindd_wins.c (-1 / +1 lines)
97	if (resolve_wins(name,0x20,&ret,count)) {	97	if (resolve_wins(name,0x20,&ret,count)) {
98	if ( count == 0 )	98	if ( count == 0 )
99	return NULL;	99	return NULL;
100	if ( (return_ip = (struct in_addr )malloc((count)*sizeof(struct in_addr))) == NULL ) {	100	if ( (return_ip = SMB_MALLOC_ARRAY(struct in_addr, *count)) == NULL ) {
101	free( ret );	101	free( ret );
102	return NULL;	102	return NULL;
103	}	103	}

Lines 101-107 Link Here

(-)samba-3.0.9-orig/source/nsswitch/wins.c (-1 / +1 lines)
101		101
102	/* always try with wins first */	102	/* always try with wins first */
103	if (resolve_wins(name,0x00,&address,count)) {	103	if (resolve_wins(name,0x00,&address,count)) {
104	if ( (ret = (struct in_addr *)malloc(sizeof(struct in_addr))) == NULL ) {	104	if ( (ret = SMB_MALLOC_P(struct in_addr)) == NULL ) {
105	free( address );	105	free( address );
106	return NULL;	106	return NULL;
107	}	107	}




	if (i == iNumServices) {
		service **tsp;
		
		tsp = SMB_REALLOC_ARRAY(ServicePtrs, service *, num_to_alloc);
					   sizeof(service *) *
					   num_to_alloc);
					   
		if (!tsp) {
			DEBUG(0,("add_a_service: failed to enlarge ServicePtrs!\n"));

		}
		else {
			ServicePtrs = tsp;
			ServicePtrs[iNumServices] = SMB_MALLOC_P(service);
				(service *) malloc(sizeof(service));
		}
		if (!ServicePtrs[iNumServices]) {
			DEBUG(0,("add_a_service: out of memory!\n"));

			if (strcmp(pdata->key, data->key) == 0) {
				string_free(&pdata->value);
				str_list_free(&data->list);
				pdata->value = SMB_STRDUP(data->value);
				not_added = False;
				break;
			}
			pdata = pdata->next;
		}
		if (not_added) {
		    paramo = SMB_XMALLOC_P(param_opt_struct);
		    paramo->key = SMB_STRDUP(data->key);
		    paramo->value = SMB_STRDUP(data->value);
		    paramo->list = NULL;
		    DLIST_ADD(pserviceDest->param_opt, paramo);
		}

	}

	if (!f) {
		f = SMB_MALLOC_P(struct file_lists);
		if (!f)
			return;
		f->next = file_lists;
		f->name = SMB_STRDUP(fname);
		if (!f->name) {
			SAFE_FREE(f);
			return;
		}
		f->subfname = SMB_STRDUP(subfname);
		if (!f->subfname) {
			SAFE_FREE(f);
			return;

				  ctime(&mod_time)));
			f->modtime = mod_time;
			SAFE_FREE(f->subfname);
			f->subfname = SMB_STRDUP(n2);
			return (True);
		}
		f = f->next;

{
	int i;
	SAFE_FREE(pservice->copymap);
	pservice->copymap = SMB_MALLOC_ARRAY(BOOL,NUMPARAMETERS);
	if (!pservice->copymap)
		DEBUG(0,
		      ("Couldn't allocate copymap!! (size %d)\n",

				if (strcmp(data->key, param_key) == 0) {
					string_free(&data->value);
					str_list_free(&data->list);
					data->value = SMB_STRDUP(pszParmValue);
					not_added = False;
					break;
				}
				data = data->next;
			}
			if (not_added) {
				paramo = SMB_XMALLOC_P(param_opt_struct);
				paramo->key = SMB_STRDUP(param_key);
				paramo->value = SMB_STRDUP(pszParmValue);
				paramo->list = NULL;
				if (snum < 0) {
					DLIST_ADD(Globals.param_opt, paramo);

	if (!str)
		return;

	s = SMB_STRDUP(str);
	if (!s)
		return;


			case P_STRING:
			case P_USTRING:
				if (parm_table[i].ptr) {
					parm_table[i].def.svalue = SMB_STRDUP(*(char **)parm_table[i].ptr);
				} else {
					parm_table[i].def.svalue = NULL;
				}

			case P_GSTRING:
			case P_UGSTRING:
				if (parm_table[i].ptr) {
					parm_table[i].def.svalue = SMB_STRDUP((char *)parm_table[i].ptr);
				} else {
					parm_table[i].def.svalue = NULL;
				}




      {
      char *tb;
      
      tb = SMB_REALLOC( bufr, bSize +BUFR_INC );
      if( NULL == tb )
        {
        DEBUG(0, ("%s Memory re-allocation failure.", func) );

      {
      char *tb;
      
      tb = SMB_REALLOC( bufr, bSize + BUFR_INC );
      if( NULL == tb )
        {
        DEBUG(0, ("%s Memory re-allocation failure.", func) );

      {
      char *tb;
      
      tb = SMB_REALLOC( bufr, bSize + BUFR_INC );
      if( NULL == tb )
        {
        DEBUG(0, ("%s Memory re-allocation failure.", func) );

  int lvl = in_client?1:0;
  myFILE *ret;

  ret = SMB_MALLOC_P(myFILE);
  if (!ret) return NULL;

  ret->buf = file_load(FileName, &ret->size);

  else                                        /* If we don't have a buffer   */
    {                                         /* allocate one, then parse,   */
    bSize = BUFR_INC;                         /* then free.                  */
    bufr = (char *)SMB_MALLOC( bSize );
    if( NULL == bufr )
      {
      DEBUG(0,("%s memory allocation failure.\n", func));




	if (!login_cache_init())
		return NULL;

	keybuf.dptr = SMB_STRDUP(pdb_get_nt_username(sampass));
	if (!keybuf.dptr || !strlen(keybuf.dptr)) {
		SAFE_FREE(keybuf.dptr);
		return NULL;

	databuf = tdb_fetch(cache, keybuf);
	SAFE_FREE(keybuf.dptr);

	if (!(entry = SMB_MALLOC_P(LOGIN_CACHE))) {
		DEBUG(1, ("Unable to allocate cache entry buffer!\n"));
		SAFE_FREE(databuf.dptr);
		return NULL;

	if (!login_cache_init())
		return False;

	keybuf.dptr = SMB_STRDUP(pdb_get_nt_username(sampass));
	if (!keybuf.dptr || !strlen(keybuf.dptr)) {
		SAFE_FREE(keybuf.dptr);
		return False;

			 entry.acct_ctrl,
			 entry.bad_password_count,
			 entry.bad_password_time);
	databuf.dptr = SMB_MALLOC(databuf.dsize);
	if (!databuf.dptr) {
		SAFE_FREE(keybuf.dptr);
		return False;

	if (!login_cache_init()) 
		return False;	

	keybuf.dptr = SMB_STRDUP(pdb_get_nt_username(sampass));
	if (!keybuf.dptr || !strlen(keybuf.dptr)) {
		SAFE_FREE(keybuf.dptr);
		return False;

Lines 201-207 Link Here

(-)samba-3.0.9-orig/source/passdb/lookup_sid.c (-2 / +2 lines)
201	}	201	}
202	}	202	}
203		203
204	pc = (struct uid_sid_cache *)malloc(sizeof(struct uid_sid_cache));	204	pc = SMB_MALLOC_P(struct uid_sid_cache);
205	if (!pc)	205	if (!pc)
206	return;	206	return;
207	pc->uid = uid;	207	pc->uid = uid;
Lines 275-281 Link Here
275	}	275	}
276	}	276	}
277		277
278	pc = (struct gid_sid_cache *)malloc(sizeof(struct gid_sid_cache));	278	pc = SMB_MALLOC_P(struct gid_sid_cache);
279	if (!pc)	279	if (!pc)
280	return;	280	return;
281	pc->gid = gid;	281	pc->gid = gid;

Lines 83-89 Link Here

(-)samba-3.0.9-orig/source/passdb/machine_sid.c (-1 / +1 lines)
83	BOOL is_dc = False;	83	BOOL is_dc = False;
84	DOM_SID *sam_sid;	84	DOM_SID *sam_sid;
85		85
86	if(!(sam_sid=(DOM_SID *)malloc(sizeof(DOM_SID))))	86	if(!(sam_sid=SMB_MALLOC_P(DOM_SID)))
87	return NULL;	87	return NULL;
88		88
89	generate_wellknown_sids();	89	generate_wellknown_sids();




		return NT_STATUS_UNSUCCESSFUL;
	}

	*user=TALLOC_P(mem_ctx, SAM_ACCOUNT);

	if (*user==NULL) {
		DEBUG(0,("pdb_init_sam_talloc: error while allocating memory\n"));

	/* Change from V1 is addition of password history field. */
	account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
	if (pwHistLen) {
		char *pw_hist = SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN);
		if (!pw_hist) {
			ret = False;
			goto done;

	}

	/* malloc the space needed */
	if ( (*buf=(uint8*)SMB_MALLOC(len)) == NULL) {
		DEBUG(0,("init_buffer_from_sam_v2: Unable to malloc() memory for buffer!\n"));
		return (-1);
	}

Lines 1224-1230 Link Here

(-)samba-3.0.9-orig/source/passdb/pdb_get_set.c (-1 / +1 lines)
1224		1224
1225	if (current_history_len < pwHistLen) {	1225	if (current_history_len < pwHistLen) {
1226	/* Ensure we have space for the needed history. */	1226	/* Ensure we have space for the needed history. */
1227	uchar *new_history = talloc(sampass->mem_ctx,	1227	uchar *new_history = TALLOC(sampass->mem_ctx,
1228	pwHistLen*PW_HISTORY_ENTRY_LEN);	1228	pwHistLen*PW_HISTORY_ENTRY_LEN);
1229	/* And copy it into the new buffer. */	1229	/* And copy it into the new buffer. */
1230	if (current_history_len) {	1230	if (current_history_len) {




		return NT_STATUS_OBJECT_NAME_COLLISION;
	}

	entry = SMB_XMALLOC_P(struct pdb_init_function_entry);
	entry->name = smb_xstrdup(name);
	entry->init = init;


		return NT_STATUS_NO_MEMORY;
	}		

	*context = TALLOC_P(mem_ctx, struct pdb_context);
	if (!*context) {
		DEBUG(0, ("make_pdb_context: talloc failed!\n"));
		return NT_STATUS_NO_MEMORY;


NTSTATUS make_pdb_methods(TALLOC_CTX *mem_ctx, PDB_METHODS **methods) 
{
	*methods = TALLOC_P(mem_ctx, struct pdb_methods);

	if (!*methods) {
		return NT_STATUS_NO_MEMORY;




		/* We can only store (sizeof(pstring)-1)/64 password history entries. */
		pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));

		if ((pwhist = SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
			DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
			return False;
		}

		;
	}

	(*attr_list) = SMB_REALLOC_ARRAY((*attr_list), char *,  i+2);
	SMB_ASSERT((*attr_list) != NULL);
	(*attr_list)[i] = SMB_STRDUP(new_attr);
	(*attr_list)[i+1] = NULL;
}


			continue;
		}

		mapt=SMB_REALLOC_ARRAY((*rmap), GROUP_MAP, entries+1);
		if (!mapt) {
			DEBUG(0,("ldapsam_enum_group_mapping: Unable to enlarge group map!\n"));
			SAFE_FREE(*rmap);


	/* TODO: Setup private data and free */

	ldap_state = TALLOC_ZERO_P(pdb_context->mem_ctx, struct ldapsam_privates);
	if (!ldap_state) {
		DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
		return NT_STATUS_NO_MEMORY;

Lines 551-557 Link Here

(-)samba-3.0.9-orig/source/passdb/pdb_smbpasswd.c (-2 / +2 lines)
551	new_entry_length = strlen(newpwd->smb_name) + 1 + 15 + 1 + 32 + 1 + 32 + 1 +	551	new_entry_length = strlen(newpwd->smb_name) + 1 + 15 + 1 + 32 + 1 + 32 + 1 +
552	NEW_PW_FORMAT_SPACE_PADDED_LEN + 1 + 13 + 2;	552	NEW_PW_FORMAT_SPACE_PADDED_LEN + 1 + 13 + 2;
553		553
554	if((new_entry = (char *)malloc( new_entry_length )) == NULL) {	554	if((new_entry = (char *)SMB_MALLOC( new_entry_length )) == NULL) {
555	DEBUG(0, ("format_new_smbpasswd_entry: Malloc failed adding entry for user %s.\n",	555	DEBUG(0, ("format_new_smbpasswd_entry: Malloc failed adding entry for user %s.\n",
556	newpwd->smb_name ));	556	newpwd->smb_name ));
557	return NULL;	557	return NULL;
Lines 1505-1511 Link Here
1505		1505
1506	/* Setup private data and free function */	1506	/* Setup private data and free function */
1507		1507
1508	privates = talloc_zero(pdb_context->mem_ctx, sizeof(struct smbpasswd_privates));	1508	privates = TALLOC_ZERO_P(pdb_context->mem_ctx, struct smbpasswd_privates);
1509		1509
1510	if (!privates) {	1510	if (!privates) {
1511	DEBUG(0, ("talloc() failed for smbpasswd private_data!\n"));	1511	DEBUG(0, ("talloc() failed for smbpasswd private_data!\n"));

Lines 78-84 Link Here

(-)samba-3.0.9-orig/source/passdb/pdb_sql.c (-2 / +2 lines)
78		78
79	char sql_escape_string(const char unesc)	79	char sql_escape_string(const char unesc)
80	{	80	{
81	char esc = malloc(strlen(unesc) 2 + 3);	81	char esc = SMB_MALLOC(strlen(unesc) 2 + 3);
82	size_t pos_unesc = 0, pos_esc = 0;	82	size_t pos_unesc = 0, pos_esc = 0;
83		83
84	for(pos_unesc = 0; unesc[pos_unesc]; pos_unesc++) {	84	for(pos_unesc = 0; unesc[pos_unesc]; pos_unesc++) {
Lines 472-478 Link Here
472	" VALUES (%s", query.part2);	472	" VALUES (%s", query.part2);
473	}	473	}
474		474
475	ret = strdup(query.part1);	475	ret = SMB_STRDUP(query.part1);
476	talloc_destroy(query.mem_ctx);	476	talloc_destroy(query.mem_ctx);
477	return ret;	477	return ret;
478	}	478	}

Lines 267-273 Link Here

(-)samba-3.0.9-orig/source/passdb/pdb_tdb.c (-2 / +2 lines)
267	struct pwent_list *ptr;	267	struct pwent_list *ptr;
268		268
269	if ( strncmp(key.dptr, prefix, prefixlen) == 0 ) {	269	if ( strncmp(key.dptr, prefix, prefixlen) == 0 ) {
270	if ( !(ptr=(struct pwent_list*)malloc(sizeof(struct pwent_list))) ) {	270	if ( !(ptr=SMB_MALLOC_P(struct pwent_list)) ) {
271	DEBUG(0,("tdbsam_traverse_setpwent: Failed to malloc new entry for list\n"));	271	DEBUG(0,("tdbsam_traverse_setpwent: Failed to malloc new entry for list\n"));
272		272
273	/* just return 0 and let the traversal continue */	273	/* just return 0 and let the traversal continue */
Lines 724-730 Link Here
724	(*pdb_method)->update_sam_account = tdbsam_update_sam_account;	724	(*pdb_method)->update_sam_account = tdbsam_update_sam_account;
725	(*pdb_method)->delete_sam_account = tdbsam_delete_sam_account;	725	(*pdb_method)->delete_sam_account = tdbsam_delete_sam_account;
726		726
727	tdb_state = talloc_zero(pdb_context->mem_ctx, sizeof(struct tdbsam_privates));	727	tdb_state = TALLOC_ZERO_P(pdb_context->mem_ctx, struct tdbsam_privates);
728		728
729	if (!tdb_state) {	729	if (!tdb_state) {
730	DEBUG(0, ("talloc() failed for tdbsam private_data!\n"));	730	DEBUG(0, ("talloc() failed for tdbsam private_data!\n"));




	*count = i;

	/* allocate and parse */
	*sids = SMB_MALLOC_ARRAY(DOM_SID, *count);
	if (! *sids) {
		return NT_STATUS_NO_MEMORY;
	}

	}

	/* allocate the maximum size that we might use */
	data.dptr = SMB_MALLOC(count * ((MAXSUBAUTHS*11) + 30));
	if (!data.dptr) {
		return NT_STATUS_NO_MEMORY;
	}

	}

	/* add it in */
	current_sids = SMB_REALLOC_ARRAY(current_sids, DOM_SID, current_count+1);
	if (!current_sids) {
		privilege_unlock_right(right);
		return NT_STATUS_NO_MEMORY;

		right = key.dptr;
		
		if (privilege_sid_has_right(sid, right)) {
			(*rights) = SMB_REALLOC_ARRAY(*rights,char *, (*count)+1);
			if (! *rights) {
				safe_free(nextkey.dptr);
				free(key.dptr);
				return NT_STATUS_NO_MEMORY;
			}

			(*rights)[*count] = SMB_STRDUP(right);
			(*count)++;
		}





			
	/* the trust's password */	
	if (pwd) {
		*pwd = SMB_STRDUP(pass.pass);
		if (!*pwd) {
			return False;
		}

	size_t size, packed_size = 0;
	fstring dom_name;
	char *packed_pass;
	struct trusted_dom_pass *pass = TALLOC_ZERO_P(ctx, struct trusted_dom_pass);
	NTSTATUS status;

	if (!secrets_init()) return NT_STATUS_ACCESS_DENIED;

	DEBUG(5, ("secrets_get_trusted_domains: looking for %d domains, starting at index %d\n", 
		  max_num_domains, *enum_ctx));

	*domains = TALLOC_ZERO_ARRAY(ctx, TRUSTDOM *, max_num_domains);

	/* fetching trusted domains' data and collecting them in a list */
	keys = tdb_search_keys(tdb, pattern);

		char *secrets_key;
		
		/* important: ensure null-termination of the key string */
		secrets_key = SMB_STRNDUP(k->node_key.dptr, k->node_key.dsize);
		if (!secrets_key) {
			DEBUG(0, ("strndup failed!\n"));
			return NT_STATUS_NO_MEMORY;

		SAFE_FREE(secrets_key);

		if (idx >= start_idx && idx < start_idx + max_num_domains) {
			dom = TALLOC_ZERO_P(ctx, TRUSTDOM);
			if (!dom) {
				/* free returned tdb record */
				return NT_STATUS_NO_MEMORY;




		/* This is not lp_workgroup() for good reason:
		   it must stay around longer than the lp_*() 
		   strings do */
		sid_name_map[i].name = SMB_STRDUP(lp_workgroup());
		sid_name_map[i].known_users = NULL;
		i++;
		sid_name_map[i].sid = get_global_sam_sid();
		sid_name_map[i].name = SMB_STRDUP(global_myname());
		sid_name_map[i].known_users = NULL;
		i++;
	} else {
		sid_name_map[i].sid = get_global_sam_sid();
		sid_name_map[i].name = SMB_STRDUP(global_myname());
		sid_name_map[i].known_users = NULL;
		i++;
	}


void add_sid_to_array(const DOM_SID *sid, DOM_SID **sids, int *num)
{
	*sids = SMB_REALLOC_ARRAY(*sids, DOM_SID, (*num)+1);

	if (*sids == NULL)
		return;

Lines 40-46 Link Here

(-)samba-3.0.9-orig/source/printing/load.c (-1 / +1 lines)
40	{	40	{
41	const char *p;	41	const char *p;
42	int printers;	42	int printers;
43	char *str = strdup(lp_auto_services());	43	char *str = SMB_STRDUP(lp_auto_services());
44		44
45	if (!str) return;	45	if (!str) return;
46		46




				msg->len, msg->notify.data);

	if (buflen != len) {
		buf = TALLOC_REALLOC(send_ctx, buf, len);
		if (!buf)
			return False;
		buflen = len;

	}
	offset += 4; /* For count. */

	buf = TALLOC(send_ctx, offset);
	if (!buf) {
		DEBUG(0,("print_notify_send_messages: Out of memory\n"));
		talloc_destroy_pool(send_ctx);

	memcpy( to, from, sizeof(SPOOLSS_NOTIFY_MSG) );
	
	if ( from->len ) {
		to->notify.data = TALLOC_MEMDUP(send_ctx, from->notify.data, from->len );
		if ( !to->notify.data ) {
			DEBUG(0,("copy_notify2_msg: talloc_memdup() of size [%d] failed!\n", from->len ));
			return False;


	/* Store the message on the pending queue. */

	pnqueue = TALLOC_P(send_ctx, struct notify_queue);
	if (!pnqueue) {
		DEBUG(0,("send_spoolss_notify2_msg: Out of memory.\n"));
		return;


	/* allocate a new msg structure and copy the fields */
	
	if ( !(pnqueue->msg = TALLOC_P(send_ctx, SPOOLSS_NOTIFY_MSG)) ) {
		DEBUG(0,("send_spoolss_notify2_msg: talloc() of size [%lu] failed!\n", 
			(unsigned long)sizeof(SPOOLSS_NOTIFY_MSG)));
		return;

	if (!create_send_ctx())
		return;

	msg = TALLOC_P(send_ctx, struct spoolss_notify_msg);
	if (!msg)
		return;


	if (!create_send_ctx())
		return;

	msg = TALLOC_P(send_ctx, struct spoolss_notify_msg);
	if (!msg)
		return;



	num_pids = data.dsize / 8;

	if ((pid_list = TALLOC_ARRAY(mem_ctx, pid_t, num_pids)) == NULL) {
		ret = False;
		goto done;
	}




		if (ret != dbuf.dsize) 
			continue;

		tl = SMB_REALLOC_ARRAY(*list, nt_forms_struct, n+1);
		if (!tl) {
			DEBUG(0,("get_ntforms: Realloc fail.\n"));
			return 0;

	}

	if (update==False) {
		if((tl=SMB_REALLOC_ARRAY(*list, nt_forms_struct, n+1)) == NULL) {
			DEBUG(0,("add_a_form: failed to enlarge forms list!\n"));
			return False;
		}

		if (strncmp(kbuf.dptr, key, strlen(key)) != 0)
			continue;
		
		if((fl = SMB_REALLOC_ARRAY(*list, fstring, total+1)) == NULL) {
			DEBUG(0,("get_ntdrivers: failed to enlarge list!\n"));
			return -1;
		}

	char    *buf = NULL;
	ssize_t byte_count;

	if ((buf=SMB_MALLOC(PE_HEADER_SIZE)) == NULL) {
		DEBUG(0,("get_file_version: PE file [%s] PE Header malloc failed bytes = %d\n",
				fname, PE_HEADER_SIZE));
		goto error_exit;

			goto error_exit;

		SAFE_FREE(buf);
		if ((buf=SMB_MALLOC(section_table_bytes)) == NULL) {
			DEBUG(0,("get_file_version: PE file [%s] section table malloc failed bytes = %d\n",
					fname, section_table_bytes));
			goto error_exit;

					goto error_exit;

				SAFE_FREE(buf);
				if ((buf=SMB_MALLOC(section_bytes)) == NULL) {
					DEBUG(0,("get_file_version: PE file [%s] version malloc failed bytes = %d\n",
							fname, section_bytes));
					goto error_exit;


		/* Allocate a bit more space to speed up things */
		SAFE_FREE(buf);
		if ((buf=SMB_MALLOC(VS_NE_BUF_SIZE)) == NULL) {
			DEBUG(0,("get_file_version: NE file [%s] malloc failed bytes  = %d\n",
					fname, PE_HEADER_SIZE));
			goto error_exit;

	if (len != buflen) {
		char *tb;

		tb = (char *)SMB_REALLOC(buf, len);
		if (!tb) {
			DEBUG(0,("add_a_printer_driver_3: failed to enlarge buffer\n!"));
			ret = -1;

	fstrcpy(info.configfile, "");
	fstrcpy(info.helpfile, "");

	if ((info.dependentfiles= SMB_MALLOC_ARRAY(fstring, 2)) == NULL)
		return WERR_NOMEM;

	memset(info.dependentfiles, '\0', 2*sizeof(fstring));

	while (len < dbuf.dsize) {
		fstring *tddfs;

		tddfs = SMB_REALLOC_ARRAY(driver.dependentfiles, fstring, i+2);
							 sizeof(fstring)*(i+2));
		if (tddfs == NULL) {
			DEBUG(0,("get_a_printer_driver_3: failed to enlarge buffer!\n"));
			break;

	if (buflen != len) {
		char *tb;

		tb = (char *)SMB_REALLOC(buf, len);
		if (!tb) {
			DEBUG(0,("update_a_printer_2: failed to enlarge buffer!\n"));
			ret = WERR_NOMEM;

{

	char adevice[MAXDEVICENAME];
	NT_DEVICEMODE *nt_devmode = SMB_MALLOC_P(NT_DEVICEMODE);

	if (nt_devmode == NULL) {
		DEBUG(0,("construct_nt_devicemode: malloc fail.\n"));

	
	/* allocate another slot in the NT_PRINTER_KEY array */
	
	d = SMB_REALLOC_ARRAY( data->keys, NT_PRINTER_KEY, data->num_keys+1);
	if ( d )
		data->keys = d;
	

	/* initialze new key */
	
	data->num_keys++;
	data->keys[key_index].name = SMB_STRDUP( name );
	
	ZERO_STRUCTP( &data->keys[key_index].values );
	


			/* found a match, so allocate space and copy the name */
			
			if ( !(ptr = SMB_REALLOC_ARRAY( subkeys_ptr, fstring, num_subkeys+2)) ) {
				DEBUG(0,("get_printer_subkeys: Realloc failed for [%d] entries!\n", 
					num_subkeys+1));
				SAFE_FREE( subkeys );


	/* a multi-sz has to have a null string terminator, i.e., the last
	   string must be followed by two nulls */
	str_size = strlen(multi_sz) + 2;
	conv_strs = SMB_CALLOC_ARRAY(smb_ucs2_t, str_size);
	if (!conv_strs) {
		return;
	}

	/* Change to byte units. */
	str_size *= sizeof(smb_ucs2_t);
	push_ucs2(NULL, conv_strs, multi_sz, str_size, 
		  STR_TERMINATE | STR_NOALIGN);


	if (buflen < len) {
		char *tb;

		tb = (char *)SMB_REALLOC(buf, len);
		if (!tb) {
			DEBUG(0, ("update_driver_init_2: failed to enlarge buffer!\n"));
			ret = -1;

		if ((ctx = talloc_init("save_driver_init_2")) == NULL)
			return WERR_NOMEM;

		if ((nt_devmode = SMB_MALLOC_P(NT_DEVICEMODE)) == NULL) {
			status = WERR_NOMEM;
			goto done;
		}

	if ( !printer )
		return NULL;
	
	if ( !(copy = SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL_2)) )
		return NULL;
		
	memcpy( copy, printer, sizeof(NT_PRINTER_INFO_LEVEL_2) );


	switch (level) {
		case 2:
			if ((printer = SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL)) == NULL) {
				DEBUG(0,("get_a_printer: malloc fail.\n"));
				return WERR_NOMEM;
			}

				/* save a copy in cache */
				if ( print_hnd && (print_hnd->printer_type==PRINTER_HANDLE_IS_PRINTER)) {
					if ( !print_hnd->printer_info )
						print_hnd->printer_info = SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL);

					if ( print_hnd->printer_info ) {
						/* make sure to use the handle's talloc ctx here since 

Lines 931-937 Link Here

(-)samba-3.0.9-orig/source/printing/print_cups.c (-1 / +1 lines)
931	{	931	{
932	qalloc += 16;	932	qalloc += 16;
933		933
934	temp = Realloc(queue, sizeof(print_queue_struct) * qalloc);	934	temp = SMB_REALLOC_ARRAY(queue, print_queue_struct, qalloc);
935		935
936	if (temp == NULL)	936	if (temp == NULL)
937	{	937	{

Lines 194-200 Link Here

(-)samba-3.0.9-orig/source/printing/print_generic.c (-1 / +1 lines)
194	qcount = 0;	194	qcount = 0;
195	ZERO_STRUCTP(status);	195	ZERO_STRUCTP(status);
196	if (numlines)	196	if (numlines)
197	queue = (print_queue_struct )malloc(sizeof(print_queue_struct)(numlines+1));	197	queue = SMB_MALLOC_ARRAY(print_queue_struct, numlines+1);
198		198
199	if (queue) {	199	if (queue) {
200	memset(queue, '\0', sizeof(print_queue_struct)*(numlines+1));	200	memset(queue, '\0', sizeof(print_queue_struct)*(numlines+1));




		if (buflen != len) {
			char *tb;

			tb = (char *)SMB_REALLOC(buf, len);
			if (!tb) {
				DEBUG(0,("pjob_store: failed to enlarge buffer!\n"));
				goto done;

				queue[i].fs_file);
	}

	if ((data.dptr = SMB_MALLOC(data.dsize)) == NULL)
		return;

        len = 0;


	if (i == data.dsize) {
		/* We weren't in the list. Realloc. */
		data.dptr = SMB_REALLOC(data.dptr, data.dsize + 8);
		if (!data.dptr) {
			DEBUG(0,("print_notify_register_pid: Relloc fail for printer %s\n",
						printername));

	if (qcount == 0 && extra_count == 0)
		goto out;

	if ((queue = SMB_MALLOC_ARRAY(print_queue_struct, qcount + extra_count)) == NULL)
		goto out;

	/* Retrieve the linearised queue data. */

Lines 80-86 Link Here

(-)samba-3.0.9-orig/source/printing/printing_db.c (-1 / +1 lines)
80		80
81	if (!p) {	81	if (!p) {
82	/* Create one. */	82	/* Create one. */
83	p = (struct tdb_print_db *)malloc(sizeof(struct tdb_print_db));	83	p = SMB_MALLOC_P(struct tdb_print_db);
84	if (!p) {	84	if (!p) {
85	DEBUG(0,("get_print_db: malloc fail !\n"));	85	DEBUG(0,("get_print_db: malloc fail !\n"));
86	return NULL;	86	return NULL;

Lines 78-84 Link Here

(-)samba-3.0.9-orig/source/registry/reg_cachehook.c (-1 / +1 lines)
78	/* prepend the string with a '\' character */	78	/* prepend the string with a '\' character */
79		79
80	len = strlen( keyname );	80	len = strlen( keyname );
81	if ( !(key = malloc( len + 2 )) ) {	81	if ( !(key = SMB_MALLOC( len + 2 )) ) {
82	DEBUG(0,("reghook_cache_find: malloc failed for string [%s] !?!?!\n",	82	DEBUG(0,("reghook_cache_find: malloc failed for string [%s] !?!?!\n",
83	keyname));	83	keyname));
84	return NULL;	84	return NULL;

Lines 183-189 Link Here

(-)samba-3.0.9-orig/source/registry/reg_db.c (-2 / +2 lines)
183		183
184	/* allocate some initial memory */	184	/* allocate some initial memory */
185		185
186	buffer = malloc(sizeof(pstring));	186	buffer = SMB_MALLOC(sizeof(pstring));
187	buflen = sizeof(pstring);	187	buflen = sizeof(pstring);
188	len = 0;	188	len = 0;
189		189
Lines 197-203 Link Here
197	len += tdb_pack( buffer+len, buflen-len, "f", regsubkey_ctr_specific_key(ctr, i) );	197	len += tdb_pack( buffer+len, buflen-len, "f", regsubkey_ctr_specific_key(ctr, i) );
198	if ( len > buflen ) {	198	if ( len > buflen ) {
199	/* allocate some extra space */	199	/* allocate some extra space */
200	if ((tmpbuf = Realloc( buffer, len*2 )) == NULL) {	200	if ((tmpbuf = SMB_REALLOC( buffer, len*2 )) == NULL) {
201	DEBUG(0,("regdb_store_reg_keys: Failed to realloc memory of size [%d]\n", len*2));	201	DEBUG(0,("regdb_store_reg_keys: Failed to realloc memory of size [%d]\n", len*2));
202	ret = False;	202	ret = False;
203	goto done;	203	goto done;

Lines 154-160 Link Here

(-)samba-3.0.9-orig/source/registry/reg_frontend.c (-1 / +1 lines)
154	if ( !(s = regsubkey_ctr_specific_key( &ctr, key_index )) )	154	if ( !(s = regsubkey_ctr_specific_key( &ctr, key_index )) )
155	return False;	155	return False;
156		156
157	*subkey = strdup( s );	157	*subkey = SMB_STRDUP( s );
158		158
159	return True;	159	return True;
160	}	160	}




		/* allocate a space for the char* in the array */
		
		if (  ctr->subkeys == 0 )
			ctr->subkeys = TALLOC_P( ctr->ctx, char *);
		else {
			pp = TALLOC_REALLOC_ARRAY( ctr->ctx, ctr->subkeys, char *, ctr->num_subkeys+1);
			if ( pp )
				ctr->subkeys = pp;
		}

		/* allocate the string and save it in the array */
		
		ctr->subkeys[ctr->num_subkeys] = TALLOC( ctr->ctx, len+1 );
		strncpy( ctr->subkeys[ctr->num_subkeys], keyname, len+1 );
		ctr->num_subkeys++;
	}

	if ( !val )
		return NULL;
	
	if ( !(copy = SMB_MALLOC_P( REGISTRY_VALUE)) ) {
		DEBUG(0,("dup_registry_value: malloc() failed!\n"));
		return NULL;
	}

		/* allocate a slot in the array of pointers */
		
		if (  ctr->num_values == 0 )
			ctr->values = TALLOC_P( ctr->ctx, REGISTRY_VALUE *);
		else {
			ppreg = TALLOC_REALLOC_ARRAY( ctr->ctx, ctr->values, REGISTRY_VALUE *, ctr->num_values+1 );
			if ( ppreg )
				ctr->values = ppreg;
		}

		/* allocate a new value and store the pointer in the arrya */
		
		ctr->values[ctr->num_values] = TALLOC_P( ctr->ctx, REGISTRY_VALUE);

		/* init the value */
	
		fstrcpy( ctr->values[ctr->num_values]->valuename, name );
		ctr->values[ctr->num_values]->type = type;
		ctr->values[ctr->num_values]->data_p = TALLOC_MEMDUP( ctr->ctx, data_p, size );
		ctr->values[ctr->num_values]->size = size;
		ctr->num_values++;
	}

		/* allocate a slot in the array of pointers */
		
		if (  ctr->num_values == 0 )
			ctr->values = TALLOC_P( ctr->ctx, REGISTRY_VALUE *);
		else {
			ppreg = TALLOC_REALLOC_ARRAY( ctr->ctx, ctr->values, REGISTRY_VALUE *, ctr->num_values+1 );
			if ( ppreg )
				ctr->values = ppreg;
		}

		/* allocate a new value and store the pointer in the arrya */
		
		ctr->values[ctr->num_values] = TALLOC_P( ctr->ctx, REGISTRY_VALUE);

		/* init the value */
	
		fstrcpy( ctr->values[ctr->num_values]->valuename, val->valuename );
		ctr->values[ctr->num_values]->type = val->type;
		ctr->values[ctr->num_values]->data_p = TALLOC_MEMDUP( ctr->ctx, val->data_p, val->size );
		ctr->values[ctr->num_values]->size = val->size;
		ctr->num_values++;
	}




		p++;
	
	if ( *p )
		return SMB_STRDUP(p);
	else
		return NULL;
}

	
	/* we are dealing with a subkey of "Environments */
	
	key2 = SMB_STRDUP( key );
	keystr = key2;
	reg_split_path( keystr, &base, &new_path );
	

	
	/* env */
	
	key2 = SMB_STRDUP( key );
	keystr = key2;
	reg_split_path( keystr, &base, &new_path );
	if ( !base || !new_path )

			
			length = strlen(filename);
		
			buffer2 = SMB_REALLOC( buffer, buffer_size + (length + 1)*sizeof(uint16) );
			if ( !buffer2 )
				break;
			buffer = buffer2;

		
		/* terminated by double NULL.  Add the final one here */
		
		buffer2 = SMB_REALLOC( buffer, buffer_size + 2 );
		if ( !buffer2 ) {
			SAFE_FREE( buffer );
			buffer_size = 0;


	/* get information for a specific printer */
	
	key2 = SMB_STRDUP( key );
	keystr = key2;
	reg_split_path( keystr, &base, &new_path );


		goto done;
	}
	
	key2 = SMB_STRDUP( key );
	keystr = key2;
	reg_split_path( keystr, &base, &new_path );
	

Lines 60-66 Link Here

(-)samba-3.0.9-orig/source/rpcclient/cmd_echo.c (-2 / +2 lines)
60	}	60	}
61		61
62	size = atoi(argv[1]);	62	size = atoi(argv[1]);
63	in_data = malloc(size);	63	in_data = SMB_MALLOC(size);
64		64
65	for (i = 0; i < size; i++)	65	for (i = 0; i < size; i++)
66	in_data[i] = i & 0xff;	66	in_data[i] = i & 0xff;
Lines 129-135 Link Here
129	}	129	}
130		130
131	size = atoi(argv[1]);	131	size = atoi(argv[1]);
132	in_data = malloc(size);	132	in_data = SMB_MALLOC(size);
133		133
134	for (i = 0; i < size; i++)	134	for (i = 0; i < size; i++)
135	in_data[i] = i & 0xff;	135	in_data[i] = i & 0xff;

Lines 207-213 Link Here

(-)samba-3.0.9-orig/source/rpcclient/cmd_lsarpc.c (-1 / +1 lines)
207		207
208	/* Convert arguments to sids */	208	/* Convert arguments to sids */
209		209
210	sids = (DOM_SID )talloc(mem_ctx, sizeof(DOM_SID) (argc - 1));	210	sids = TALLOC_ARRAY(mem_ctx, DOM_SID, argc - 1);
211		211
212	if (!sids) {	212	if (!sids) {
213	printf("could not allocate memory for %d sids\n", argc - 1);	213	printf("could not allocate memory for %d sids\n", argc - 1);

Lines 1238-1244 Link Here

(-)samba-3.0.9-orig/source/rpcclient/cmd_samr.c (-2 / +2 lines)
1238	/* Look up names */	1238	/* Look up names */
1239		1239
1240	num_names = argc - 2;	1240	num_names = argc - 2;
1241	names = (const char *)talloc(mem_ctx, sizeof(char ) * num_names);	1241	names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
1242		1242
1243	for (i = 0; i < argc - 2; i++)	1243	for (i = 0; i < argc - 2; i++)
1244	names[i] = argv[i + 2];	1244	names[i] = argv[i + 2];
Lines 1296-1302 Link Here
1296	/* Look up rids */	1296	/* Look up rids */
1297		1297
1298	num_rids = argc - 1;	1298	num_rids = argc - 1;
1299	rids = (uint32 )talloc(mem_ctx, sizeof(uint32) num_rids);	1299	rids = TALLOC_ARRAY(mem_ctx, uint32, num_rids);
1300		1300
1301	for (i = 0; i < argc - 1; i++)	1301	for (i = 0; i < argc - 1; i++)
1302	sscanf(argv[i + 1], "%i", &rids[i]);	1302	sscanf(argv[i + 1], "%i", &rids[i]);




	/* allocate the space; add one extra slot for a terminating NULL.
	   Each filename is NULL terminated and the end contains a double
	   NULL */
	if ((info->dependentfiles=TALLOC_ARRAY(mem_ctx, uint16, len+1)) == NULL)
	{
		DEBUG(0,("init_drv_info_3_members: Unable to malloc memory for dependenfiles\n"));
		return False;

	fstrcpy(value.valuename, argv[2]);
	value.type = REG_SZ;
	value.size = data.uni_str_len * 2;
	value.data_p = TALLOC_MEMDUP(mem_ctx, data.buffer, value.size);

	result = cli_spoolss_setprinterdata(cli, mem_ctx, &pol, &value);
		

	option.option_type_ptr = 1;
	option.count = option.ctr.count = 2;

	option.ctr.type = TALLOC_ARRAY(mem_ctx, SPOOL_NOTIFY_OPTION_TYPE, 2);
		mem_ctx, sizeof(SPOOL_NOTIFY_OPTION_TYPE) * 2);

	ZERO_STRUCT(option.ctr.type[0]);
	option.ctr.type[0].type = PRINTER_NOTIFY_TYPE;




	if (!commands) 
		return NULL;

	matches = SMB_MALLOC_ARRAY(char *, MAX_COMPLETIONS);
	if (!matches) return NULL;

	matches[count++] = SMB_STRDUP(text);
	if (!matches[0]) return NULL;

	while (commands && count < MAX_COMPLETIONS-1) 

                      ( commands->cmd_set[i].returntype == RPC_RTYPE_WERROR &&
                        commands->cmd_set[i].wfn)))
			{
				matches[count] = SMB_STRDUP(commands->cmd_set[i].name);
				if (!matches[count]) 
					return NULL;
				count++;


	if (count == 2) {
		SAFE_FREE(matches[0]);
		matches[0] = SMB_STRDUP(matches[1]);
	}
	matches[count] = NULL;
	return matches;

{
	struct cmd_list *entry;

	if (!(entry = SMB_MALLOC_P(struct cmd_list))) {
		DEBUG(0, ("out of memory\n"));
		return;
	}

Lines 39-46 Link Here

(-)samba-3.0.9-orig/source/rpc_client/cli_ds.c (-6 / +16 lines)
39		39
40	/* Initialise parse structures */	40	/* Initialise parse structures */
41		41
42	prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);	42	if (!prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL)) {
43	prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);	43	return NT_STATUS_NO_MEMORY;
		44	}
		45	if (!prs_init(&rbuf, 0, mem_ctx, UNMARSHALL)) {
		46	prs_mem_free(&qbuf);
		47	return NT_STATUS_NO_MEMORY;
		48	}
44		49
45	q.level = level;	50	q.level = level;
46		51
Lines 63-69 Link Here
63	result = r.status;	68	result = r.status;
64		69
65	if ( r.ptr && ctr ) {	70	if ( r.ptr && ctr ) {
66	ctr->basic = talloc(mem_ctx, sizeof(DSROLE_PRIMARY_DOMAIN_INFO_BASIC));	71	ctr->basic = TALLOC_P(mem_ctx, DSROLE_PRIMARY_DOMAIN_INFO_BASIC);
67	if (!ctr->basic)	72	if (!ctr->basic)
68	goto done;	73	goto done;
69	memcpy(ctr->basic, r.info.basic, sizeof(DSROLE_PRIMARY_DOMAIN_INFO_BASIC));	74	memcpy(ctr->basic, r.info.basic, sizeof(DSROLE_PRIMARY_DOMAIN_INFO_BASIC));
Lines 94-101 Link Here
94		99
95	/* Initialise parse structures */	100	/* Initialise parse structures */
96		101
97	prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);	102	if (!prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL)) {
98	prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);	103	return NT_STATUS_NO_MEMORY;;
		104	}
		105	if (!prs_init(&rbuf, 0, mem_ctx, UNMARSHALL)) {
		106	prs_mem_free(&qbuf);
		107	return NT_STATUS_NO_MEMORY;
		108	}
99		109
100	init_q_ds_enum_domain_trusts( &q, server, flags );	110	init_q_ds_enum_domain_trusts( &q, server, flags );
101		111
Lines 118-124 Link Here
118	int i;	128	int i;
119		129
120	*num_domains = r.num_domains;	130	*num_domains = r.num_domains;
121	trusts = (struct ds_domain_trust)talloc(mem_ctx, r.num_domainssizeof(*trusts));	131	*trusts = TALLOC_ARRAY(mem_ctx, struct ds_domain_trust, r.num_domains);
122		132
123	for ( i=0; i< *num_domains; i++ ) {	133	for ( i=0; i< *num_domains; i++ ) {
124	(*trusts)[i].flags = r.domains.trusts[i].flags;	134	(*trusts)[i].flags = r.domains.trusts[i].flags;

Lines 35-42 Link Here

(-)samba-3.0.9-orig/source/rpc_client/cli_echo.c (-9 / +29 lines)
35		35
36	/* Initialise parse structures */	36	/* Initialise parse structures */
37		37
38	prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);	38	if (!prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL)) {
39	prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);	39	return NT_STATUS_NO_MEMORY;
		40	}
		41	if (!prs_init(&rbuf, 0, mem_ctx, UNMARSHALL)) {
		42	prs_mem_free(&qbuf);
		43	return NT_STATUS_NO_MEMORY;
		44	}
40		45
41	/* Marshall data and send request */	46	/* Marshall data and send request */
42		47
Lines 76-83 Link Here
76		81
77	/* Initialise parse structures */	82	/* Initialise parse structures */
78		83
79	prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);	84	if (!prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL)) {
80	prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);	85	return NT_STATUS_NO_MEMORY;
		86	}
		87	if (!prs_init(&rbuf, 0, mem_ctx, UNMARSHALL)) {
		88	prs_mem_free(&qbuf);
		89	return NT_STATUS_NO_MEMORY;
		90	}
81		91
82	/* Marshall data and send request */	92	/* Marshall data and send request */
83		93
Lines 95-101 Link Here
95	result = True;	105	result = True;
96		106
97	if (out_data) {	107	if (out_data) {
98	*out_data = talloc(mem_ctx, size);	108	*out_data = TALLOC(mem_ctx, size);
99	memcpy(*out_data, r.data, size);	109	memcpy(*out_data, r.data, size);
100	}	110	}
101		111
Lines 119-126 Link Here
119		129
120	/* Initialise parse structures */	130	/* Initialise parse structures */
121		131
122	prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);	132	if (!prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL)) {
123	prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);	133	return NT_STATUS_NO_MEMORY;
		134	}
		135	if (!prs_init(&rbuf, 0, mem_ctx, UNMARSHALL)) {
		136	prs_mem_free(&qbuf);
		137	return NT_STATUS_NO_MEMORY;
		138	}
124		139
125	/* Marshall data and send request */	140	/* Marshall data and send request */
126		141
Lines 159-166 Link Here
159		174
160	/* Initialise parse structures */	175	/* Initialise parse structures */
161		176
162	prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);	177	if (!prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL)) {
163	prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);	178	return NT_STATUS_NO_MEMORY;
		179	}
		180	if (!prs_init(&rbuf, 0, mem_ctx, UNMARSHALL)) {
		181	prs_mem_free(&qbuf);
		182	return NT_STATUS_NO_MEMORY;
		183	}
164		184
165	/* Marshall data and send request */	185	/* Marshall data and send request */
166		186




	if (NT_STATUS_IS_OK(result = r.status)) {
		*pol = r.pol;
#ifdef __INSURE__
		pol->marker = MALLOC(1);
#endif
	}


		goto done;
	}

	if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
					   num_sids))) {
		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
					 num_sids))) {
		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	if (!((*types) = TALLOC_ARRAY(mem_ctx, uint32, num_sids))) {
					  num_sids))) {
		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;

		goto done;
	}

	if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
					 num_names)))) {
		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	if (!((*types = TALLOC_ARRAY(mem_ctx, uint32, num_names)))) {
					 num_names)))) {
		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;

		}

		if (domain_sid && (r.dom.id3.buffer_dom_sid != 0)) {
			*domain_sid = TALLOC_P(mem_ctx, DOM_SID);
			if (*domain_sid) {
				sid_copy(*domain_sid, &r.dom.id3.dom_sid.sid);
			}

		}
			
		if (domain_sid && (r.dom.id5.buffer_dom_sid != 0)) {
			*domain_sid = TALLOC_P(mem_ctx, DOM_SID);
			if (*domain_sid) {
				sid_copy(*domain_sid, &r.dom.id5.dom_sid.sid);
			}

	}
	
	if (domain_guid) {
		*domain_guid = TALLOC_P(mem_ctx, struct uuid);
		memcpy(*domain_guid, 
		       &r.info.dns_dom_info.dom_guid, 
		       sizeof(struct uuid));
	}

	if (domain_sid && r.info.dns_dom_info.ptr_dom_sid != 0) {
		*domain_sid = TALLOC_P(mem_ctx, DOM_SID);
		if (*domain_sid) {
			sid_copy(*domain_sid, 
				 &r.info.dns_dom_info.dom_sid.sid);


		/* Allocate memory for trusted domain names and sids */

		*domain_names = TALLOC_ARRAY(mem_ctx, char *, r.num_domains);
						r.num_domains);

		if (!*domain_names) {
			DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));

			goto done;
		}

		*domain_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.num_domains);
						 r.num_domains);
		if (!domain_sids) {
			DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
			result = NT_STATUS_NO_MEMORY;

	*enum_context = r.enum_context;
	*count = r.count;

	if (!((*privs_name = TALLOC_ARRAY(mem_ctx, char *, r.count)))) {
		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	if (!((*privs_high = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	if (!((*privs_low = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;


	/* Return output parameters */

	*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.sids.num_entries);
	if (!*sids) {
		DEBUG(0, ("(cli_lsa_enum_sids): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;

	if (r.count == 0)
		goto done;

	if (!((*set = TALLOC_ARRAY(mem_ctx, LUID_ATTR, r.count)))) {
		DEBUG(0, ("(cli_lsa_enum_privsaccount): out of memory\n"));
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;

		goto done;
	}

	*privs_name = TALLOC_ARRAY(mem_ctx, char *, *count);
	for (i=0;i<*count;i++) {
		pull_ucs2_talloc(mem_ctx, &(*privs_name)[i], r.rights.strings[i].string.buffer);
	}





	if (r.num_entries2) {
		/* allocate memory needed to return received data */	
		*rids = TALLOC_ARRAY(mem_ctx, uint32, r.num_entries2);
		if (!*rids) {
			DEBUG(0, ("Error in cli_samr_enum_dom_users(): out of memory\n"));
			return NT_STATUS_NO_MEMORY;
		}
		
		*dom_users = TALLOC_ARRAY(mem_ctx, char*, r.num_entries2);
		if (!*dom_users) {
			DEBUG(0, ("Error in cli_samr_enum_dom_users(): out of memory\n"));
			return NT_STATUS_NO_MEMORY;

	if (*num_dom_groups == 0)
		goto done;

	if (!((*dom_groups) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_dom_groups))) {
	      talloc(mem_ctx, sizeof(struct acct_info) * *num_dom_groups))) {
		result = NT_STATUS_NO_MEMORY;
		goto done;
	}

	if (*num_dom_aliases == 0)
		goto done;

	if (!((*dom_aliases) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_dom_aliases))) {
	      talloc(mem_ctx, sizeof(struct acct_info) * *num_dom_aliases))) {
		result = NT_STATUS_NO_MEMORY;
		goto done;
	}

		goto done;
	}

	if (!(*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_mem))) {
		result = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	}

	*num_names = r.num_names1;
	*names = TALLOC_ARRAY(mem_ctx, char *, r.num_names1);
	*name_types = TALLOC_ARRAY(mem_ctx, uint32, r.num_names1);

	for (i = 0; i < r.num_names1; i++) {
		fstring tmp;

	}

	*num_rids = r.num_rids1;
	*rids = TALLOC_ARRAY(mem_ctx, uint32, r.num_rids1);
	*rid_types = TALLOC_ARRAY(mem_ctx, uint32, r.num_rids1);

	for (i = 0; i < r.num_rids1; i++) {
		(*rids)[i] = r.rids[i];




        uint32 i;
        PRINTER_INFO_0  *inf;

        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_0, returned);
	memset(inf, 0, returned*sizeof(PRINTER_INFO_0));

	prs_set_offset(&buffer->prs,0);

        uint32 i;
        PRINTER_INFO_1  *inf;

        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_1, returned);
	memset(inf, 0, returned*sizeof(PRINTER_INFO_1));

	prs_set_offset(&buffer->prs,0);

        uint32 i;
        PRINTER_INFO_2  *inf;

        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_2, returned);
	memset(inf, 0, returned*sizeof(PRINTER_INFO_2));

	prs_set_offset(&buffer->prs,0);

        uint32 i;
        PRINTER_INFO_3  *inf;

        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_3, returned);
	memset(inf, 0, returned*sizeof(PRINTER_INFO_3));

	prs_set_offset(&buffer->prs,0);

	uint32 i;
	PRINTER_INFO_7  *inf;

	inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_7, returned);
	memset(inf, 0, returned*sizeof(PRINTER_INFO_7));

	prs_set_offset(&buffer->prs,0);

        uint32 i;
        PORT_INFO_1 *inf;

        inf=TALLOC_ARRAY(mem_ctx, PORT_INFO_1, returned);
	memset(inf, 0, returned*sizeof(PORT_INFO_1));

        prs_set_offset(&buffer->prs, 0);

        uint32 i;
        PORT_INFO_2 *inf;

        inf=TALLOC_ARRAY(mem_ctx, PORT_INFO_2, returned);
	memset(inf, 0, returned*sizeof(PORT_INFO_2));

        prs_set_offset(&buffer->prs, 0);

        uint32 i;
        DRIVER_INFO_1 *inf;

        inf=TALLOC_ARRAY(mem_ctx, DRIVER_INFO_1, returned);
	memset(inf, 0, returned*sizeof(DRIVER_INFO_1));

	prs_set_offset(&buffer->prs,0);

        uint32 i;
        DRIVER_INFO_2 *inf;

        inf=TALLOC_ARRAY(mem_ctx, DRIVER_INFO_2, returned);
	memset(inf, 0, returned*sizeof(DRIVER_INFO_2));

	prs_set_offset(&buffer->prs,0);

        uint32 i;
        DRIVER_INFO_3 *inf;

        inf=TALLOC_ARRAY(mem_ctx, DRIVER_INFO_3, returned);
	memset(inf, 0, returned*sizeof(DRIVER_INFO_3));

	prs_set_offset(&buffer->prs,0);

{
	DRIVER_DIRECTORY_1 *inf;
 
        inf=TALLOC_P(mem_ctx, DRIVER_DIRECTORY_1);
	memset(inf, 0, sizeof(DRIVER_DIRECTORY_1));

        prs_set_offset(&buffer->prs, 0);

{
	int i;

	*forms = TALLOC_ARRAY(mem_ctx, FORM_1, num_forms);
	prs_set_offset(&buffer->prs,0);

	for (i = 0; i < num_forms; i++)

{
	uint32 i;

	*jobs = TALLOC_ARRAY(mem_ctx, JOB_INFO_1, num_jobs);
	prs_set_offset(&buffer->prs,0);

	for (i = 0; i < num_jobs; i++) 

{
	uint32 i;

	*jobs = TALLOC_ARRAY(mem_ctx, JOB_INFO_2, num_jobs);
	prs_set_offset(&buffer->prs,0);

	for (i = 0; i < num_jobs; i++) 


	/* Return output parameters */

	value->data_p = TALLOC_MEMDUP(mem_ctx, r.data, r.needed);
	value->type = r.type;
	value->size = r.size;



	/* Return output parameters */

	value->data_p = TALLOC_MEMDUP(mem_ctx, r.data, r.needed);
	value->type = r.type;
	value->size = r.needed;


	if (value) {
		rpcstr_pull(value->valuename, r.value, sizeof(value->valuename), -1,
			    STR_TERMINATE);
		value->data_p = TALLOC_MEMDUP(mem_ctx, r.data, r.realdatasize);
		value->type = r.type;
		value->size = r.realdatasize;
	}

	/* Copy results */
	
	if (keylist) {
		*keylist = SMB_MALLOC_ARRAY(uint16, r.keys.buf_len);
		memcpy(*keylist, r.keys.buffer, r.keys.buf_len * 2);
		if (len)
			*len = r.keys.buf_len * 2;





	switch(info_level) {
	case 1:
		ctr->share.info1 = TALLOC_ARRAY(mem_ctx, SRV_SHARE_INFO_1, ctr->num_entries);
			mem_ctx, sizeof(SRV_SHARE_INFO_1) * ctr->num_entries);
		
		memset(ctr->share.info1, 0, sizeof(SRV_SHARE_INFO_1));



		break;
	case 2:
		ctr->share.info2 = TALLOC_ARRAY(mem_ctx, SRV_SHARE_INFO_2, ctr->num_entries);
			mem_ctx, sizeof(SRV_SHARE_INFO_2) * ctr->num_entries);
		
		memset(ctr->share.info2, 0, sizeof(SRV_SHARE_INFO_2));


		break;
	/* adding info-level 502 here */
	case 502:
		ctr->share.info502 = TALLOC_ARRAY(mem_ctx, SRV_SHARE_INFO_502, ctr->num_entries);
			mem_ctx, sizeof(SRV_SHARE_INFO_502) * ctr->num_entries);
		
		memset(ctr->share.info502, 0, sizeof(SRV_SHARE_INFO_502));


	
	switch(file_level) {
	case 3:
		ctr->file.info3 = TALLOC_ARRAY(mem_ctx, SRV_FILE_INFO_3, ctr->num_entries);
			mem_ctx, sizeof(SRV_FILE_INFO_3) * ctr->num_entries);

		memset(ctr->file.info3, 0, 
		       sizeof(SRV_FILE_INFO_3) * ctr->num_entries);




		depth++;
		/* should depend on whether marshalling or unmarshalling! */
		if(UNMARSHALLING(ps)) {
			ctr->dfs.info1 = PRS_ALLOC_MEM(ps, DFS_INFO_1, num_entries);
			if (!ctr->dfs.info1)
				return False;
		}

	case 2:
		depth++;
		if(UNMARSHALLING(ps)) {
			ctr->dfs.info2 = PRS_ALLOC_MEM(ps, DFS_INFO_2, num_entries);
			if (!ctr->dfs.info2)
				return False;
		}

	case 3:
		depth++;
		if(UNMARSHALLING(ps)) {
			ctr->dfs.info3 = PRS_ALLOC_MEM(ps, DFS_INFO_3, num_entries);
			if (!ctr->dfs.info3)
				return False;
		}

	depth++;

	if(UNMARSHALLING(ps)) {
		info3->storages = PRS_ALLOC_MEM(ps, DFS_STORAGE_INFO, info3->num_storage_infos);
		if (!info3->storages)
			return False;
	}

Lines 29-35 Link Here

(-)samba-3.0.9-orig/source/rpc_parse/parse_ds.c (-2 / +2 lines)
29	DSROLE_PRIMARY_DOMAIN_INFO_BASIC p = basic;	29	DSROLE_PRIMARY_DOMAIN_INFO_BASIC p = basic;
30		30
31	if ( UNMARSHALLING(ps) )	31	if ( UNMARSHALLING(ps) )
32	p = basic = (DSROLE_PRIMARY_DOMAIN_INFO_BASIC )prs_alloc_mem(ps, sizeof(DSROLE_PRIMARY_DOMAIN_INFO_BASIC));	32	p = *basic = PRS_ALLOC_MEM(ps, DSROLE_PRIMARY_DOMAIN_INFO_BASIC, 1);
33		33
34	if ( !p )	34	if ( !p )
35	return False;	35	return False;
Lines 208-214 Link Here
208		208
209	/* allocate the domain trusts array are parse it */	209	/* allocate the domain trusts array are parse it */
210		210
211	ctr->trusts = (DS_DOMAIN_TRUSTS)talloc(ps->mem_ctx, sizeof(DS_DOMAIN_TRUSTS)ctr->max_count);	211	ctr->trusts = TALLOC_ARRAY(ps->mem_ctx, DS_DOMAIN_TRUSTS, ctr->max_count);
212		212
213	if ( !ctr->trusts )	213	if ( !ctr->trusts )
214	return False;	214	return False;




		return False;

	if (UNMARSHALLING(ps)) {
		q_d->data = PRS_ALLOC_MEM(ps, char, q_d->size);

		if (!q_d->data)
			return False;

		return False;

	if (UNMARSHALLING(ps)) {
		q_d->data = PRS_ALLOC_MEM(ps, char, q_d->size);

		if (!q_d->data)
			return False;

		return False;

	if (UNMARSHALLING(ps)) {
		q_d->data = PRS_ALLOC_MEM(ps, char, q_d->size);

		if (!q_d->data)
			return False;

		return False;

	if (UNMARSHALLING(ps)) {
		q_d->data = PRS_ALLOC_MEM(ps, char, q_d->size);

		if (!q_d->data)
			return False;





	if (attr->ptr_sec_qos != 0) {
		if (UNMARSHALLING(ps))
			if (!(attr->sec_qos = PRS_ALLOC_MEM(ps,LSA_SEC_QOS,1)))
				return False;

		if(!lsa_io_sec_qos("sec_qos", attr->sec_qos, ps, depth))

		 * allocating empty arrays of unicode headers, strings
		 * and sids of enumerated trusted domains
		 */
		if (!(r_e->hdr_domain_name = TALLOC_ARRAY(ctx,UNIHDR2,num_domains))) {
			r_e->status = NT_STATUS_NO_MEMORY;
			return;
		}
		
		if (!(r_e->uni_domain_name = TALLOC_ARRAY(ctx,UNISTR2,num_domains))) {
			r_e->status = NT_STATUS_NO_MEMORY;
			return;
		}

		if (!(r_e->domain_sid = TALLOC_ARRAY(ctx,DOM_SID2,num_domains))) {
			r_e->status = NT_STATUS_NO_MEMORY;
			return;
		}

		num_domains = r_e->num_domains2;

		if (UNMARSHALLING(ps)) {
			if (!(r_e->hdr_domain_name = PRS_ALLOC_MEM(ps,UNIHDR2,num_domains)))
				return False;

			if (!(r_e->uni_domain_name = PRS_ALLOC_MEM(ps,UNISTR2,num_domains)))
				return False;

			if (!(r_e->domain_sid = PRS_ALLOC_MEM(ps,DOM_SID2,num_domains)))
				return False;
		}


		return False;

	if (UNMARSHALLING(ps)) {
		d_q->auditsettings = TALLOC_ZERO_ARRAY(ps->mem_ctx, uint32, d_q->count2);
	}

	if (d_q->auditsettings == NULL) {


	if (num_entries == 0) return;

	if ((sen->ptr_sid = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_entries )) == NULL) {
					     sizeof(uint32))) == NULL) {
		DEBUG(3, ("init_lsa_sid_enum(): out of memory for ptr_sid\n"));
		return;
	}

	if ((sen->sid = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID2, num_entries)) == NULL) {
					   sizeof(DOM_SID2))) == NULL) {
		DEBUG(3, ("init_lsa_sid_enum(): out of memory for sids\n"));
		return;
	}

	/* Mallocate memory if we're unpacking from the wire */

	if (UNMARSHALLING(ps)) {
		if ((sen->ptr_sid = PRS_ALLOC_MEM( ps, uint32, sen->num_entries)) == NULL) {
			sen->num_entries * sizeof(uint32))) == NULL) {
			DEBUG(3, ("init_lsa_sid_enum(): out of memory for "
				  "ptr_sid\n"));
			return False;
		}

		if ((sen->sid = PRS_ALLOC_MEM( ps, DOM_SID2, sen->num_entries)) == NULL) {
			sen->num_entries * sizeof(DOM_SID2))) == NULL) {
			DEBUG(3, ("init_lsa_sid_enum(): out of memory for "
				  "sids\n"));
			return False;

			return False;

		if (UNMARSHALLING(ps)) {
			if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME, trn->num_entries)) == NULL) {
			     prs_alloc_mem(ps, trn->num_entries * 
				    sizeof(LSA_TRANS_NAME))) == NULL) {
				return False;
			}

			if ((trn->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, trn->num_entries)) == NULL) {
			     prs_alloc_mem(ps, trn->num_entries *
				    sizeof(UNISTR2))) == NULL) {
				return False;
			}
		}

	q_l->num_entries2 = num_names;
	q_l->lookup_level = 1;

	if ((q_l->uni_name = TALLOC_ZERO_ARRAY(mem_ctx, UNISTR2, num_names)) == NULL) {
		mem_ctx, num_names * sizeof(UNISTR2))) == NULL) {
		DEBUG(3, ("init_q_lookup_names(): out of memory\n"));
		return;
	}

	if ((q_l->hdr_name = TALLOC_ZERO_ARRAY(mem_ctx, UNIHDR, num_names)) == NULL) {
		mem_ctx, num_names * sizeof(UNIHDR))) == NULL) {
		DEBUG(3, ("init_q_lookup_names(): out of memory\n"));
		return;
	}


	if (UNMARSHALLING(ps)) {
		if (q_r->num_entries) {
			if ((q_r->hdr_name = PRS_ALLOC_MEM(ps, UNIHDR, q_r->num_entries)) == NULL)
					q_r->num_entries * sizeof(UNIHDR))) == NULL)
				return False;
			if ((q_r->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, q_r->num_entries)) == NULL)
					q_r->num_entries * sizeof(UNISTR2))) == NULL)
				return False;
		}
	}

		}

		if (UNMARSHALLING(ps)) {
			if ((r_r->dom_rid = PRS_ALLOC_MEM(ps, DOM_RID2, r_r->num_entries2))
			    == NULL) {
				DEBUG(3, ("lsa_io_r_lookup_names(): out of memory\n"));
				return False;

			return False;

		if (UNMARSHALLING(ps))
			if (!(r_q->privs = PRS_ALLOC_MEM(ps, LSA_PRIV_ENTRY, r_q->count1)))
				return False;

		if (!lsa_io_priv_entries("", r_q->privs, r_q->count1, ps, depth))

			if (!NT_STATUS_IS_OK(init_priv_with_ctx(ps->mem_ctx, &(r_c->set))))
				return False;

			if (!(r_c->set->set = PRS_ALLOC_MEM(ps,LUID_ATTR,r_c->count)))
				return False;

		}

		if (!NT_STATUS_IS_OK(init_priv_with_ctx(ps->mem_ctx, &(r_c->set))))
			return False;
		
		if (!(r_c->set->set = PRS_ALLOC_MEM(ps, LUID_ATTR, r_c->count)))
			return False;
	}
	

			if (!NT_STATUS_IS_OK(init_priv_with_ctx(ps->mem_ctx, &(r_c->set))))
				return False;

			if (!(r_c->set->set = PRS_ALLOC_MEM(ps, LUID_ATTR, r_c->count)))
				return False;
		}





		return;
	}
		

	len = strlen(buf) + 1;
	len = MAX(len,MAX_UNISTRLEN);

	str->buffer = TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, len);
		len = MAX_UNISTRLEN;
	len *= sizeof(uint16);

	str->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len);
	if (str->buffer == NULL)
		smb_panic("init_unistr: malloc fail\n");

	rpcstr_push(str->buffer, buf, len*sizeof(uint16), STR_TERMINATE);
}

/*******************************************************************


static void create_buffer3(BUFFER3 *str, size_t len)
{
	len = MAX(len,MAX_BUFFERLEN);
		len = MAX_BUFFERLEN;

	str->buffer = TALLOC_ZERO(get_talloc_ctx(), len);
	if (str->buffer == NULL)
		smb_panic("create_buffer3: talloc fail\n");


		return False;

	if (UNMARSHALLING(ps)) {
		buf3->buffer = PRS_ALLOC_MEM(ps, unsigned char, buf3->buf_max_len);
		if (buf3->buffer == NULL)
			return False;
	}

	str->buf_len = buf != NULL ? len : 0;

	if (buf != NULL) {
		len = MAX(len,MAX_BUFFERLEN);
		str->buffer = TALLOC_ZERO(get_talloc_ctx(), len);
		str->buffer = talloc_zero(get_talloc_ctx(), len);
		if (str->buffer == NULL)
			smb_panic("init_buffer2: talloc fail\n");
		memcpy(str->buffer, buf, MIN(str->buf_len, len));

	   (the the length of the source string) to prevent
	   reallocation of memory. */
	if (str->buffer == NULL) {
		size_t alloc_len = MAX(from->uni_max_len,MAX_UNISTRLEN);
   		str->buffer = (uint16 *)TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, alloc_len);
		if ((str->buffer == NULL)) {
			len = MAX_UNISTRLEN;
		len *= sizeof(uint16);

   		str->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len);
		if ((str->buffer == NULL) && (len > 0 )) {
			smb_panic("copy_unistr2: talloc fail\n");
			return;
		}


void init_string2(STRING2 *str, const char *buf, int max_len, int str_len)
{
	int alloc_len = 0;

	/* set up string lengths. */
	str->str_max_len = max_len;
	str->offset = 0;


	/* store the string */
	if(str_len != 0) {
		int alloc_len = MAX(str_len, MAX_STRINGLEN);
		str->buffer = TALLOC_ZERO(get_talloc_ctx(), alloc_len);
		str->buffer = talloc_zero(get_talloc_ctx(), alloc_len);
		if (str->buffer == NULL)
			smb_panic("init_string2: malloc fail\n");
		memcpy(str->buffer, buf, str_len);

		len = strlen(buf) + 1;
	}

	len = MAX(len,MAX_UNISTRLEN);
		len = MAX_UNISTRLEN;
	len *= sizeof(uint16);

	str->buffer = TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, len);
	if (str->buffer == NULL) {
		smb_panic("init_unistr2: malloc fail\n");
		return;
	}

	/* Ensure len is the length in *bytes* */
	len *= sizeof(uint16);

	/*
	 * The UNISTR2 must be initialized !!!
	 * jfm, 7/7/2001.

void init_unistr2_w(TALLOC_CTX *ctx, UNISTR2 *str, const smb_ucs2_t *buf)
{
	uint32 len = strlen_w(buf);
	uint32 max_len = len;
	uint32 alloc_len;

	ZERO_STRUCTP(str);

	str->offset = 0;
	str->uni_str_len = len;

	alloc_len = MAX((len + 1), MAX_UNISTRLEN);
		max_len = MAX_UNISTRLEN;

	alloc_len = (max_len + 1) * sizeof(uint16);

	str->buffer = TALLOC_ZERO_ARRAY(ctx, uint16, alloc_len);
	if (str->buffer == NULL) {
		smb_panic("init_unistr2_w: malloc fail\n");
		return;
	}

	to->uni_str_len = i;

	/* allocate the space and copy the string buffer */
	to->buffer = TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, i);
	if (to->buffer == NULL)
		smb_panic("init_unistr2_from_unistr: malloc fail\n");
	memcpy(to->buffer, from->buffer, i*sizeof(uint16));
	return;
}


		return True;
	}

	array->strings = TALLOC_ZERO_ARRAY(get_talloc_ctx(), UNISTR2_ARRAY_EL, count );
	if (!array->strings) {
		return False;
	}

	}

	if (UNMARSHALLING(ps)) {
		array->strings = TALLOC_ZERO_ARRAY(get_talloc_ctx(), UNISTR2_ARRAY_EL, array->count );
	}
	if (! array->strings) {
		return False;


void init_unistr3(UNISTR3 *str, const char *buf)
{
	size_t len, alloc_len;

	if (buf == NULL) {
		str->uni_str_len=0;


	str->uni_str_len=len;

	alloc_len = MAX(len, MAX_UNISTRLEN);
		len = MAX_UNISTRLEN;

	len *= sizeof(uint16);

	str->str.buffer = TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, alloc_len);
	if (str->str.buffer == NULL)
		smb_panic("init_unistr3: malloc fail\n");

	rpcstr_push((char *)str->str.buffer, buf, len * sizeof(uint16), STR_TERMINATE);
}

/*******************************************************************




		}

		/* Now allocate space for them. */
		*ppsids = TALLOC_ZERO_ARRAY(ctx, DOM_SID2, count);
		if (*ppsids == NULL)
			return 0;


	depth++;

	if (UNMARSHALLING(ps)) {
		ctr = *pp_ctr = PRS_ALLOC_MEM(ps, NET_ID_INFO_CTR, 1);
		if (ctr == NULL)
			return False;
	}


	usr->num_groups2 = num_groups;

	usr->gids = TALLOC_ZERO_ARRAY(ctx,DOM_GID,num_groups);
	if (usr->gids == NULL && num_groups>0)
		return;


		return False;

	if (UNMARSHALLING(ps) && usr->num_groups2 > 0) {
		usr->gids = PRS_ALLOC_MEM(ps, DOM_GID, usr->num_groups2);
		if (usr->gids == NULL)
			return False;
	}

	if (usr->num_other_sids) {

		if (UNMARSHALLING(ps)) {
			usr->other_sids = PRS_ALLOC_MEM(ps, DOM_SID2, usr->num_other_sids);
			if (usr->other_sids == NULL)
				return False;
		}

			return False;

		if (UNMARSHALLING(ps) && usr->num_other_groups > 0) {
			usr->other_gids = PRS_ALLOC_MEM(ps, DOM_GID, usr->num_other_groups);
			if (usr->other_gids == NULL)
				return False;
		}

			return False;
		}

                info->rids = TALLOC_ARRAY(ps->mem_ctx, uint32, info->num_members2);
                                    info->num_members2);

                if (info->rids == NULL) {
                        DEBUG(0, ("out of memory allocating %d rids\n",

			return False;
		}

                info->attribs = TALLOC_ARRAY(ps->mem_ctx, uint32, info->num_members3);
                                       info->num_members3);

                if (info->attribs == NULL) {
                        DEBUG(0, ("out of memory allocating %d attribs\n",

			return False;
		}

                info->ptr_sids = TALLOC_ARRAY(ps->mem_ctx, uint32, info->num_sids);
                                        info->num_sids);
                
                if (info->ptr_sids == NULL) {
                        DEBUG(0, ("out of memory allocating %d ptr_sids\n",

                                return False;
		}

                info->sids = TALLOC_ARRAY(ps->mem_ctx, DOM_SID2, info->num_sids);
                                    info->num_sids);

                if (info->sids == NULL) {
                        DEBUG(0, ("error allocating %d sids\n",

	if(!prs_uint32("attribute_count", ps, depth, &info->attribute_count))
                return False;

	info->attributes = TALLOC_ARRAY(ps->mem_ctx, uint32, info->attribute_count);

	for (i=0; i<info->attribute_count; i++)
		if(!prs_uint32("attributes", ps, depth, &info->attributes[i]))

	if(!prs_uint32("privlist_count", ps, depth, &info->privlist_count))
                return False;

	info->hdr_privslist = TALLOC_ARRAY(ps->mem_ctx, UNIHDR, info->privlist_count);
	info->uni_privslist = TALLOC_ARRAY(ps->mem_ctx, UNISTR2, info->privlist_count);

	for (i=0; i<info->privlist_count; i++)
		if(!smb_io_unihdr("hdr_privslist", &info->hdr_privslist[i], ps, depth))

			}

                        if (r_s->num_deltas2 > 0) {
                                r_s->hdr_deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_HDR, r_s->num_deltas2);
                                        talloc(ps->mem_ctx, r_s->num_deltas2 *
                                               sizeof(SAM_DELTA_HDR));
                          
                                if (r_s->hdr_deltas == NULL) {
                                        DEBUG(0, ("error tallocating memory "
                                                  "for %d delta headers\n", 

			}

                        if (r_s->num_deltas2 > 0) {
                                r_s->deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_CTR, r_s->num_deltas2);
                                        talloc(ps->mem_ctx, r_s->num_deltas2 *
                                               sizeof(SAM_DELTA_CTR));

                                if (r_s->deltas == NULL) {
                                        DEBUG(0, ("error tallocating memory "
                                                  "for %d deltas\n", 

		if (r_s->ptr_deltas != 0)
		{
                        if (r_s->num_deltas > 0) {
                                r_s->hdr_deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_HDR, r_s->num_deltas);
                                        talloc(ps->mem_ctx, r_s->num_deltas *
                                               sizeof(SAM_DELTA_HDR));
                                if (r_s->hdr_deltas == NULL) {
                                        DEBUG(0, ("error tallocating memory "
                                                  "for %d delta headers\n", 

			}
                        
                        if (r_s->num_deltas > 0) {
                                r_s->deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_CTR, r_s->num_deltas);
                                        talloc(ps->mem_ctx, r_s->num_deltas *
                                               sizeof(SAM_DELTA_CTR));

                                if (r_s->deltas == NULL) {
                                        DEBUG(0, ("error tallocating memory "
                                                  "for %d deltas\n", 

Lines 105-111 Link Here

(-)samba-3.0.9-orig/source/rpc_parse/parse_prs.c (-15 / +22 lines)
105		105
106	if (size != 0) {	106	if (size != 0) {
107	ps->buffer_size = size;	107	ps->buffer_size = size;
108	if((ps->data_p = (char *)malloc((size_t)size)) == NULL) {	108	if((ps->data_p = (char *)SMB_MALLOC((size_t)size)) == NULL) {
109	DEBUG(0,("prs_init: malloc fail for %u bytes.\n", (unsigned int)size));	109	DEBUG(0,("prs_init: malloc fail for %u bytes.\n", (unsigned int)size));
110	return False;	110	return False;
111	}	111	}
Lines 143-156 Link Here
143	Allocate memory when unmarshalling... Always zero clears.	143	Allocate memory when unmarshalling... Always zero clears.
144	********************************************************************/	144	********************************************************************/
145		145
146	char prs_alloc_mem(prs_struct ps, size_t size)	146	#if defined(PARANOID_MALLOC_CHECKER)
		147	char prs_alloc_mem_(prs_struct ps, size_t size, unsigned int count)
		148	#else
		149	char prs_alloc_mem(prs_struct ps, size_t size, unsigned int count)
		150	#endif
147	{	151	{
148	char *ret = NULL;	152	char *ret = NULL;
149		153
150	if (size) {	154	if (size) {
151	ret = talloc(ps->mem_ctx, size);	155	/* We can't call the type-safe version here. */
152	if (ret)	156	#if defined(PARANOID_MALLOC_CHECKER)
153	memset(ret, '\0', size);	157	ret = talloc_zero_array_(ps->mem_ctx, size, count);
		158	#else
		159	ret = talloc_zero_array(ps->mem_ctx, size, count);
		160	#endif
154	}	161	}
155	return ret;	162	return ret;
156	}	163	}
Lines 199-205 Link Here
199	return prs_force_grow(ps, newsize - ps->buffer_size);	206	return prs_force_grow(ps, newsize - ps->buffer_size);
200		207
201	if (newsize < ps->buffer_size) {	208	if (newsize < ps->buffer_size) {
202	char *new_data_p = Realloc(ps->data_p, newsize);	209	char *new_data_p = SMB_REALLOC(ps->data_p, newsize);
203	/* if newsize is zero, Realloc acts like free() & returns NULL*/	210	/* if newsize is zero, Realloc acts like free() & returns NULL*/
204	if (new_data_p == NULL && newsize != 0) {	211	if (new_data_p == NULL && newsize != 0) {
205	DEBUG(0,("prs_set_buffer_size: Realloc failure for size %u.\n",	212	DEBUG(0,("prs_set_buffer_size: Realloc failure for size %u.\n",
Lines 253-259 Link Here
253		260
254	new_size = MAX(MAX_PDU_FRAG_LEN,extra_space);	261	new_size = MAX(MAX_PDU_FRAG_LEN,extra_space);
255		262
256	if((new_data = malloc(new_size)) == NULL) {	263	if((new_data = SMB_MALLOC(new_size)) == NULL) {
257	DEBUG(0,("prs_grow: Malloc failure for size %u.\n", (unsigned int)new_size));	264	DEBUG(0,("prs_grow: Malloc failure for size %u.\n", (unsigned int)new_size));
258	return False;	265	return False;
259	}	266	}
Lines 265-271 Link Here
265	*/	272	*/
266	new_size = MAX(ps->buffer_size*2, ps->buffer_size + extra_space);	273	new_size = MAX(ps->buffer_size*2, ps->buffer_size + extra_space);
267		274
268	if ((new_data = Realloc(ps->data_p, new_size)) == NULL) {	275	if ((new_data = SMB_REALLOC(ps->data_p, new_size)) == NULL) {
269	DEBUG(0,("prs_grow: Realloc failure for size %u.\n",	276	DEBUG(0,("prs_grow: Realloc failure for size %u.\n",
270	(unsigned int)new_size));	277	(unsigned int)new_size));
271	return False;	278	return False;
Lines 296-302 Link Here
296	return False;	303	return False;
297	}	304	}
298		305
299	if((new_data = Realloc(ps->data_p, new_size)) == NULL) {	306	if((new_data = SMB_REALLOC(ps->data_p, new_size)) == NULL) {
300	DEBUG(0,("prs_force_grow: Realloc failure for size %u.\n",	307	DEBUG(0,("prs_force_grow: Realloc failure for size %u.\n",
301	(unsigned int)new_size));	308	(unsigned int)new_size));
302	return False;	309	return False;
Lines 886-892 Link Here
886	return False;	893	return False;
887		894
888	if (UNMARSHALLING(ps)) {	895	if (UNMARSHALLING(ps)) {
889	str->buffer = (uint16 )prs_alloc_mem(ps,str->buf_len sizeof(uint16));	896	str->buffer = PRS_ALLOC_MEM(ps,uint16,str->buf_len);
890	if (str->buffer == NULL)	897	if (str->buffer == NULL)
891	return False;	898	return False;
892	}	899	}
Lines 918-924 Link Here
918		925
919	if (UNMARSHALLING(ps)) {	926	if (UNMARSHALLING(ps)) {
920	if ( str->buf_len ) {	927	if ( str->buf_len ) {
921	str->buffer = (uint16 *)prs_alloc_mem(ps,str->buf_len);	928	str->buffer = PRS_ALLOC_MEM(ps, uint16, str->buf_len);
922	if ( str->buffer == NULL )	929	if ( str->buffer == NULL )
923	return False;	930	return False;
924	}	931	}
Lines 945-951 Link Here
945	return False;	952	return False;
946		953
947	if (UNMARSHALLING(ps)) {	954	if (UNMARSHALLING(ps)) {
948	str->buffer = (unsigned char *)prs_alloc_mem(ps,str->str_max_len);	955	str->buffer = PRS_ALLOC_MEM(ps,unsigned char, str->str_max_len);
949	if (str->buffer == NULL)	956	if (str->buffer == NULL)
950	return False;	957	return False;
951	}	958	}
Lines 989-995 Link Here
989	return True;	996	return True;
990		997
991	if (UNMARSHALLING(ps)) {	998	if (UNMARSHALLING(ps)) {
992	str->buffer = (uint16 )prs_alloc_mem(ps,str->uni_max_len sizeof(uint16));	999	str->buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_max_len);
993	if (str->buffer == NULL)	1000	if (str->buffer == NULL)
994	return False;	1001	return False;
995	}	1002	}
Lines 1016-1022 Link Here
1016	return False;	1023	return False;
1017		1024
1018	if (UNMARSHALLING(ps)) {	1025	if (UNMARSHALLING(ps)) {
1019	str->str.buffer = (uint16 )prs_alloc_mem(ps,str->uni_str_len sizeof(uint16));	1026	str->str.buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_str_len);
1020	if (str->str.buffer == NULL)	1027	if (str->str.buffer == NULL)
1021	return False;	1028	return False;
1022	}	1029	}
Lines 1109-1115 Link Here
1109	alloc_len += 1;	1116	alloc_len += 1;
1110		1117
1111	/* should we allocate anything at all? */	1118	/* should we allocate anything at all? */
1112	str->buffer = (uint16 )prs_alloc_mem(ps,alloc_len sizeof(uint16));	1119	str->buffer = PRS_ALLOC_MEM(ps,uint16,alloc_len);
1113	if ((str->buffer == NULL) && (alloc_len > 0))	1120	if ((str->buffer == NULL) && (alloc_len > 0))
1114	return False;	1121	return False;
1115		1122




			return False;

		if (UNMARSHALLING(ps) && (r_u->num_entries2 != 0)) {
			r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY, r_u->num_entries2);
			r_u->uni_acct_name = PRS_ALLOC_MEM(ps,UNISTR2, r_u->num_entries2);
		}

		if ((r_u->sam == NULL || r_u->uni_acct_name == NULL) && r_u->num_entries2 != 0) {

	if (num_entries==0)
		return NT_STATUS_OK;

	sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY1, num_entries);
	if (!sam->sam)
		return NT_STATUS_NO_MEMORY;

	sam->str=TALLOC_ARRAY(ctx, SAM_STR1, num_entries);
	if (!sam->str)
		return NT_STATUS_NO_MEMORY;



	if (UNMARSHALLING(ps) && num_entries > 0) {

		if ((sam->sam = PRS_ALLOC_MEM(ps, SAM_ENTRY1, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_ENTRY1) *
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_ENTRY1\n"));
			return False;
		}

		if ((sam->str = PRS_ALLOC_MEM(ps, SAM_STR1, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_STR1) * 
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_STR1\n"));
			return False;
		}

	if (num_entries==0)
		return NT_STATUS_OK;

	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY2, num_entries)))
		return NT_STATUS_NO_MEMORY;

	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR2, num_entries)))
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(sam->sam);


	if (UNMARSHALLING(ps) && num_entries > 0) {

		if ((sam->sam = PRS_ALLOC_MEM(ps, SAM_ENTRY2, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_ENTRY2) *
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_ENTRY2\n"));
			return False;
		}

		if ((sam->str = PRS_ALLOC_MEM(ps, SAM_STR2, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_STR2) * 
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_STR2\n"));
			return False;
		}

	if (num_entries==0)
		return NT_STATUS_OK;

	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY3, num_entries)))
		return NT_STATUS_NO_MEMORY;

	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR3, num_entries)))
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(sam->sam);


	if (UNMARSHALLING(ps) && num_entries > 0) {

		if ((sam->sam = PRS_ALLOC_MEM(ps, SAM_ENTRY3, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_ENTRY3) *
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_ENTRY3\n"));
			return False;
		}

		if ((sam->str = PRS_ALLOC_MEM(ps, SAM_STR3, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_STR3) * 
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_STR3\n"));
			return False;
		}

	if (num_entries==0)
		return NT_STATUS_OK;

	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY4, num_entries)))
		return NT_STATUS_NO_MEMORY;

	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR4, num_entries)))
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(sam->sam);


	if (UNMARSHALLING(ps) && num_entries > 0) {

		if ((sam->sam = PRS_ALLOC_MEM(ps, SAM_ENTRY4, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_ENTRY4) *
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_ENTRY4\n"));
			return False;
		}

		if ((sam->str = PRS_ALLOC_MEM(ps, SAM_STR4, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_STR4) * 
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_STR4\n"));
			return False;
		}

	if (num_entries==0)
		return NT_STATUS_OK;

	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY5, num_entries)))
		return NT_STATUS_NO_MEMORY;

	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR5, num_entries)))
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(sam->sam);


	if (UNMARSHALLING(ps) && num_entries > 0) {

		if ((sam->sam = PRS_ALLOC_MEM(ps, SAM_ENTRY5, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_ENTRY5) *
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_ENTRY5\n"));
			return False;
		}

		if ((sam->str = PRS_ALLOC_MEM(ps, SAM_STR5, num_entries)) == NULL) {
		     prs_alloc_mem(ps, sizeof(SAM_STR5) * 
				   num_entries)) == NULL) {
			DEBUG(0, ("out of memory allocating SAM_STR5\n"));
			return False;
		}

				prs_struct *ps, int depth)
{
	if (UNMARSHALLING(ps))
		*ctr = PRS_ALLOC_MEM(ps,GROUP_INFO_CTR,1);

	if (*ctr == NULL)
		return False;

			if(!prs_uint32("num_rids", ps, depth, &r_u->num_rids))
				return False;
			if (UNMARSHALLING(ps) && r_u->num_rids != 0) {
				r_u->rid = PRS_ALLOC_MEM(ps,uint32,r_u->num_rids);
				if (r_u->rid == NULL)
					return False;
			}

				return False;

			if (UNMARSHALLING(ps) && r_u->num_attrs != 0) {
				r_u->attr = PRS_ALLOC_MEM(ps,uint32,r_u->num_attrs);
				if (r_u->attr == NULL)
					return False;
			}


	if ((*num_gids) != 0) {
		if (UNMARSHALLING(ps)) {
			(*gid) = PRS_ALLOC_MEM(ps,DOM_GID,*num_gids);
		}

		if ((*gid) == NULL) {

			return False;

		if (UNMARSHALLING(ps)) {
			r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2);
			r_u->uni_dom_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2);
		}

		if ((r_u->sam == NULL || r_u->uni_dom_name == NULL) && r_u->num_entries2 != 0) {

			return False;

		if (UNMARSHALLING(ps)) {
			r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2);
			r_u->uni_grp_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2);
		}

		if ((r_u->sam == NULL || r_u->uni_grp_name == NULL) && r_u->num_entries2 != 0) {

			return False;

		if (UNMARSHALLING(ps) && (r_u->num_entries2 > 0)) {
			r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2);
			r_u->uni_grp_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2);
		}

		if (r_u->num_entries2 != 0 && 

		return False;

	if (UNMARSHALLING(ps) && (q_u->num_sids2 != 0)) {
		q_u->ptr_sid = PRS_ALLOC_MEM(ps,uint32,q_u->num_sids2);
		if (q_u->ptr_sid == NULL)
			return False;

		q_u->sid = PRS_ALLOC_MEM(ps, DOM_SID2, q_u->num_sids2);
		if (q_u->sid == NULL)
			return False;
	}

	if ((*num_rids) != 0) {
		if (UNMARSHALLING(ps)) {
			/* reading */
			(*rid) = PRS_ALLOC_MEM(ps,uint32, *num_rids);
		}
		if ((*rid) == NULL)
			return False;

	q_u->flags = flags;
	q_u->ptr = 0;
	q_u->num_rids2 = num_rids;
	q_u->rid = TALLOC_ZERO_ARRAY(ctx, uint32, num_rids );
	if (q_u->rid == NULL) {
		q_u->num_rids1 = 0;
		q_u->num_rids2 = 0;

		return False;

	if (UNMARSHALLING(ps) && (q_u->num_rids2 != 0)) {
		q_u->rid = PRS_ALLOC_MEM(ps, uint32, q_u->num_rids2);
		if (q_u->rid == NULL)
			return False;
	}



		if (UNMARSHALLING(ps) && (r_u->num_names2 != 0)) {
			r_u->hdr_name = PRS_ALLOC_MEM(ps, UNIHDR, r_u->num_names2);
			if (r_u->hdr_name == NULL)
				return False;

			r_u->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, r_u->num_names2);
			if (r_u->uni_name == NULL)
				return False;
		}

			return False;

		if (UNMARSHALLING(ps) && (r_u->num_types2 != 0)) {
			r_u->type = PRS_ALLOC_MEM(ps, uint32, r_u->num_types2);
			if (r_u->type == NULL)
				return False;
		}

		if(!prs_uint32("num_sids1", ps, depth, &r_u->num_sids1))
			return False;

		ptr_sid = TALLOC_ARRAY(ps->mem_ctx, uint32, r_u->num_sids1);
		if (!ptr_sid) {
			return False;
		}

		}
		
		if (UNMARSHALLING(ps)) {
			r_u->sid = TALLOC_ARRAY(ps->mem_ctx, DOM_SID2, r_u->num_sids1);
		}
		
		for (i = 0; i < r_u->num_sids1; i++) {

	q_u->ptr = 0;
	q_u->num_names2 = num_names;

	if (!(q_u->hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR, num_names)))
		return NT_STATUS_NO_MEMORY;

	if (!(q_u->uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_names)))
		return NT_STATUS_NO_MEMORY;

	for (i = 0; i < num_names; i++) {

		return False;

	if (UNMARSHALLING(ps) && (q_u->num_names2 != 0)) {
		q_u->hdr_name = PRS_ALLOC_MEM(ps, UNIHDR, q_u->num_names2);
		q_u->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, q_u->num_names2);
		q_u->uni_name = (UNISTR2 *)prs_alloc_mem(ps, sizeof(UNISTR2) *
							 q_u->num_names2);
		if (!q_u->hdr_name || !q_u->uni_name)
			return False;
	}

		r_u->ptr_rids = 1;
		r_u->num_rids2 = num_rids;

		if (!(r_u->rids = TALLOC_ZERO_ARRAY(ctx, uint32, num_rids)))
			return NT_STATUS_NO_MEMORY;
		if (!(r_u->types = TALLOC_ZERO_ARRAY(ctx, uint32, num_rids)))
			return NT_STATUS_NO_MEMORY;

		if (!r_u->rids || !r_u->types)

		}

		if (UNMARSHALLING(ps))
			r_u->rids = PRS_ALLOC_MEM(ps, uint32, r_u->num_rids2);

		if (!r_u->rids) {
			DEBUG(0, ("NULL rids in samr_io_r_lookup_names\n"));

		}

		if (UNMARSHALLING(ps))
			r_u->types = PRS_ALLOC_MEM(ps, uint32, r_u->num_types2);

		if (!r_u->types) {
			DEBUG(0, ("NULL types in samr_io_r_lookup_names\n"));


	switch (switch_value) {
	case 0x10:
		ctr->info.id10 = TALLOC_ZERO_P(ctx,SAM_USER_INFO_10);
		if (ctr->info.id10 == NULL)
			return NT_STATUS_NO_MEMORY;


			expire.low = 0xffffffff;
			expire.high = 0x7fffffff;

			ctr->info.id = TALLOC_ZERO_P(ctx,SAM_USER_INFO_11);
			init_sam_user_info11(ctr->info.id11, &expire,
					     "BROOKFIELDS$",	/* name */
					     0x03ef,	/* user rid */

		}
#endif
	case 0x12:
		ctr->info.id12 = TALLOC_ZERO_P(ctx,SAM_USER_INFO_12);
		if (ctr->info.id12 == NULL)
			return NT_STATUS_NO_MEMORY;


	case 21:
		{
			SAM_USER_INFO_21 *cusr;
			cusr = TALLOC_ZERO_P(ctx,SAM_USER_INFO_21);
			ctr->info.id21 = cusr;
			if (ctr->info.id21 == NULL)
				return NT_STATUS_NO_MEMORY;

	depth++;

	if (UNMARSHALLING(ps)) {
		ctr = PRS_ALLOC_MEM(ps,SAM_USERINFO_CTR,1);
		if (ctr == NULL)
			return False;
		*ppctr = ctr;

	switch (ctr->switch_value) {
	case 0x10:
		if (UNMARSHALLING(ps))
			ctr->info.id10 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_10,1);
		if (ctr->info.id10 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
			return False;

		break;
	case 0x11:
		if (UNMARSHALLING(ps))
			ctr->info.id11 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_11,1);

		if (ctr->info.id11 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));

		break;
	case 0x12:
		if (UNMARSHALLING(ps))
			ctr->info.id12 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_12,1);

		if (ctr->info.id12 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));

		break;
	case 20:
		if (UNMARSHALLING(ps))
			ctr->info.id20 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_20,1);

		if (ctr->info.id20 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));

		break;
	case 21:
		if (UNMARSHALLING(ps))
			ctr->info.id21 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_21,1);

		if (ctr->info.id21 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));

		break;
	case 23:
		if (UNMARSHALLING(ps))
			ctr->info.id23 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_23,1);

		if (ctr->info.id23 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));

		break;
	case 24:
		if (UNMARSHALLING(ps))
			ctr->info.id24 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_24,1);

		if (ctr->info.id24 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));

		break;
	case 25:
		if (UNMARSHALLING(ps))
			ctr->info.id25 = PRS_ALLOC_MEM(ps,SAM_USER_INFO_25,1);

		if (ctr->info.id25 == NULL) {
			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));

	if(!prs_align(ps))
		return False;

	if ((q_u->ctr = PRS_ALLOC_MEM(ps, SAM_UNK_CTR, 1)) == NULL)
		return False;
	
	switch (q_u->switch_value) {




		/*
		 * This is a read and we must allocate the stuct to read into.
		 */
		if((psa = PRS_ALLOC_MEM(ps, SEC_ACL, 1)) == NULL)
			return False;
		*ppsa = psa;
	}

		 * between a non-present DACL (allow all access) and a DACL with no ACE's
		 * (allow no access).
		 */
		if((psa->ace = PRS_ALLOC_MEM(ps, SEC_ACE, psa->num_aces+1)) == NULL)
			return False;
	}



	if (psd == NULL) {
		if(UNMARSHALLING(ps)) {
			if((psd = PRS_ALLOC_MEM(ps,SEC_DESC,1)) == NULL)
				return False;
			*ppsd = psd;
		} else {


		if (UNMARSHALLING(ps)) {
			/* reading */
			if((psd->owner_sid = PRS_ALLOC_MEM(ps,DOM_SID,1)) == NULL)
				return False;
		}



		if (UNMARSHALLING(ps)) {
			/* reading */
			if((psd->grp_sid = PRS_ALLOC_MEM(ps,DOM_SID,1)) == NULL)
				return False;
		}


	psdb = *ppsdb;

	if (UNMARSHALLING(ps) && psdb == NULL) {
		if((psdb = PRS_ALLOC_MEM(ps,SEC_DESC_BUF,1)) == NULL)
			return False;
		*ppsdb = psdb;
	}





	/* reading */
	if (UNMARSHALLING(ps))
		if((ctr->type=PRS_ALLOC_MEM(ps,SPOOL_NOTIFY_OPTION_TYPE,ctr->count)) == NULL)
			return False;
		
	/* the option type struct */


	case NOTIFY_STRING:

		if (UNMARSHALLING(ps)) {
			data->notify_data.data.string = 
				(uint16 *)prs_alloc_mem(ps, data->notify_data.data.length);

			if (!data->notify_data.data.string) 
				return False;
		}

		if (MARSHALLING(ps))
			data->notify_data.data.length /= 2;

		if(!prs_uint32("string length", ps, depth, &data->notify_data.data.length))
			return False;

		if (UNMARSHALLING(ps)) {
			data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16,
								data->notify_data.data.length);

			if (!data->notify_data.data.string) 
				return False;
		}

		if (!prs_uint16uni(True, "string", ps, depth, data->notify_data.data.string,
				   data->notify_data.data.length))
			return False;

	case NOTIFY_POINTER:

		if (UNMARSHALLING(ps)) {
			data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16,
								data->notify_data.data.length);

			if (!data->notify_data.data.string) 
				return False;


			/* Tallocate memory for string */

			data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16, x * 2);
			if (!data->notify_data.data.string) 
				return False;


	depth++;

	if (UNMARSHALLING(ps)) {
		devmode->devicename.buffer = PRS_ALLOC_MEM(ps, uint16, 32);
		if (devmode->devicename.buffer == NULL)
			return False;
	}

		return False;

	if (UNMARSHALLING(ps)) {
		devmode->formname.buffer = PRS_ALLOC_MEM(ps, uint16, 32);
		if (devmode->formname.buffer == NULL)
			return False;
	}


	if (devmode->driverextra!=0) {
		if (UNMARSHALLING(ps)) {
			devmode->private=PRS_ALLOC_MEM(ps, uint8, devmode->driverextra);
			if(devmode->private == NULL)
				return False;
			DEBUG(7,("spoolss_io_devmode: allocated memory [%d] for private\n",devmode->driverextra)); 

	/* so we have a DEVICEMODE to follow */		
	if (UNMARSHALLING(ps)) {
		DEBUG(9,("Allocating memory for spoolss_io_devmode\n"));
		dm_c->devmode=PRS_ALLOC_MEM(ps,DEVICEMODE,1);
		if(dm_c->devmode == NULL)
			return False;
	}

	SPOOL_PRINTER_INFO_LEVEL_2 *inf;

	/* allocate the necessary memory */
	if (!(inf=TALLOC_P(mem_ctx, SPOOL_PRINTER_INFO_LEVEL_2))) {
		DEBUG(0,("make_spoolss_printer_info_2: Unable to allocate SPOOL_PRINTER_INFO_LEVEL_2 sruct!\n"));
		return False;
	}

	SPOOL_PRINTER_INFO_LEVEL_3 *inf;

	/* allocate the necessary memory */
	if (!(inf=TALLOC_P(mem_ctx, SPOOL_PRINTER_INFO_LEVEL_3))) {
		DEBUG(0,("make_spoolss_printer_info_3: Unable to allocate SPOOL_PRINTER_INFO_LEVEL_3 sruct!\n"));
		return False;
	}

	SPOOL_PRINTER_INFO_LEVEL_7 *inf;

	/* allocate the necessary memory */
	if (!(inf=TALLOC_P(mem_ctx, SPOOL_PRINTER_INFO_LEVEL_7))) {
		DEBUG(0,("make_spoolss_printer_info_7: Unable to allocate SPOOL_PRINTER_INFO_LEVEL_7 struct!\n"));
		return False;
	}

		return False;
	
	if (UNMARSHALLING(ps) && r_u->size) {
		r_u->data = PRS_ALLOC_MEM(ps, unsigned char, r_u->size);
		if(!r_u->data)
			return False;
	}

	if (q_u->buffer_size!=0)
	{
		if (UNMARSHALLING(ps))
			q_u->buffer=PRS_ALLOC_MEM(ps, uint8, q_u->buffer_size);
		if(q_u->buffer == NULL)
			return False;	
		if(!prs_uint8s(True, "buffer", ps, depth, q_u->buffer, q_u->buffer_size))

	if (q_u->option_ptr!=0) {
	
		if (UNMARSHALLING(ps))
			if((q_u->option=PRS_ALLOC_MEM(ps,SPOOL_NOTIFY_OPTION,1)) == NULL)
				return False;
	
		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))

	if (q_u->option_ptr!=0) {
	
		if (UNMARSHALLING(ps))
			if((q_u->option=PRS_ALLOC_MEM(ps,SPOOL_NOTIFY_OPTION,1)) == NULL)
				return False;
	
		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))


			/* Yes this should be malloc not talloc. Don't change. */

			chaine.buffer = SMB_MALLOC((q-p+1)*sizeof(uint16));
			if (chaine.buffer == NULL)
				return False;



				/* Yes this should be realloc - it's freed below. JRA */

				if((tc2=(uint16 *)SMB_REALLOC(chaine2, realloc_size)) == NULL) {
					SAFE_FREE(chaine2);
					return False;
				}

		if (chaine2)
		{
			chaine2[l_chaine2] = '\0';
			*string=(uint16 *)TALLOC_MEMDUP(prs_get_mem_context(ps),chaine2,realloc_size);
			SAFE_FREE(chaine2);
		}


			return False;

		/* read the string */
		if((*devmode=PRS_ALLOC_MEM(ps,DEVICEMODE,1)) == NULL)
			return False;
		if (!spoolss_io_devmode(desc, ps, depth, *devmode))
			return False;

	depth++;
	
	if (UNMARSHALLING(ps))
		buffer = *pp_buffer = PRS_ALLOC_MEM(ps, NEW_BUFFER, 1);

	if (buffer == NULL)
		return False;

		
		make_spoolss_printer_info_2 (mem_ctx, &q_u->info.info_2, info->printers_2);
#if 1	/* JERRY TEST */
		q_u->secdesc_ctr = SMB_MALLOC_P(SEC_DESC_BUF);
		if (!q_u->secdesc_ctr)
			return False;
		q_u->secdesc_ctr->ptr = (secdesc != NULL) ? 1: 0;

		
		make_spoolss_printer_info_3 (mem_ctx, &q_u->info.info_3, info->printers_3);
		
		q_u->secdesc_ctr = SMB_MALLOC_P(SEC_DESC_BUF);
		if (!q_u->secdesc_ctr)
			return False;
		q_u->secdesc_ctr->ptr = (secdesc != NULL) ? 1: 0;

		case 1:
		{
			if (UNMARSHALLING(ps)) {
				if ((il->info_1=PRS_ALLOC_MEM(ps,SPOOL_PRINTER_INFO_LEVEL_1,1)) == NULL)
					return False;
			}
			if (!spool_io_printer_info_level_1("", il->info_1, ps, depth))

		 */	
		case 2:
			if (UNMARSHALLING(ps)) {
				if ((il->info_2=PRS_ALLOC_MEM(ps,SPOOL_PRINTER_INFO_LEVEL_2,1)) == NULL)
					return False;
			}
			if (!spool_io_printer_info_level_2("", il->info_2, ps, depth))

		case 3:
		{
			if (UNMARSHALLING(ps)) {
				if ((il->info_3=PRS_ALLOC_MEM(ps,SPOOL_PRINTER_INFO_LEVEL_3,1)) == NULL)
					return False;
			}
			if (!spool_io_printer_info_level_3("", il->info_3, ps, depth))

		}
		case 7:
			if (UNMARSHALLING(ps))
				if ((il->info_7=PRS_ALLOC_MEM(ps,SPOOL_PRINTER_INFO_LEVEL_7,1)) == NULL)
					return False;
			if (!spool_io_printer_info_level_7("", il->info_7, ps, depth))
				return False;

		
	/* reading */
	if (UNMARSHALLING(ps)) {
		il=PRS_ALLOC_MEM(ps,SPOOL_PRINTER_DRIVER_INFO_LEVEL_3,1);
		if(il == NULL)
			return False;
		*q_u=il;

		
	/* reading */
	if (UNMARSHALLING(ps)) {
		il=PRS_ALLOC_MEM(ps,SPOOL_PRINTER_DRIVER_INFO_LEVEL_6,1);
		if(il == NULL)
			return False;
		*q_u=il;

	while (src < ((char *)buf5->buffer) + buf5->buf_len*2) {
		rpcstr_pull(f, src, sizeof(f)-1, -1, STR_TERMINATE);
		src = skip_unibuf(src, 2*buf5->buf_len - PTR_DIFF(src,buf5->buffer));
		tar = SMB_REALLOC_ARRAY(*ar, fstring, n+2);
		if (!tar)
			return False;
		else

	BOOL		null_char = False;
	SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *inf;

	if (!(inf=TALLOC_ZERO_P(mem_ctx, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3)))
		return False;
	
	inf->cversion	= info3->version;

{

	buf5->buf_len = len;
	if((buf5->buffer=(uint16*)TALLOC_MEMDUP(mem_ctx, src, sizeof(uint16)*len)) == NULL) {
	{
		DEBUG(0,("make_spoolss_buffer5: Unable to malloc memory for buffer!\n"));
		return False;
	}

	
	if (*asc==NULL)
	{
		*asc=SMB_MALLOC_P(NT_PRINTER_DRIVER_INFO_LEVEL_3);
		if(*asc == NULL)
			return False;
		ZERO_STRUCTP(*asc);

	
	if (*asc==NULL)
	{
		*asc=SMB_MALLOC_P(NT_PRINTER_DRIVER_INFO_LEVEL_6);
		if(*asc == NULL)
			return False;
		ZERO_STRUCTP(*asc);

	if (*asc==NULL) {
		DEBUGADD(8,("allocating memory\n"));

		*asc=SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL_2);
		if(*asc == NULL)
			return False;
		ZERO_STRUCTP(*asc);

		return False;

	if (UNMARSHALLING(ps) && r_u->valuesize) {
		r_u->value = PRS_ALLOC_MEM(ps, uint16, r_u->valuesize);
		if (!r_u->value) {
			DEBUG(0, ("spoolss_io_r_enumprinterdata: out of memory for printerdata value\n"));
			return False;

		return False;

	if (UNMARSHALLING(ps) && r_u->datasize) {
		r_u->data = PRS_ALLOC_MEM(ps, uint8, r_u->datasize);
		if (!r_u->data) {
			DEBUG(0, ("spoolss_io_r_enumprinterdata: out of memory for printerdata data\n"));
			return False;

		case REG_MULTI_SZ:
            if (q_u->max_len) {
                if (UNMARSHALLING(ps))
    				q_u->data=PRS_ALLOC_MEM(ps, uint8, q_u->max_len);
    			if(q_u->data == NULL)
    				return False;
    			if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))

		if (src->size != POINTER) 
			continue;
		len = src->notify_data.data.length;
		s = SMB_MALLOC_ARRAY(uint16, len);
		if (s == NULL) {
			DEBUG(0,("copy_spool_notify_info_data: malloc() failed!\n"));
			return False;

	
	if (dst->count) 
	{
		dst->data = SMB_MALLOC_ARRAY(SPOOL_NOTIFY_INFO_DATA, dst->count);
		
		DEBUG(10,("copy_spool_notify_info: allocating space for [%d] PRINTER_NOTIFY_INFO_DATA entries\n",
			dst->count));

		return False;
	
	if (UNMARSHALLING(ps) && r_u->size) {
		r_u->data = PRS_ALLOC_MEM(ps, unsigned char, r_u->size);
		if(!r_u->data)
			return False;
	}

		case 0x7:
			if (q_u->max_len) {
				if (UNMARSHALLING(ps))
    					q_u->data=PRS_ALLOC_MEM(ps, uint8, q_u->max_len);
    				if(q_u->data == NULL)
    					return False;
    				if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))

	/* first loop to write basic enum_value information */
	
	if (UNMARSHALLING(ps)) {
		ctr->values = PRS_ALLOC_MEM(ps, PRINTER_ENUM_VALUES, ctr->size_of_array);
			ps, ctr->size_of_array * sizeof(PRINTER_ENUM_VALUES));
		if (!ctr->values)
			return False;
	}

		
		if ( ctr->values[i].data_len ) {
			if ( UNMARSHALLING(ps) ) {
				ctr->values[i].data = PRS_ALLOC_MEM(ps, uint8, ctr->values[i].data_len);
					ps, ctr->values[i].data_len);
				if (!ctr->values[i].data)
					return False;
			}




		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info0 = PRS_ALLOC_MEM(ps, SRV_SHARE_INFO_0, num_entries)))
				return False;
			ctr->share.info0 = info0;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info1 = PRS_ALLOC_MEM(ps, SRV_SHARE_INFO_1, num_entries)))
				return False;
			ctr->share.info1 = info1;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info2 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_2,num_entries)))
				return False;
			ctr->share.info2 = info2;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info501 = PRS_ALLOC_MEM(ps, SRV_SHARE_INFO_501, num_entries)))
					sizeof (SRV_SHARE_INFO_501))))
				return False;
			ctr->share.info501 = info501;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info502 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_502,num_entries)))
				return False;
			ctr->share.info502 = info502;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info1004 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1004,num_entries)))
				return False;
			ctr->share.info1004 = info1004;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info1005 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1005,num_entries)))
				return False;
			ctr->share.info1005 = info1005;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info1006 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1006,num_entries)))
				return False;
			ctr->share.info1006 = info1006;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info1007 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1007,num_entries)))
				return False;
			ctr->share.info1007 = info1007;
		}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info1501 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1501,num_entries)))
				return False;
			ctr->share.info1501 = info1501;
		}

	depth++;

	if(UNMARSHALLING(ps)) {
		ctr = *pp_ctr = PRS_ALLOC_MEM(ps, SRV_SESS_INFO_CTR, 1);
		if (ctr == NULL)
			return False;
	}

	depth++;

	if (UNMARSHALLING(ps)) {
		ctr = *pp_ctr = PRS_ALLOC_MEM(ps, SRV_CONN_INFO_CTR, 1);
		if (ctr == NULL)
			return False;
	}

		int i;

		if (UNMARSHALLING(ps)) {
			if (!(info3 = PRS_ALLOC_MEM(ps, SRV_FILE_INFO_3, num_entries)))
				return False;
			ctr->file.info3 = info3;
		}

		return False;

	if (UNMARSHALLING(ps)) {
		q_n->ctr = PRS_ALLOC_MEM(ps, SRV_INFO_CTR, 1);
			prs_alloc_mem(ps, sizeof(SRV_INFO_CTR));

		if (!q_n->ctr)
			return False;


		DISK_INFO *dinfo;

		if(!(dinfo = PRS_ALLOC_MEM(ps, DISK_INFO, entries_read3)))
		return False;
		r_n->disk_enum_ctr.disk_info = dinfo;
	}





	vfs_ChDir(p->conn,p->conn->connectpath);

	jn.referral_list = TALLOC_ARRAY(p->mem_ctx, struct referral, jn.referral_count);
				* sizeof(struct referral));

	if(jn.referral_list == NULL) {
		DEBUG(0,("init_reply_dfs_add: talloc failed for referral list!\n"));
		return WERR_DFS_INTERNAL_ERROR;

		dfs3[i].ptr_storages = 1;
     
		/* also enumerate the storages */
		dfs3[i].storages = TALLOC_ARRAY(ctx, DFS_STORAGE_INFO, j[i].referral_count);
						sizeof(DFS_STORAGE_INFO));
		if (!dfs3[i].storages)
			return False;


	case 1:
		{
		DFS_INFO_1* dfs1;
		dfs1 = TALLOC_ARRAY(ctx, DFS_INFO_1, num_jn);
		if (!dfs1)
			return WERR_NOMEM;
		init_reply_dfs_info_1(jn, dfs1, num_jn);

	case 2:
		{
		DFS_INFO_2* dfs2;
		dfs2 = TALLOC_ARRAY(ctx, DFS_INFO_2, num_jn);
		if (!dfs2)
			return WERR_NOMEM;
		init_reply_dfs_info_2(jn, dfs2, num_jn);

	case 3:
		{
		DFS_INFO_3* dfs3;
		dfs3 = TALLOC_ARRAY(ctx, DFS_INFO_3, num_jn);
		if (!dfs3)
			return WERR_NOMEM;
		init_reply_dfs_info_3(ctx, jn, dfs3, num_jn);

	r_u->reshnd.ptr_hnd = 1;
	r_u->reshnd.handle = num_jn;
  
	r_u->ctr = TALLOC_P(p->mem_ctx, DFS_INFO_CTR);
	if (!r_u->ctr)
		return WERR_NOMEM;
	ZERO_STRUCTP(r_u->ctr);

Lines 44-50 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_echo_nt.c (-2 / +2 lines)
44	{	44	{
45	DEBUG(10, ("_echo_data\n"));	45	DEBUG(10, ("_echo_data\n"));
46		46
47	r_u->data = talloc(p->mem_ctx, q_u->size);	47	r_u->data = TALLOC(p->mem_ctx, q_u->size);
48	r_u->size = q_u->size;	48	r_u->size = q_u->size;
49	memcpy(r_u->data, q_u->data, q_u->size);	49	memcpy(r_u->data, q_u->data, q_u->size);
50	}	50	}
Lines 68-74 Link Here
68		68
69	DEBUG(10, ("_source_data\n"));	69	DEBUG(10, ("_source_data\n"));
70		70
71	r_u->data = talloc(p->mem_ctx, q_u->size);	71	r_u->data = TALLOC(p->mem_ctx, q_u->size);
72	r_u->size = q_u->size;	72	r_u->size = q_u->size;
73		73
74	for (i = 0; i < r_u->size; i++)	74	for (i = 0; i < r_u->size; i++)

Lines 41-47 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_lsa_ds_nt.c (-1 / +1 lines)
41		41
42	DEBUG(10,("fill_dsrole_dominfo_basic: enter\n"));	42	DEBUG(10,("fill_dsrole_dominfo_basic: enter\n"));
43		43
44	if ( !(basic = talloc_zero(ctx, sizeof(DSROLE_PRIMARY_DOMAIN_INFO_BASIC))) ) {	44	if ( !(basic = TALLOC_ZERO_P(ctx, DSROLE_PRIMARY_DOMAIN_INFO_BASIC)) ) {
45	DEBUG(0,("fill_dsrole_dominfo_basic: FATAL error! talloc_xero() failed\n"));	45	DEBUG(0,("fill_dsrole_dominfo_basic: FATAL error! talloc_xero() failed\n"));
46	return NT_STATUS_NO_MEMORY;	46	return NT_STATUS_NO_MEMORY;
47	}	47	}

Lines 70-76 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_lsa_hnd.c (-2 / +2 lines)
70	* Create list.	70	* Create list.
71	*/	71	*/
72		72
73	if ((hl = (struct handle_list *)malloc(sizeof(struct handle_list))) == NULL)	73	if ((hl = SMB_MALLOC_P(struct handle_list)) == NULL)
74	return False;	74	return False;
75	ZERO_STRUCTP(hl);	75	ZERO_STRUCTP(hl);
76		76
Lines 112-118 Link Here
112	return False;	112	return False;
113	}	113	}
114		114
115	pol = (struct policy )malloc(sizeof(p));	115	pol = SMB_MALLOC_P(struct policy);
116	if (!pol) {	116	if (!pol) {
117	DEBUG(0,("create_policy_hnd: ERROR: out of memory!\n"));	117	DEBUG(0,("create_policy_hnd: ERROR: out of memory!\n"));
118	return False;	118	return False;




	/* Allocate memory for list of names */

	if (num_entries > 0) {
		if (!(trn->name = TALLOC_ARRAY(ctx, LSA_TRANS_NAME, num_entries))) {
							  num_entries))) {
			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
			return;
		}

		if (!(trn->uni_name = TALLOC_ARRAY(ctx, UNISTR2, num_entries))) {
							num_entries))) {
			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
			return;
		}



	/* associate the domain SID with the (unique) handle. */
	if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(info);

	}

	/* associate the domain SID with the (unique) handle. */
	if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(info);

		info->id2.auditing_enabled = 1;
		info->id2.count1 = 7;
		info->id2.count2 = 7;
		if ((info->id2.auditsettings = TALLOC_ARRAY(p->mem_ctx,uint32, 7)) == NULL)
			return NT_STATUS_NO_MEMORY;
		for (i = 0; i < 7; i++)
			info->id2.auditsettings[i] = 3;

		DEBUG(5,("_lsa_lookup_sids: truncating SID lookup list to %d\n", num_entries));
	}

	ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
	names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM);

	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
		r_u->status = NT_STATUS_INVALID_HANDLE;

		DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
	}
		
	ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
	rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, num_entries);

	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
		r_u->status = NT_STATUS_INVALID_HANDLE;

	if (enum_context >= PRIV_ALL_INDEX)
		return NT_STATUS_NO_MORE_ENTRIES;

	entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, PRIV_ALL_INDEX);
	if (entries==NULL)
		return NT_STATUS_NO_MEMORY;


	if (q_u->enum_context >= num_entries)
		return NT_STATUS_NO_MORE_ENTRIES;

	sids->ptr_sid = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_entries-q_u->enum_context);
	sids->sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_entries-q_u->enum_context);

	if (sids->ptr_sid==NULL || sids->sid==NULL) {
		SAFE_FREE(map);

		return NT_STATUS_ACCESS_DENIED;

	/* associate the user/group SID with the (unique) handle. */
	if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(info);

Lines 579-585 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_netlog_nt.c (-1 / +1 lines)
579	SAM_ACCOUNT *sampw;	579	SAM_ACCOUNT *sampw;
580	struct auth_context *auth_context = NULL;	580	struct auth_context *auth_context = NULL;
581		581
582	usr_info = (NET_USER_INFO_3 *)talloc(p->mem_ctx, sizeof(NET_USER_INFO_3));	582	usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
583	if (!usr_info)	583	if (!usr_info)
584	return NT_STATUS_NO_MEMORY;	584	return NT_STATUS_NO_MEMORY;
585		585




			int 			n_fns = 0;
			PIPE_RPC_FNS		*context_fns;
			
			if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
				DEBUG(0,("check_bind_req: malloc() failed!\n"));
				return False;
			}

        /* We use a temporary variable because this call can fail and 
           rpc_lookup will still be valid afterwards.  It could then succeed if
           called again later */
	rpc_lookup_size++;
        rpc_entry = SMB_REALLOC_ARRAY(rpc_lookup, struct rpc_table, rpc_lookup_size);
        if (NULL == rpc_entry) {
                rpc_lookup_size--;
                DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));

        
        rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
        ZERO_STRUCTP(rpc_entry);
        rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
        rpc_entry->pipe.srv = SMB_STRDUP(srv);
        rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
        memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
                                  sizeof(struct api_struct));
        memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
               size * sizeof(struct api_struct));
        rpc_entry->n_cmds += size;
        
        return NT_STATUS_OK;

	if ((DEBUGLEVEL >= 10) && 
	    (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
		size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
		char *data = SMB_MALLOC(data_len);

		data = malloc(data_len);

		DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
		if (data) {




	for (p = Pipes; p; p = p->next)
		DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));  

	p = SMB_MALLOC_P(smb_np_struct);

	if (!p) {
		DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
		return NULL;

		return NULL;
	}

	p = SMB_MALLOC_P(pipes_struct);

	if (!p) {
	{
		DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
		return NULL;
	}

Lines 97-103 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_reg_nt.c (-2 / +2 lines)
97	if ( subkey_len && subkeyname2[subkey_len-1] == '\\' )	97	if ( subkey_len && subkeyname2[subkey_len-1] == '\\' )
98	subkeyname2[subkey_len-1] = '\0';	98	subkeyname2[subkey_len-1] = '\0';
99		99
100	if ((regkey=(REGISTRY_KEY*)malloc(sizeof(REGISTRY_KEY))) == NULL)	100	if ((regkey=SMB_MALLOC_P(REGISTRY_KEY)) == NULL)
101	return NT_STATUS_NO_MEMORY;	101	return NT_STATUS_NO_MEMORY;
102		102
103	ZERO_STRUCTP( regkey );	103	ZERO_STRUCTP( regkey );
Lines 373-379 Link Here
373	/* couple of hard coded registry values */	373	/* couple of hard coded registry values */
374		374
375	if ( strequal(name, "RefusePasswordChange") ) {	375	if ( strequal(name, "RefusePasswordChange") ) {
376	if ( (val = (REGISTRY_VALUE*)malloc(sizeof(REGISTRY_VALUE))) == NULL ) {	376	if ( (val = SMB_MALLOC_P(REGISTRY_VALUE)) == NULL ) {
377	DEBUG(0,("_reg_info: malloc() failed!\n"));	377	DEBUG(0,("_reg_info: malloc() failed!\n"));
378	return NT_STATUS_NO_MEMORY;	378	return NT_STATUS_NO_MEMORY;
379	}	379	}





	mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);

	if ((info = TALLOC_P(mem_ctx, struct samr_info)) == NULL)
		return NULL;

	ZERO_STRUCTP(info);

		if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) {
		
			DEBUG(10,("load_sampwd_entries: allocating more memory\n"));
			pwd_array=TALLOC_REALLOC_ARRAY(mem_ctx, info->disp_info.disp_user_info, SAM_ACCOUNT,
			                  info->disp_info.num_user_account+MAX_SAM_ENTRIES);

			if (pwd_array==NULL)
				return NT_STATUS_NO_MEMORY;


	info->disp_info.num_group_account=group_entries;

	grp_array=TALLOC_ARRAY(mem_ctx, DOMAIN_GRP, info->disp_info.num_group_account);
	if (group_entries!=0 && grp_array==NULL) {
		DEBUG(1, ("load_group_domain_entries: talloc() failed for grp_array!\n"));
		SAFE_FREE(map);

	if (num_entries == 0)
		return NT_STATUS_OK;

	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_entries);

	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_entries);

	if (sam == NULL || uni_name == NULL) {
		DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));

	if (num_sam_entries == 0)
		return;

	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);

	if (sam == NULL || uni_name == NULL) {
		DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));

		num_entries=max_entries;
	}

	*d_grp=TALLOC_ZERO_ARRAY(ctx, DOMAIN_GRP, num_entries);
	if (num_entries!=0 && *d_grp==NULL){
		SAFE_FREE(map);
		return NT_STATUS_NO_MEMORY;

	if (*p_num_entries == 0)
		return NT_STATUS_OK;

	*d_grp = TALLOC_ARRAY(ctx, DOMAIN_GRP, *p_num_entries);

	if (*d_grp == NULL) {
		SAFE_FREE(info);

		DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to only %d entries\n", max_entries));
	}

	if (!(ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_DISPINFO_CTR)))
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(ctr);

	switch (q_u->switch_level) {
	case 0x1:
		if (max_entries) {
			if (!(ctr->sam.info1 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_1,max_entries)))
				return NT_STATUS_NO_MEMORY;
		}
		disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context, 

		break;
	case 0x2:
		if (max_entries) {
			if (!(ctr->sam.info2 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_2,max_entries)))
				return NT_STATUS_NO_MEMORY;
		}
		disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context, 

		break;
	case 0x3:
		if (max_entries) {
			if (!(ctr->sam.info3 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_3,max_entries)))
				return NT_STATUS_NO_MEMORY;
		}
		disp_ret = init_sam_dispinfo_3(p->mem_ctx, ctr->sam.info3, max_entries, enum_context, info->disp_info.disp_group_info);

		break;
	case 0x4:
		if (max_entries) {
			if (!(ctr->sam.info4 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_4,max_entries)))
				return NT_STATUS_NO_MEMORY;
		}
		disp_ret = init_sam_dispinfo_4(p->mem_ctx, ctr->sam.info4, max_entries, enum_context, info->disp_info.disp_user_info);

		break;
	case 0x5:
		if (max_entries) {
			if (!(ctr->sam.info5 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_5,max_entries)))
				return NT_STATUS_NO_MEMORY;
		}
		disp_ret = init_sam_dispinfo_5(p->mem_ctx, ctr->sam.info5, max_entries, enum_context, info->disp_info.disp_group_info);

	*pp_hdr_name = NULL;

	if (num_names != 0) {
		hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR, num_names);
		if (hdr_name == NULL)
			return False;

		uni_name = TALLOC_ZERO_ARRAY(ctx,UNISTR2, num_names);
		if (uni_name == NULL)
			return False;
	}

	}

	if (num_rids) {
		if ((group_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids )) == NULL)
			return NT_STATUS_NO_MEMORY;
 	}
 


	DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));

	ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_USERINFO_CTR);
	if (!ctr)
		return NT_STATUS_NO_MEMORY;



	switch (q_u->switch_value) {
	case 0x10:
		ctr->info.id10 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_10);
		if (ctr->info.id10 == NULL)
			return NT_STATUS_NO_MEMORY;


            expire.low = 0xffffffff;
            expire.high = 0x7fffffff;

            ctr->info.id = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_11));
                                    sizeof
                                    (*ctr->
                                     info.
                                     id11));
	    ZERO_STRUCTP(ctr->info.id11);
            init_sam_user_info11(ctr->info.id11, &expire,
                         "BROOKFIELDS$",    /* name */

#endif

	case 0x12:
		ctr->info.id12 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_12);
		if (ctr->info.id12 == NULL)
			return NT_STATUS_NO_MEMORY;


		break;
		
	case 20:
		ctr->info.id20 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_20);
		if (ctr->info.id20 == NULL)
			return NT_STATUS_NO_MEMORY;
		if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))

		break;

	case 21:
		ctr->info.id21 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_21);
		if (ctr->info.id21 == NULL)
			return NT_STATUS_NO_MEMORY;
		if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21, 


	uint32 num_users=0, num_groups=0, num_aliases=0;

	if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(ctr);

	if (num_sam_entries == 0)
		return True;

	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);

	if (sam == NULL || uni_name == NULL)
		return False;

			continue;
		}

		new_rids=TALLOC_REALLOC_ARRAY(p->mem_ctx, rids, uint32, num_groups+tmp_num_groups);
		if (new_rids==NULL) {
			DEBUG(0,("_samr_query_useraliases: could not realloc memory\n"));
			return NT_STATUS_NO_MEMORY;

	if (!pdb_enum_aliasmem(&alias_sid, &sids, &num_sids))
		return NT_STATUS_NO_SUCH_ALIAS;

	sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_sids);	
	if (num_sids!=0 && sid == NULL) {
		SAFE_FREE(sids);
		return NT_STATUS_NO_MEMORY;

			return;
	}
	
	*uids = SMB_REALLOC_ARRAY(*uids, uid_t, *num+1);

	if (*uids == NULL)
		return;

	if(!get_memberuids(gid, &uids, &num))
		return NT_STATUS_NO_SUCH_GROUP;

	rid=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num);
	attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num);
	
	if (num!=0 && (rid==NULL || attr==NULL))
		return NT_STATUS_NO_MEMORY;

	if (!ret)
		return NT_STATUS_INVALID_HANDLE;

	ctr=TALLOC_ZERO_P(p->mem_ctx, GROUP_INFO_CTR);
	if (ctr==NULL)
		return NT_STATUS_NO_MEMORY;



	uint32 account_policy_temp;

	if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
		return NT_STATUS_NO_MEMORY;

	ZERO_STRUCTP(ctr);




	if (!sp)
		return NULL;

	new_sp = SMB_MALLOC_P(SPOOL_NOTIFY_OPTION);
	if (!new_sp)
		return NULL;



	DEBUG(10,("open_printer_hnd: name [%s]\n", name));

	if((new_printer=SMB_MALLOC_P(Printer_entry)) == NULL)
		return False;

	ZERO_STRUCTP(new_printer);

	init_unistr2(&unistr, msg->notify.data, UNI_STR_TERMINATE);

	data->notify_data.data.length = msg->len * 2;
	data->notify_data.data.string = TALLOC_ARRAY(mem_ctx, uint16, msg->len);

	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

		return;

	data->notify_data.data.length = prs_offset(&ps);
	data->notify_data.data.string = TALLOC(mem_ctx, prs_offset(&ps));

	prs_copy_all_data_out((char *)data->notify_data.data.string, &ps);


	if ( i == ctr->num_groups ) {
		ctr->num_groups++;

		if ( !(groups = TALLOC_REALLOC_ARRAY( ctr->ctx, ctr->msg_groups, SPOOLSS_NOTIFY_MSG_GROUP, ctr->num_groups)) ) {
			DEBUG(0,("notify_msg_ctr_addmsg: talloc_realloc() failed!\n"));
			return 0;
		}

	
	msg_grp->num_msgs++;
	
	if ( !(msg_list = TALLOC_REALLOC_ARRAY( ctr->ctx, msg_grp->msgs, SPOOLSS_NOTIFY_MSG, msg_grp->num_msgs )) ) {
		DEBUG(0,("notify_msg_ctr_addmsg: talloc_realloc() failed for new message [%d]!\n", msg_grp->num_msgs));
		return 0;
	}

	/* need to allocate own copy of data */
	
	if ( msg->len != 0 ) 
		msg_grp->msgs[new_slot].notify.data = TALLOC_MEMDUP( ctr->ctx, msg->notify.data, msg->len );
	
	return ctr->num_groups;
}

		
		/* allocate the max entries possible */
		
		data = TALLOC_ARRAY( mem_ctx, SPOOL_NOTIFY_INFO_DATA, msg_group->num_msgs);
		ZERO_STRUCTP(data);
		
		/* build the array of change notifications */

	
	/* bulk copy first */
	
	d = TALLOC_MEMDUP(ctx, devmode, sizeof(DEVICEMODE));
	if (!d)
		return NULL;
		

	
	len = unistrlen(devmode->devicename.buffer);
	if (len != -1) {
		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
		if (unistrcpy(d->devicename.buffer, devmode->devicename.buffer) != len)
			return NULL;
	}


	len = unistrlen(devmode->formname.buffer);
	if (len != -1) {
		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
		if (unistrcpy(d->formname.buffer, devmode->formname.buffer) != len)
			return NULL;
	}

	d->private = TALLOC_MEMDUP(ctx, devmode->private, devmode->driverextra);
	
	return d;
}

	if ((devmode->driverextra != 0) && (devmode->private != NULL)) {
		SAFE_FREE(nt_devmode->private);
		nt_devmode->driverextra=devmode->driverextra;
		if((nt_devmode->private=SMB_MALLOC_ARRAY(uint8, nt_devmode->driverextra)) == NULL)
			return False;
		memcpy(nt_devmode->private, devmode->private, nt_devmode->driverextra);
	}

		
		/* special case for 0 length values */
		if ( data_len ) {
			if ( (*data  = (uint8 *)TALLOC_MEMDUP(ctx, regval_data_p(val), data_len)) == NULL )
				return WERR_NOMEM;
		}
		else {
			if ( (*data  = (uint8 *)TALLOC_ZERO(ctx, in_size)) == NULL )
				return WERR_NOMEM;
		}
	}

		
	if (!StrCaseCmp(value, "W3SvcInstalled")) {
		*type = 0x4;
		if((*data = (uint8 *)TALLOC_ZERO(ctx, 4*sizeof(uint8) )) == NULL)
			return WERR_NOMEM;
		*needed = 0x4;
		return WERR_OK;


	if (!StrCaseCmp(value, "BeepEnabled")) {
		*type = 0x4;
		if((*data = (uint8 *)TALLOC(ctx, 4*sizeof(uint8) )) == NULL)
			return WERR_NOMEM;
		SIVAL(*data, 0, 0x00);
		*needed = 0x4;			


	if (!StrCaseCmp(value, "EventLog")) {
		*type = 0x4;
		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
			return WERR_NOMEM;
		/* formally was 0x1b */
		SIVAL(*data, 0, 0x0);


	if (!StrCaseCmp(value, "NetPopup")) {
		*type = 0x4;
		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
			return WERR_NOMEM;
		SIVAL(*data, 0, 0x00);
		*needed = 0x4;


	if (!StrCaseCmp(value, "MajorVersion")) {
		*type = 0x4;
		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
			return WERR_NOMEM;

		/* Windows NT 4.0 seems to not allow uploading of drivers


	if (!StrCaseCmp(value, "MinorVersion")) {
		*type = 0x4;
		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
			return WERR_NOMEM;
		SIVAL(*data, 0, 0);
		*needed = 0x4;

		*type = 0x3;
		*needed = 0x114;

		if((*data = (uint8 *)TALLOC(ctx, *needed)) == NULL)
			return WERR_NOMEM;
		ZERO_STRUCTP( *data );
		

		const char *string="C:\\PRINTERS";
		*type = 0x1;			
		*needed = 2*(strlen(string)+1);		
		if((*data  = (uint8 *)TALLOC(ctx, (*needed > in_size) ? *needed:in_size )) == NULL)
			return WERR_NOMEM;
		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
		

		const char *string="Windows NT x86";
		*type = 0x1;			
		*needed = 2*(strlen(string)+1);	
		if((*data  = (uint8 *)TALLOC(ctx, (*needed > in_size) ? *needed:in_size )) == NULL)
			return WERR_NOMEM;
		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
		for (i=0; i<strlen(string); i++) {


	if (!StrCaseCmp(value, "DsPresent")) {
		*type = 0x4;
		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
			return WERR_NOMEM;
		SIVAL(*data, 0, 0x01);
		*needed = 0x4;

			return WERR_BADFILE;
		*type = 0x1;			
		*needed = 2*(strlen(hostname)+1);	
		if((*data  = (uint8 *)TALLOC(ctx, (*needed > in_size) ? *needed:in_size )) == NULL)
			return WERR_NOMEM;
		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
		for (i=0; i<strlen(hostname); i++) {

		if ( strequal(value, "ChangeId") ) {
			*type = REG_DWORD;
			*needed = sizeof(uint32);
			if ( (*data = (uint8*)TALLOC(p->mem_ctx, sizeof(uint32))) == NULL) {
				status = WERR_NOMEM;
				goto done;
			}

		/* reply this param doesn't exist */
		
		if ( *out_size ) {
			if((*data=(uint8 *)TALLOC_ZERO_ARRAY(p->mem_ctx, uint8, *out_size)) == NULL) {
				if ( printer ) 
					free_a_printer( &printer, 2 );
				return WERR_NOMEM;

	len = rpcstr_push(temp, printer->info_2->servername, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);

	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, p, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, lp_servicename(snum), sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, printer->info_2->portname, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, printer->info_2->drivername, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

		len = rpcstr_push(temp, printer->info_2->comment, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, printer->info_2->location,sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, printer->info_2->sepfile, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp,  printer->info_2->printprocessor, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp,  printer->info_2->parameters, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, printer->info_2->datatype, sizeof(pstring)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, queue->fs_user, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, queue->fs_file, sizeof(temp)-2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = rpcstr_push(temp, p, sizeof(temp) - 2, STR_TERMINATE);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
	
	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

	len = sizeof(SYSTEMTIME);

	data->notify_data.data.length = len;
	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);

	if (!data->notify_data.data.string) {
		data->notify_data.data.length = 0;

		if (!search_notify(type, field, &j) )
			continue;

		if((tid=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
			DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n"));
			return False;
		} else 

		if (!search_notify(type, field, &j) )
			continue;

		if((tid=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
			DEBUG(2,("construct_notify_jobs_info: failed to enlarg buffer info->data!\n"));
			return False;
		}


	/* it's the first time, add it to the list */
	if (session_counter==NULL) {
		if((session_counter=SMB_MALLOC_P(counter_printer_0)) == NULL) {
			free_a_printer(&ntprinter, 2);
			return False;
		}

		goto done;
	}

	if ((devmode = SMB_MALLOC_P(DEVICEMODE)) == NULL) {
		DEBUG(2,("construct_dev_mode: malloc fail.\n"));
		goto done;
	}

		return False;

	*pp_printer = NULL;
	if ((printer = SMB_MALLOC_P(PRINTER_INFO_3)) == NULL) {
		DEBUG(2,("construct_printer_info_3: malloc fail.\n"));
		return False;
	}

			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));

			if (construct_printer_info_1(NULL, flags, &current_prt, snum)) {
				if((tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_1, *returned +1)) == NULL) {
					DEBUG(2,("enum_all_printers_info_1: failed to enlarge printers buffer!\n"));
					SAFE_FREE(printers);
					*returned=0;

	 * undocumented RPC call.
	 */
	
	if((printer=SMB_MALLOC_P(PRINTER_INFO_1)) == NULL)
		return WERR_NOMEM;

	*returned=1;

			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
				
			if (construct_printer_info_2(NULL, &current_prt, snum)) {
				if((tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_2, *returned +1)) == NULL) {
					DEBUG(2,("enum_all_printers_info_2: failed to enlarge printers buffer!\n"));
					SAFE_FREE(printers);
					*returned = 0;

{
	PRINTER_INFO_0 *printer=NULL;

	if((printer=SMB_MALLOC_P(PRINTER_INFO_0)) == NULL)
		return WERR_NOMEM;

	construct_printer_info_0(print_hnd, printer, snum);

{
	PRINTER_INFO_1 *printer=NULL;

	if((printer=SMB_MALLOC_P(PRINTER_INFO_1)) == NULL)
		return WERR_NOMEM;

	construct_printer_info_1(print_hnd, PRINTER_ENUM_ICON8, printer, snum);

{
	PRINTER_INFO_2 *printer=NULL;

	if((printer=SMB_MALLOC_P(PRINTER_INFO_2))==NULL)
		return WERR_NOMEM;
	
	construct_printer_info_2(print_hnd, printer, snum);

{
	PRINTER_INFO_4 *printer=NULL;

	if((printer=SMB_MALLOC_P(PRINTER_INFO_4))==NULL)
		return WERR_NOMEM;

	if (!construct_printer_info_4(print_hnd, printer, snum))

{
	PRINTER_INFO_5 *printer=NULL;

	if((printer=SMB_MALLOC_P(PRINTER_INFO_5))==NULL)
		return WERR_NOMEM;

	if (!construct_printer_info_5(print_hnd, printer, snum))

{
	PRINTER_INFO_7 *printer=NULL;

	if((printer=SMB_MALLOC_P(PRINTER_INFO_7))==NULL)
		return WERR_NOMEM;

	if (!construct_printer_info_7(print_hnd, printer, snum))


		/* add one extra unit16 for the second terminating NULL */
		
		if ( (tuary=SMB_REALLOC_ARRAY(*uni_array, uint16, j+1+strlen(line)+2)) == NULL ) {
			DEBUG(2,("init_unistr_array: Realloc error\n" ));
			return 0;
		} else

	DRIVER_INFO_1 *info=NULL;
	WERROR status;
	
	if((info=SMB_MALLOC_P(DRIVER_INFO_1)) == NULL)
		return WERR_NOMEM;
	
	status=construct_printer_driver_info_1(info, snum, servername, architecture, version);

	DRIVER_INFO_2 *info=NULL;
	WERROR status;
	
	if((info=SMB_MALLOC_P(DRIVER_INFO_2)) == NULL)
		return WERR_NOMEM;
	
	status=construct_printer_driver_info_2(info, snum, servername, architecture, version);

	JOB_INFO_1 *info;
	int i;
	
	info=SMB_MALLOC_ARRAY(JOB_INFO_1,*returned);
	if (info==NULL) {
		SAFE_FREE(queue);
		*returned=0;

	WERROR result;
	DEVICEMODE *devmode = NULL;
	
	info=SMB_MALLOC_ARRAY(JOB_INFO_2,*returned);
	if (info==NULL) {
		*returned=0;
		result = WERR_NOMEM;

			return WERR_NOMEM;

		if(ndrivers != 0) {
			if((tdi1=SMB_REALLOC_ARRAY(driver_info_1, DRIVER_INFO_1, *returned+ndrivers )) == NULL) {
				DEBUG(0,("enumprinterdrivers_level1: failed to enlarge driver info buffer!\n"));
				SAFE_FREE(driver_info_1);
				SAFE_FREE(list);

			return WERR_NOMEM;

		if(ndrivers != 0) {
			if((tdi2=SMB_REALLOC_ARRAY(driver_info_2, DRIVER_INFO_2, *returned+ndrivers )) == NULL) {
				DEBUG(0,("enumprinterdrivers_level2: failed to enlarge driver info buffer!\n"));
				SAFE_FREE(driver_info_2);
				SAFE_FREE(list);

			return WERR_NOMEM;

		if(ndrivers != 0) {
			if((tdi3=SMB_REALLOC_ARRAY(driver_info_3, DRIVER_INFO_3, *returned+ndrivers )) == NULL) {
				DEBUG(0,("enumprinterdrivers_level3: failed to enlarge driver info buffer!\n"));
				SAFE_FREE(driver_info_3);
				SAFE_FREE(list);


	switch (level) {
	case 1:
		if ((forms_1=SMB_MALLOC_ARRAY(FORM_1, *numofforms)) == NULL) {
			*numofforms=0;
			return WERR_NOMEM;
		}

		close(fd);

		if(numlines) {
			if((ports=SMB_MALLOC_ARRAY( PORT_INFO_1, numlines )) == NULL) {
				DEBUG(10,("Returning WERR_NOMEM [%s]\n", 
					  dos_errstr(WERR_NOMEM)));
				file_lines_free(qlines);

	} else {
		*returned = 1; /* Sole Samba port returned. */

		if((ports=SMB_MALLOC_P(PORT_INFO_1)) == NULL)
			return WERR_NOMEM;
	
		DEBUG(10,("enumports_level_1: port name %s\n", SAMBA_PRINTER_PORT_NAME));

		close(fd);

		if(numlines) {
			if((ports=SMB_MALLOC_ARRAY( PORT_INFO_2, numlines)) == NULL) {
				file_lines_free(qlines);
				return WERR_NOMEM;
			}


		*returned = 1;

		if((ports=SMB_MALLOC_P(PORT_INFO_2)) == NULL)
			return WERR_NOMEM;
	
		DEBUG(10,("enumports_level_2: port name %s\n", SAMBA_PRINTER_PORT_NAME));

	int	snum;
	WERROR err = WERR_OK;

	if ((printer = SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL)) == NULL) {
		DEBUG(0,("spoolss_addprinterex_level_2: malloc fail.\n"));
		return WERR_NOMEM;
	}

	if (!(short_archi = get_short_archi(long_archi)))
		return WERR_INVALID_ENVIRONMENT;

	if((info=SMB_MALLOC_P(DRIVER_DIRECTORY_1)) == NULL)
		return WERR_NOMEM;

	slprintf(path, sizeof(path)-1, "\\\\%s\\print$\\%s", pservername, short_archi);


		*out_max_value_len=(in_value_len/sizeof(uint16));
		
		if((*out_value=(uint16 *)TALLOC_ZERO(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL)
		{
			result = WERR_NOMEM;
			goto done;

		
		/* only allocate when given a non-zero data_len */
		
		if ( in_data_len && ((*data_out=(uint8 *)TALLOC_ZERO(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) )
		{
			result = WERR_NOMEM;
			goto done;

	
		/* name */
		*out_max_value_len=(in_value_len/sizeof(uint16));
		if ( (*out_value = (uint16 *)TALLOC_ZERO(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL ) 
		{
			result = WERR_NOMEM;
			goto done;

		/* data - counted in bytes */

		*out_max_data_len = in_data_len;
		if ( (*data_out = (uint8 *)TALLOC_ZERO(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) 
		{
			result = WERR_NOMEM;
			goto done;

{
	PRINTPROCESSOR_1 *info_1=NULL;
	
	if((info_1 = SMB_MALLOC_P(PRINTPROCESSOR_1)) == NULL)
		return WERR_NOMEM;

	(*returned) = 0x1;

{
	PRINTPROCDATATYPE_1 *info_1=NULL;
	
	if((info_1 = SMB_MALLOC_P(PRINTPROCDATATYPE_1)) == NULL)
		return WERR_NOMEM;

	(*returned) = 0x1;

{
	PRINTMONITOR_1 *info_1=NULL;
	
	if((info_1 = SMB_MALLOC_P(PRINTMONITOR_1)) == NULL)
		return WERR_NOMEM;

	(*returned) = 0x1;

{
	PRINTMONITOR_2 *info_2=NULL;
	
	if((info_2 = SMB_MALLOC_P(PRINTMONITOR_2)) == NULL)
		return WERR_NOMEM;

	(*returned) = 0x1;

	BOOL found=False;
	JOB_INFO_1 *info_1=NULL;

	info_1=SMB_MALLOC_P(JOB_INFO_1);

	if (info_1 == NULL) {
		return WERR_NOMEM;

	DEVICEMODE 	*devmode = NULL;
	NT_DEVICEMODE	*nt_devmode = NULL;

	info_2=SMB_MALLOC_P(JOB_INFO_2);

	ZERO_STRUCTP(info_2);


	if ( !(nt_devmode=print_job_devmode( lp_const_servicename(snum), jobid )) )
		devmode = construct_dev_mode(snum);
	else {
		if ((devmode = SMB_MALLOC_P(DEVICEMODE)) != NULL) {
			ZERO_STRUCTP( devmode );
			convert_nt_devicemode( devmode, nt_devmode );
		}

		
		if ( *out_size ) 
		{
			if( (*data=(uint8 *)TALLOC_ZERO(p->mem_ctx, *out_size*sizeof(uint8))) == NULL ) {
				status = WERR_NOMEM;
				goto done;
			}

	num_entries = regval_ctr_numvals( &p_data->keys[key_index].values );
	if ( num_entries )
	{
		if ( (enum_values=TALLOC_ARRAY(p->mem_ctx, PRINTER_ENUM_VALUES, num_entries)) == NULL )
		{
			DEBUG(0,("_spoolss_enumprinterdataex: talloc() failed to allocate memory for [%lu] bytes!\n",
				(unsigned long)num_entries*sizeof(PRINTER_ENUM_VALUES)));

		
		data_len = regval_size( val );
		if ( data_len ) {
			if ( !(enum_values[i].data = TALLOC_MEMDUP(p->mem_ctx, regval_data_p(val), data_len)) ) 
			{
				DEBUG(0,("talloc_memdup failed to allocate memory [data_len=%d] for data!\n", 
					data_len ));

	if (!get_short_archi(long_archi))
		return WERR_INVALID_ENVIRONMENT;

	if((info=SMB_MALLOC_P(PRINTPROCESSOR_DIRECTORY_1)) == NULL)
		return WERR_NOMEM;

	pstrcpy(path, "C:\\WINNT\\System32\\spool\\PRTPROCS\\W32X86");

Lines 527-536 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_srvsvc_nt.c (-35 / +46 lines)
527	switch (info_level) {	527	switch (info_level) {
528	case 0:	528	case 0:
529	{	529	{
530	SRV_SHARE_INFO_0 *info0;	530	SRV_SHARE_INFO_0 *info0 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_0, num_entries);
531	int i = 0;	531	int i = 0;
532		532
533	info0 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_0));	533	if (!info0) {
		534	return False;
		535	}
534		536
535	for (snum = *resume_hnd; snum < num_services; snum++) {	537	for (snum = *resume_hnd; snum < num_services; snum++) {
536	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	538	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 545-554 Link Here
545		547
546	case 1:	548	case 1:
547	{	549	{
548	SRV_SHARE_INFO_1 *info1;	550	SRV_SHARE_INFO_1 *info1 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1, num_entries);
549	int i = 0;	551	int i = 0;
550		552
551	info1 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1));	553	if (!info1) {
		554	return False;
		555	}
552		556
553	for (snum = *resume_hnd; snum < num_services; snum++) {	557	for (snum = *resume_hnd; snum < num_services; snum++) {
554	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	558	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 562-571 Link Here
562		566
563	case 2:	567	case 2:
564	{	568	{
565	SRV_SHARE_INFO_2 *info2;	569	SRV_SHARE_INFO_2 *info2 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_2, num_entries);
566	int i = 0;	570	int i = 0;
567		571
568	info2 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_2));	572	if (!info2) {
		573	return False;
		574	}
569		575
570	for (snum = *resume_hnd; snum < num_services; snum++) {	576	for (snum = *resume_hnd; snum < num_services; snum++) {
571	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	577	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 579-588 Link Here
579		585
580	case 501:	586	case 501:
581	{	587	{
582	SRV_SHARE_INFO_501 *info501;	588	SRV_SHARE_INFO_501 *info501 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_501, num_entries);
583	int i = 0;	589	int i = 0;
584		590
585	info501 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_501));	591	if (!info501) {
		592	return False;
		593	}
586		594
587	for (snum = *resume_hnd; snum < num_services; snum++) {	595	for (snum = *resume_hnd; snum < num_services; snum++) {
588	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	596	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 596-605 Link Here
596		604
597	case 502:	605	case 502:
598	{	606	{
599	SRV_SHARE_INFO_502 *info502;	607	SRV_SHARE_INFO_502 *info502 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_502, num_entries);
600	int i = 0;	608	int i = 0;
601		609
602	info502 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_502));	610	if (!info502) {
		611	return False;
		612	}
603		613
604	for (snum = *resume_hnd; snum < num_services; snum++) {	614	for (snum = *resume_hnd; snum < num_services; snum++) {
605	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	615	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 615-624 Link Here
615		625
616	case 1004:	626	case 1004:
617	{	627	{
618	SRV_SHARE_INFO_1004 *info1004;	628	SRV_SHARE_INFO_1004 *info1004 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1004, num_entries);
619	int i = 0;	629	int i = 0;
620		630
621	info1004 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1004));	631	if (!info1004) {
		632	return False;
		633	}
622		634
623	for (snum = *resume_hnd; snum < num_services; snum++) {	635	for (snum = *resume_hnd; snum < num_services; snum++) {
624	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	636	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 632-641 Link Here
632		644
633	case 1005:	645	case 1005:
634	{	646	{
635	SRV_SHARE_INFO_1005 *info1005;	647	SRV_SHARE_INFO_1005 *info1005 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1005, num_entries);
636	int i = 0;	648	int i = 0;
637		649
638	info1005 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1005));	650	if (!info1005) {
		651	return False;
		652	}
639		653
640	for (snum = *resume_hnd; snum < num_services; snum++) {	654	for (snum = *resume_hnd; snum < num_services; snum++) {
641	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	655	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 649-658 Link Here
649		663
650	case 1006:	664	case 1006:
651	{	665	{
652	SRV_SHARE_INFO_1006 *info1006;	666	SRV_SHARE_INFO_1006 *info1006 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1006, num_entries);
653	int i = 0;	667	int i = 0;
654		668
655	info1006 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1006));	669	if (!info1006) {
		670	return False;
		671	}
656		672
657	for (snum = *resume_hnd; snum < num_services; snum++) {	673	for (snum = *resume_hnd; snum < num_services; snum++) {
658	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	674	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 666-675 Link Here
666		682
667	case 1007:	683	case 1007:
668	{	684	{
669	SRV_SHARE_INFO_1007 *info1007;	685	SRV_SHARE_INFO_1007 *info1007 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1007, num_entries);
670	int i = 0;	686	int i = 0;
671		687
672	info1007 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1007));	688	if (!info1007) {
		689	return False;
		690	}
673		691
674	for (snum = *resume_hnd; snum < num_services; snum++) {	692	for (snum = *resume_hnd; snum < num_services; snum++) {
675	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	693	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 683-692 Link Here
683		701
684	case 1501:	702	case 1501:
685	{	703	{
686	SRV_SHARE_INFO_1501 *info1501;	704	SRV_SHARE_INFO_1501 *info1501 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1501, num_entries);
687	int i = 0;	705	int i = 0;
688		706
689	info1501 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1501));	707	if (!info1501) {
		708	return False;
		709	}
690		710
691	for (snum = *resume_hnd; snum < num_services; snum++) {	711	for (snum = *resume_hnd; snum < num_services; snum++) {
692	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {	712	if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares \|\| !is_hidden_share(snum)) ) {
Lines 1137-1144 Link Here
1137	int i;	1157	int i;
1138	if (*total_entries > 0) {	1158	if (*total_entries > 0) {
1139	ctr->ptr_entries = 1;	1159	ctr->ptr_entries = 1;
1140	ctr->file.info3 = talloc(ctx, ctr->num_entries *	1160	ctr->file.info3 = TALLOC_ARRAY(ctx, SRV_FILE_INFO_3, ctr->num_entries);
1141	sizeof(SRV_FILE_INFO_3));
1142	}	1161	}
1143	for (i=0 ;i<ctr->num_entries;i++) {	1162	for (i=0 ;i<ctr->num_entries;i++) {
1144	init_srv_file_info3(&ctr->file.info3[i].info_3, i+*resume_hnd, 0x35, 0, "\\PIPE\\samr", "dummy user");	1163	init_srv_file_info3(&ctr->file.info3[i].info_3, i+*resume_hnd, 0x35, 0, "\\PIPE\\samr", "dummy user");
Lines 1189-1195 Link Here
1189	WERROR _srv_net_srv_get_info(pipes_struct p, SRV_Q_NET_SRV_GET_INFO q_u, SRV_R_NET_SRV_GET_INFO *r_u)	1208	WERROR _srv_net_srv_get_info(pipes_struct p, SRV_Q_NET_SRV_GET_INFO q_u, SRV_R_NET_SRV_GET_INFO *r_u)
1190	{	1209	{
1191	WERROR status = WERR_OK;	1210	WERROR status = WERR_OK;
1192	SRV_INFO_CTR ctr = (SRV_INFO_CTR )talloc(p->mem_ctx, sizeof(SRV_INFO_CTR));	1211	SRV_INFO_CTR *ctr = TALLOC_P(p->mem_ctx, SRV_INFO_CTR);
1193		1212
1194	if (!ctr)	1213	if (!ctr)
1195	return WERR_NOMEM;	1214	return WERR_NOMEM;
Lines 1292-1298 Link Here
1292	{	1311	{
1293	DEBUG(5,("srv_net_conn_enum: %d\n", __LINE__));	1312	DEBUG(5,("srv_net_conn_enum: %d\n", __LINE__));
1294		1313
1295	r_u->ctr = (SRV_CONN_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_CONN_INFO_CTR));	1314	r_u->ctr = TALLOC_P(p->mem_ctx, SRV_CONN_INFO_CTR);
1296	if (!r_u->ctr)	1315	if (!r_u->ctr)
1297	return WERR_NOMEM;	1316	return WERR_NOMEM;
1298		1317
Lines 1317-1323 Link Here
1317	{	1336	{
1318	DEBUG(5,("_srv_net_sess_enum: %d\n", __LINE__));	1337	DEBUG(5,("_srv_net_sess_enum: %d\n", __LINE__));
1319		1338
1320	r_u->ctr = (SRV_SESS_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_SESS_INFO_CTR));	1339	r_u->ctr = TALLOC_P(p->mem_ctx, SRV_SESS_INFO_CTR);
1321	if (!r_u->ctr)	1340	if (!r_u->ctr)
1322	return WERR_NOMEM;	1341	return WERR_NOMEM;
1323		1342
Lines 1800-1806 Link Here
1800	struct tm *t;	1819	struct tm *t;
1801	time_t unixdate = time(NULL);	1820	time_t unixdate = time(NULL);
1802		1821
1803	tod = (TIME_OF_DAY_INFO *)talloc(p->mem_ctx, sizeof(TIME_OF_DAY_INFO));	1822	tod = TALLOC_P(p->mem_ctx, TIME_OF_DAY_INFO);
1804	if (!tod)	1823	if (!tod)
1805	return WERR_NOMEM;	1824	return WERR_NOMEM;
1806		1825
Lines 2119-2136 Link Here
2119		2138
2120	r_u->disk_enum_ctr.unknown = 0;	2139	r_u->disk_enum_ctr.unknown = 0;
2121		2140
2122	{	2141	if(!(r_u->disk_enum_ctr.disk_info = TALLOC_ARRAY(ctx, DISK_INFO, MAX_SERVER_DISK_ENTRIES))) {
2123	DISK_INFO *dinfo;
2124
2125	int dinfo_size = MAX_SERVER_DISK_ENTRIES * sizeof(*dinfo);
2126
2127	if(!(dinfo = talloc(ctx, dinfo_size))) {
2128	return WERR_NOMEM;	2142	return WERR_NOMEM;
2129	}	2143	}
2130		2144
2131	r_u->disk_enum_ctr.disk_info = dinfo;
2132	}
2133
2134	r_u->disk_enum_ctr.disk_info_ptr = r_u->disk_enum_ctr.disk_info ? 1 : 0;	2145	r_u->disk_enum_ctr.disk_info_ptr = r_u->disk_enum_ctr.disk_info ? 1 : 0;
2135		2146
2136	/allow one DISK_INFO for null terminator/	2147	/allow one DISK_INFO for null terminator/

Lines 276-282 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_util.c (-2 / +2 lines)
276		276
277	if (n_unix_groups > 0) {	277	if (n_unix_groups > 0) {
278		278
279	pgids = talloc(ctx, sizeof(DOM_GID) n_unix_groups);	279	*pgids = TALLOC_ARRAY(ctx, DOM_GID, n_unix_groups);
280		280
281	if (!*pgids) {	281	if (!*pgids) {
282	DEBUG(0, ("get_user_group: malloc() failed for DOM_GID list!\n"));	282	DEBUG(0, ("get_user_group: malloc() failed for DOM_GID list!\n"));
Lines 324-330 Link Here
324	DOM_GID *gids;	324	DOM_GID *gids;
325	int i;	325	int i;
326		326
327	gids = (DOM_GID )talloc(mem_ctx, sizeof(gids) * nt_token->num_sids);	327	gids = TALLOC_ARRAY(mem_ctx, DOM_GID, nt_token->num_sids);
328		328
329	if (!gids) {	329	if (!gids) {
330	return NT_STATUS_NO_MEMORY;	330	return NT_STATUS_NO_MEMORY;

Lines 65-71 Link Here

(-)samba-3.0.9-orig/source/rpc_server/srv_wkssvc_nt.c (-1 / +1 lines)
65		65
66	DEBUG(5,("_wks_query_info: %d\n", __LINE__));	66	DEBUG(5,("_wks_query_info: %d\n", __LINE__));
67		67
68	wks100 = (WKS_INFO_100 *)talloc_zero(p->mem_ctx, sizeof(WKS_INFO_100));	68	wks100 = TALLOC_ZERO_P(p->mem_ctx, WKS_INFO_100);
69		69
70	if (!wks100)	70	if (!wks100)
71	return NT_STATUS_NO_MEMORY;	71	return NT_STATUS_NO_MEMORY;

Lines 83-89 Link Here

(-)samba-3.0.9-orig/source/sam/idmap.c (-1 / +1 lines)
83	return NT_STATUS_OBJECT_NAME_COLLISION;	83	return NT_STATUS_OBJECT_NAME_COLLISION;
84	}	84	}
85		85
86	entry = smb_xmalloc(sizeof(struct idmap_function_entry));	86	entry = SMB_XMALLOC_P(struct idmap_function_entry);
87	entry->name = smb_xstrdup(name);	87	entry->name = smb_xstrdup(name);
88	entry->methods = methods;	88	entry->methods = methods;
89		89

Lines 487-493 Link Here

(-)samba-3.0.9-orig/source/sam/idmap_tdb.c (-1 / +1 lines)
487	BOOL tdb_is_new = False;	487	BOOL tdb_is_new = False;
488		488
489	/* use the old database if present */	489	/* use the old database if present */
490	tdbfile = strdup(lock_path("winbindd_idmap.tdb"));	490	tdbfile = SMB_STRDUP(lock_path("winbindd_idmap.tdb"));
491	if (!tdbfile) {	491	if (!tdbfile) {
492	DEBUG(0, ("idmap_init: out of memory!\n"));	492	DEBUG(0, ("idmap_init: out of memory!\n"));
493	return NT_STATUS_NO_MEMORY;	493	return NT_STATUS_NO_MEMORY;




	 * the expiration time here.
	 */

	if((blr = SMB_MALLOC_P(blocking_lock_record)) == NULL) {
		DEBUG(0,("push_blocking_lock_request: Malloc fail !\n" ));
		return False;
	}

	if((blr->inbuf = (char *)SMB_MALLOC(length)) == NULL) {
		DEBUG(0,("push_blocking_lock_request: Malloc fail (2)!\n" ));
		SAFE_FREE(blr);
		return False;

Lines 132-138 Link Here

(-)samba-3.0.9-orig/source/smbd/conn.c (-1 / +1 lines)
132	return NULL;	132	return NULL;
133	}	133	}
134		134
135	if ((conn=(connection_struct )talloc_zero(mem_ctx, sizeof(conn)))==NULL) {	135	if ((conn=TALLOC_ZERO_P(mem_ctx, connection_struct))==NULL) {
136	DEBUG(0,("talloc_zero() failed!\n"));	136	DEBUG(0,("talloc_zero() failed!\n"));
137	return NULL;	137	return NULL;
138	}	138	}




	if (dptrs_open >= MAX_OPEN_DIRECTORIES)
		dptr_idleoldest();

	dptr = SMB_MALLOC_P(dptr_struct);
	if(!dptr) {
		DEBUG(0,("malloc fail in dptr_create.\n"));
		return -1;


	if (!p)
		return(NULL);
	dirp = SMB_MALLOC_P(Dir);
	if (!dirp) {
		DEBUG(0,("Out of memory in OpenDir\n"));
		SMB_VFS_CLOSEDIR(conn,p);

		if (used + l > dirp->mallocsize) {
			int s = MAX(used+l,used+2000);
			char *r;
			r = (char *)SMB_REALLOC(dirp->data,s);
			if (!r) {
				DEBUG(0,("Out of memory in OpenDir\n"));
					break;

Lines 132-138 Link Here

(-)samba-3.0.9-orig/source/smbd/fake_file.c (-1 / +1 lines)
132	return NULL;	132	return NULL;
133	}	133	}
134		134
135	if ((fh =(FAKE_FILE_HANDLE *)talloc_zero(mem_ctx, sizeof(FAKE_FILE_HANDLE)))==NULL) {	135	if ((fh =TALLOC_ZERO_P(mem_ctx, FAKE_FILE_HANDLE))==NULL) {
136	DEBUG(0,("talloc_zero() failed.\n"));	136	DEBUG(0,("talloc_zero() failed.\n"));
137	talloc_destroy(mem_ctx);	137	talloc_destroy(mem_ctx);
138	return NULL;	138	return NULL;

Lines 662-668 Link Here

(-)samba-3.0.9-orig/source/smbd/fileio.c (-2 / +2 lines)
662	if(alloc_size == 0 \|\| fsp->wcp)	662	if(alloc_size == 0 \|\| fsp->wcp)
663	return False;	663	return False;
664		664
665	if((wcp = (write_cache *)malloc(sizeof(write_cache))) == NULL) {	665	if((wcp = SMB_MALLOC_P(write_cache)) == NULL) {
666	DEBUG(0,("setup_write_cache: malloc fail.\n"));	666	DEBUG(0,("setup_write_cache: malloc fail.\n"));
667	return False;	667	return False;
668	}	668	}
Lines 671-677 Link Here
671	wcp->offset = 0;	671	wcp->offset = 0;
672	wcp->alloc_size = alloc_size;	672	wcp->alloc_size = alloc_size;
673	wcp->data_size = 0;	673	wcp->data_size = 0;
674	if((wcp->data = malloc(wcp->alloc_size)) == NULL) {	674	if((wcp->data = SMB_MALLOC(wcp->alloc_size)) == NULL) {
675	DEBUG(0,("setup_write_cache: malloc fail for buffer size %u.\n",	675	DEBUG(0,("setup_write_cache: malloc fail for buffer size %u.\n",
676	(unsigned int)wcp->alloc_size ));	676	(unsigned int)wcp->alloc_size ));
677	SAFE_FREE(wcp);	677	SAFE_FREE(wcp);

Lines 93-99 Link Here

(-)samba-3.0.9-orig/source/smbd/files.c (-1 / +1 lines)
93	return NULL;	93	return NULL;
94	}	94	}
95		95
96	fsp = (files_struct )malloc(sizeof(fsp));	96	fsp = SMB_MALLOC_P(files_struct);
97	if (!fsp) {	97	if (!fsp) {
98	unix_ERR_class = ERRSRV;	98	unix_ERR_class = ERRSRV;
99	unix_ERR_code = ERRnofids;	99	unix_ERR_code = ERRnofids;




static BOOL api_rpc_trans_reply(char *outbuf, smb_np_struct *p)
{
	BOOL is_data_outstanding;
	char *rdata = SMB_MALLOC(p->max_trans_reply);
	int data_len;

	if(rdata == NULL) {

		goto bad_param;
  
	if (tdscnt)  {
		if((data = (char *)SMB_MALLOC(tdscnt)) == NULL) {
			DEBUG(0,("reply_trans: data malloc fail for %u bytes !\n", tdscnt));
			END_PROFILE(SMBtrans);
			return(ERROR_DOS(ERRDOS,ERRnomem));

	}

	if (tpscnt) {
		if((params = (char *)SMB_MALLOC(tpscnt)) == NULL) {
			DEBUG(0,("reply_trans: param malloc fail for %u bytes !\n", tpscnt));
			SAFE_FREE(data);
			END_PROFILE(SMBtrans);


	if (suwcnt) {
		unsigned int i;
		if((setup = SMB_MALLOC_ARRAY(uint16,suwcnt)) == NULL) {
			DEBUG(0,("reply_trans: setup malloc fail for %u bytes !\n", (unsigned int)(suwcnt * sizeof(uint16))));
			SAFE_FREE(data);
			SAFE_FREE(params);




		 */
		*rdata_len = 0;
		*rparam_len = 6;
		*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
		SSVALS(*rparam,0,ERRunknownlevel);
		SSVAL(*rparam,2,0);
		SSVAL(*rparam,4,0);

	}

	if (mdrcnt > 0) {
		*rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
		desc.base = *rdata;
		desc.buflen = mdrcnt;
	} else {

		 * init_package will return wrong size if buflen=0
		 */
		desc.buflen = getlen(desc.format);
		desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
	}

	if (init_package(&desc,1,count)) {

 
	*rdata_len = desc.usedlen;
	*rparam_len = 6;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
	SSVALS(*rparam,0,desc.errcode);
	SSVAL(*rparam,2,0);
	SSVAL(*rparam,4,desc.neededlen);

     */
    *rdata_len = 0;
    *rparam_len = 6;
    *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
    SSVALS(*rparam,0,ERRunknownlevel);
    SSVAL(*rparam,2,0);
    SSVAL(*rparam,4,0);

    if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i))
      queuecnt++;
  if (uLevel > 0) {
    if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
      DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
      return False;
    }
    memset(queue,0,queuecnt*sizeof(print_queue_struct*));
    if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
      DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
      return False;
    }
    memset(status,0,queuecnt*sizeof(print_status_struct));
    if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
      DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
      return False;
    }

 	n++;
      }
  }
  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  desc.base = *rdata;
  desc.buflen = mdrcnt;


 
  *rdata_len = desc.usedlen;
  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,succnt);

      struct srv_info_struct *ts;
      
      alloced += 10;
      ts = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
	Realloc(*servers,sizeof(**servers)*alloced);
      if (!ts) {
      	DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
	return(0);

  }

  *rdata_len = fixed_len + string_len;
  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
  memset(*rdata,'\0',*rdata_len);
  
  p2 = (*rdata) + fixed_len;	/* auxilliary data (strings) will go here */

  }
  
  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,counted);

  *rdata_len = 0;
  
  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

  SSVAL(*rparam,0,0x08AC); /* informational warning message */
  SSVAL(*rparam,2,0);

  if (!prefix_ok(str1,"zWrLh")) return False;
  if (!check_share_info(uLevel,str2)) return False;
 
  *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  p = *rdata;
  *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
  if (*rdata_len < 0) return False;
 
  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVAL(*rparam,0,NERR_Success);
  SSVAL(*rparam,2,0);		/* converter word */
  SSVAL(*rparam,4,*rdata_len);

    }
  }
  *rdata_len = fixed_len + string_len;
  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
  memset(*rdata,0,*rdata_len);
  
  p2 = (*rdata) + fixed_len;	/* auxiliary data (strings) will go here */

    }
  
  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,counted);

  } else return False;

  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVAL(*rparam,0,NERR_Success);
  SSVAL(*rparam,2,0);		/* converter word */
  SSVAL(*rparam,4,*rdata_len);


 error_exit:
  *rparam_len = 4;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  *rdata_len = 0;
  SSVAL(*rparam,0,res);
  SSVAL(*rparam,2,0);

	DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: %d\n", resume_context, cli_buf_size));

	*rdata_len = cli_buf_size;
	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);

	p = *rdata;


	*rdata_len = PTR_DIFF(p,*rdata);

	*rparam_len = 8;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

  	SSVAL(*rparam, 0, errflags);
  	SSVAL(*rparam, 2, 0);		/* converter word */

	DOM_SID sid, dom_sid;

	*rparam_len = 8;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  
	/* check it's a supported varient */
	

		return False;

	*rdata_len = mdrcnt + 1024;
	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);

	SSVAL(*rparam,0,NERR_Success);
	SSVAL(*rparam,2,0);		/* converter word */

	DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n", resume_context, cli_buf_size));

	*rparam_len = 8;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

	/* check it's a supported varient */
	if (strcmp("B21",str2) != 0)
		return False;

	*rdata_len = cli_buf_size;
	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);

	p = *rdata;


{
  char *p;
  *rparam_len = 4;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

  *rdata_len = 21;
  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);

  SSVAL(*rparam,0,NERR_Success);
  SSVAL(*rparam,2,0);		/* converter word */

	memcpy(pass2,p+16,16);

	*rparam_len = 4;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

	*rdata_len = 0;


	fstring user;
	char *p = param + 2;
	*rparam_len = 2;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

	*rdata_len = 0;


		return(False);

	*rparam_len = 4;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);	
	*rdata_len = 0;

	if (!print_job_exists(sharename, jobid)) {

		return(False);

	*rparam_len = 4;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
	*rdata_len = 0;

	snum = print_queue_snum(QueueName);

	if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
		return False;
	*rparam_len = 4;
	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

	if ( (snum = lp_servicenumber(sharename)) == -1 ) {
		DEBUG(0,("api_PrintJobInfo: unable to get service number from sharename [%s]\n",

  }

  *rdata_len = mdrcnt;
  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);

  p = *rdata;
  p2 = p + struct_len;

  *rdata_len = PTR_DIFF(p2,*rdata);

  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVAL(*rparam,0,NERR_Success);
  SSVAL(*rparam,2,0);		/* converter word */
  SSVAL(*rparam,4,*rdata_len);

  DEBUG(4,("NetWkstaGetInfo level %d\n",level));

  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

  /* check it's a supported varient */
  if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz")))
    return(False);

  *rdata_len = mdrcnt + 1024;
  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);

  SSVAL(*rparam,0,NERR_Success);
  SSVAL(*rparam,2,0);		/* converter word */

	       vuser->user.unix_name));

    *rparam_len = 6;
    *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

    DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
  

	if (strcmp(level_string,str2) != 0) return False;

	*rdata_len = mdrcnt + 1024;
	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);

	SSVAL(*rparam,0,NERR_Success);
	SSVAL(*rparam,2,0);		/* converter word */

  /* check it's a supported varient */
  if (strcmp(str1,"OOWb54WrLh") != 0) return False;
  if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) return False;
  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  desc.base = *rdata;
  desc.buflen = mdrcnt;
  desc.subformat = NULL;


  *rdata_len = desc.usedlen;
  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,desc.neededlen);

  if (strcmp(str2,"") != 0) return False;

  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,0);		/* errorcode */
  SSVAL(*rparam,2,0);		/* converter word */
  SSVAL(*rparam,4,0x7f);	/* permission flags */

  }

  if (mdrcnt > 0) {
    *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
    desc.base = *rdata;
    desc.buflen = mdrcnt;
  } else {

     *  init_package will return wrong size if buflen=0
     */
    desc.buflen = getlen(desc.format);
    desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
  }

  if (init_package(&desc,1,0)) {

  }

  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,desc.neededlen);

  if (snum < 0 || !VALID_SNUM(snum)) return(False);

  count = print_queue_status(snum,&queue,&status);
  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  desc.base = *rdata;
  desc.buflen = mdrcnt;


  *rdata_len = desc.usedlen;

  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,succnt);

  }
  else {
    if (mdrcnt > 0) {
      *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
      desc.base = *rdata;
      desc.buflen = mdrcnt;
    } else {

       *  init_package will return wrong size if buflen=0
       */
      desc.buflen = getlen(desc.format);
      desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
    }
    if (init_package(&desc,1,0)) {
      fill_printdest_info(conn,snum,uLevel,&desc);

  }

  *rparam_len = 6;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,desc.neededlen);

    if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i))
      queuecnt++;

  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  desc.base = *rdata;
  desc.buflen = mdrcnt;
  if (init_package(&desc,queuecnt,0)) {    

  *rdata_len = desc.usedlen;

  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,succnt);

  if (strcmp(str1,"WrLeh") != 0) return False;
  if (uLevel != 0 || strcmp(str2,"B41") != 0) return False;

  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  desc.base = *rdata;
  desc.buflen = mdrcnt;
  if (init_package(&desc,1,0)) {

  *rdata_len = desc.usedlen;

  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,succnt);

  if (strcmp(str1,"WrLeh") != 0) return False;
  if (uLevel != 0 || strcmp(str2,"B13") != 0) return False;

  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  desc.base = *rdata;
  desc.buflen = mdrcnt;
  desc.format = str2;

  *rdata_len = desc.usedlen;

  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,succnt);

  if (strcmp(str1,"WrLeh") != 0) return False;
  if (uLevel != 0 || strcmp(str2,"B9") != 0) return False;

  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  memset((char *)&desc,'\0',sizeof(desc));
  desc.base = *rdata;
  desc.buflen = mdrcnt;

  *rdata_len = desc.usedlen;

  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0);
  SSVAL(*rparam,4,succnt);


  num_sessions = list_sessions(&session_list);

  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
  memset((char *)&desc,'\0',sizeof(desc));
  desc.base = *rdata;
  desc.buflen = mdrcnt;

  *rdata_len = desc.usedlen;

  *rparam_len = 8;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
  SSVALS(*rparam,0,desc.errcode);
  SSVAL(*rparam,2,0); /* converter */
  SSVAL(*rparam,4,num_sessions); /* count */

			 int *rdata_len,int *rparam_len)
{
  *rparam_len = MIN(*rparam_len,mprcnt);
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

  *rdata_len = 0;


			    int *rdata_len,int *rparam_len)
{
  *rparam_len = 4;
  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);

  *rdata_len = 0;


		  return ERROR_NT(NT_STATUS_ACCESS_DENIED);
  }

  rdata = (char *)SMB_MALLOC(1024);
  if (rdata)
    memset(rdata,'\0',1024);

  rparam = (char *)SMB_MALLOC(1024);
  if (rparam)
    memset(rparam,'\0',1024);


Lines 153-165 Link Here

(-)samba-3.0.9-orig/source/smbd/mangle_hash2.c (-6 / +12 lines)
153	*/	153	*/
154	static BOOL cache_init(void)	154	static BOOL cache_init(void)
155	{	155	{
156	if (prefix_cache) return True;	156	if (prefix_cache) {
		157	return True;
		158	}
157		159
158	prefix_cache = calloc(MANGLE_CACHE_SIZE, sizeof(char *));	160	prefix_cache = SMB_CALLOC_ARRAY(char *,MANGLE_CACHE_SIZE);
159	if (!prefix_cache) return False;	161	if (!prefix_cache) {
		162	return False;
		163	}
160		164
161	prefix_cache_hashes = calloc(MANGLE_CACHE_SIZE, sizeof(u32));	165	prefix_cache_hashes = SMB_CALLOC_ARRAY(u32, MANGLE_CACHE_SIZE);
162	if (!prefix_cache_hashes) return False;	166	if (!prefix_cache_hashes) {
		167	return False;
		168	}
163		169
164	return True;	170	return True;
165	}	171	}
Lines 175-181 Link Here
175	free(prefix_cache[i]);	181	free(prefix_cache[i]);
176	}	182	}
177		183
178	prefix_cache[i] = strndup(prefix, length);	184	prefix_cache[i] = SMB_STRNDUP(prefix, length);
179	prefix_cache_hashes[i] = hash;	185	prefix_cache_hashes[i] = hash;
180	}	186	}
181		187

Lines 476-482 Link Here

(-)samba-3.0.9-orig/source/smbd/mangle_hash.c (-2 / +2 lines)
476	if(data_val.dptr == NULL \|\| data_val.dsize == 0) {	476	if(data_val.dptr == NULL \|\| data_val.dsize == 0) {
477	ext_start = strrchr( s, '.' );	477	ext_start = strrchr( s, '.' );
478	if( ext_start ) {	478	if( ext_start ) {
479	if((saved_ext = strdup(ext_start)) == NULL)	479	if((saved_ext = SMB_STRDUP(ext_start)) == NULL)
480	return False;	480	return False;
481		481
482	*ext_start = '\0';	482	*ext_start = '\0';
Lines 624-630 Link Here
624		624
625	/* mangle it into 8.3 */	625	/* mangle it into 8.3 */
626	if (cache83)	626	if (cache83)
627	tmp = strdup(OutName);	627	tmp = SMB_STRDUP(OutName);
628		628
629	to_8_3(OutName, default_case);	629	to_8_3(OutName, default_case);
630		630





	DEBUG(10,("parse_symlink: count=%d\n", count));

	reflist = *preflist = SMB_MALLOC_ARRAY(struct referral, count);
	if(reflist == NULL) {
		DEBUG(0,("parse_symlink: Malloc failed!\n"));
		return False;

		*self_referralp = True;

	jucn->referral_count = 1;
	if((ref = SMB_MALLOC_P(struct referral)) == NULL) {
		DEBUG(0,("self_ref: malloc failed for referral\n"));
		return False;
	}

					self_referralp);

		jucn->referral_count = 1;
		if ((ref = SMB_MALLOC_P(struct referral)) == NULL) {
			DEBUG(0, ("malloc failed for referral\n"));
			goto out;
		}

	/* add the unexplained 0x16 bytes */
	reply_size += 0x16;

	pdata = SMB_REALLOC(pdata,reply_size);
	if(pdata == NULL) {
		DEBUG(0,("malloc failed for Realloc!\n"));
		return -1;

		reply_size += (strlen(junction->referral_list[i].alternate_path)+1)*2;
	}

	pdata = SMB_REALLOC(pdata,reply_size);
	if(pdata == NULL) {
		DEBUG(0,("version3 referral setup: malloc failed for Realloc!\n"));
		return -1;

	jucn[cnt].volume_name[0] = '\0';
	jucn[cnt].referral_count = 1;

	ref = jucn[cnt].referral_list = SMB_MALLOC_P(struct referral);
		= (struct referral*) malloc(sizeof(struct referral));
	if (jucn[cnt].referral_list == NULL) {
		DEBUG(0, ("Malloc failed!\n"));
		goto out;

Lines 178-184 Link Here

(-)samba-3.0.9-orig/source/smbd/notify.c (-1 / +1 lines)
178	{	178	{
179	struct change_notify *cnbp;	179	struct change_notify *cnbp;
180		180
181	if((cnbp = (struct change_notify )malloc(sizeof(cnbp))) == NULL) {	181	if((cnbp = SMB_MALLOC_P(struct change_notify)) == NULL) {
182	DEBUG(0,("change_notify_set: malloc fail !\n" ));	182	DEBUG(0,("change_notify_set: malloc fail !\n" ));
183	return -1;	183	return -1;
184	}	184	}




		DEBUG(15,("quota entry for id[%s] path[%s]\n",
			sid_string_static(&sid),fsp->conn->connectpath));

		if ((tmp_list_ent=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_LIST))==NULL) {
			DEBUG(0,("talloc_zero() failed\n"));
			*qt_list = NULL;
			talloc_destroy(mem_ctx);
			return (-1);
		}

		if ((tmp_list_ent->quotas=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_STRUCT))==NULL) {
			DEBUG(0,("talloc_zero() failed\n"));
			*qt_list = NULL;
			talloc_destroy(mem_ctx);

	if (!mem_ctx)
		return False;

	qt_handle = TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_HANDLE);
	if (qt_handle==NULL) {
		DEBUG(0,("talloc_zero() failed\n"));
		return NULL;




	if (ptr==NULL)
		smb_panic("nttrans_realloc() called with NULL ptr\n");
		
	tptr = SMB_REALLOC(*ptr, size);
	if(tptr == NULL) {
		*ptr = NULL;
		return NULL;
	}
	memset(tptr,'\0',size);

	*ptr = tptr;


			return ERROR_NT(NT_STATUS_NO_MEMORY);
		}

		shadow_data = TALLOC_ZERO_P(shadow_mem_ctx,SHADOW_COPY_DATA);
		if (shadow_data == NULL) {
			DEBUG(0,("talloc_zero() failed!\n"));
			return ERROR_NT(NT_STATUS_NO_MEMORY);

			}

			sid_len = IVAL(pdata,4);
			/* Ensure this is less than 1mb. */
			if (sid_len > (1024*1024)) {
				return ERROR_DOS(ERRDOS,ERRnomem);
			}

			if (data_count < 8+sid_len) {
				DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));

		goto bad_param;
	}
    
	/* Don't allow more than 128mb for each value. */
	if ((total_parameter_count > (1024*1024*128)) || (total_data_count > (1024*1024*128))) {
		END_PROFILE(SMBnttrans);
		return ERROR_DOS(ERRDOS,ERRnomem);
	}

	/* Allocate the space for the setup, the maximum needed parameters and data */

	if(setup_count > 0)
		setup = (char *)SMB_MALLOC(setup_count);
	if (total_parameter_count > 0)
		params = (char *)SMB_MALLOC(total_parameter_count);
	if (total_data_count > 0)
		data = (char *)SMB_MALLOC(total_data_count);
 
	if ((total_parameter_count && !params)  || (total_data_count && !data) ||
				(setup_count && !setup)) {

Lines 681-687 Link Here

(-)samba-3.0.9-orig/source/smbd/open.c (-1 / +1 lines)
681	return -1;	681	return -1;
682	}	682	}
683		683
684	broken_entry = malloc(sizeof(struct share_mode_entry_list));	684	broken_entry = SMB_MALLOC_P(struct share_mode_entry_list);
685	if (!broken_entry) {	685	if (!broken_entry) {
686	smb_panic("open_mode_check: malloc fail.\n");	686	smb_panic("open_mode_check: malloc fail.\n");
687	}	687	}




	 * messages crossing on the wire.
	 */

	if((inbuf = (char *)SMB_MALLOC(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN))==NULL) {
		DEBUG(0,("oplock_break: malloc fail for input buffer.\n"));
		return False;
	}

	if((outbuf = (char *)SMB_MALLOC(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN))==NULL) {
		DEBUG(0,("oplock_break: malloc fail for output buffer.\n"));
		SAFE_FREE(inbuf);
		return False;




		return UID_FIELD_INVALID;
	}

	if((vuser = SMB_MALLOC_P(user_struct)) == NULL) {
		DEBUG(0,("Failed to malloc users struct!\n"));
		data_blob_free(&session_key);
		return UID_FIELD_INVALID;

			DEBUG(3,("add_session_user: session userlist already too large.\n"));
			return;
		}
		newlist = SMB_REALLOC( session_userlist, len_session_userlist + PSTRING_LEN );
		if( newlist == NULL ) {
			DEBUG(1,("Unable to resize session_userlist\n"));
			return;

		char *user_list = NULL;

		if ( session_userlist )
			user_list = SMB_STRDUP(session_userlist);
		else
			user_list = SMB_STRDUP("");

		if (!user_list)
			return(False);





	*store_size = PAI_ENTRIES_BASE + ((num_entries + num_def_entries)*PAI_ENTRY_LENGTH);

	pai_buf = SMB_MALLOC(*store_size);
	if (!pai_buf) {
		return NULL;
	}

	if (!check_pai_ok(buf, size))
		return NULL;

	paiv = SMB_MALLOC_P(struct pai_val);
	if (!paiv)
		return NULL;


	for (i = 0; i < paiv->num_entries; i++) {
		struct pai_entry *paie;

		paie = SMB_MALLOC_P(struct pai_entry);
		if (!paie) {
			free_inherited_info(paiv);
			return NULL;

	for (i = 0; i < paiv->num_def_entries; i++) {
		struct pai_entry *paie;

		paie = SMB_MALLOC_P(struct pai_entry);
		if (!paie) {
			free_inherited_info(paiv);
			return NULL;

	if (!lp_map_acl_inherit(SNUM(fsp->conn)))
		return NULL;

	if ((pai_buf = SMB_MALLOC(pai_buf_size)) == NULL)
		return NULL;

	do {

			/* Buffer too small - enlarge it. */
			pai_buf_size *= 2;
			SAFE_FREE(pai_buf);
			if (pai_buf_size > 1024*1024) {
				return NULL; /* Limit malloc to 1mb. */
			}
			if ((pai_buf = SMB_MALLOC(pai_buf_size)) == NULL)
				return NULL;
		}
	} while (ret == -1);


static canon_ace *dup_canon_ace( canon_ace *src_ace)
{
	canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);

	if (dst_ace == NULL)
		return NULL;

	}

	if (!got_user) {
		if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
			DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
			return False;
		}

	}

	if (!got_grp) {
		if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
			DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
			return False;
		}

	}

	if (!got_other) {
		if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
			DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
			return False;
		}

		 * Create a cannon_ace entry representing this NT DACL ACE.
		 */

		if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
			free_canon_ace_list(file_ace);
			free_canon_ace_list(dir_ace);
			DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));

		 * Add this entry to the list.
		 */

		if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
			goto fail;

		ZERO_STRUCTP(ace);

			num_dir_acls = count_canon_ace_list(dir_ace);

			/* Allocate the ace list. */
			if ((nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE, num_acls + num_profile_acls + num_dir_acls)) == NULL) {
				DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
				goto done;
			}




static BOOL push_queued_message(enum q_type qt, char *buf, int msg_len, struct timeval *ptv, char *private, size_t private_len)
{
	struct pending_message_list *tmp_msg;
	struct pending_message_list *msg = SMB_MALLOC_P(struct pending_message_list);
                               malloc(sizeof(struct pending_message_list));

	if(msg == NULL) {
		DEBUG(0,("push_message: malloc fail (1)\n"));

	unsigned int num_smbs = 0;
	const size_t total_buffer_size = BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN;

	InBuffer = (char *)SMB_MALLOC(total_buffer_size);
	OutBuffer = (char *)SMB_MALLOC(total_buffer_size);
	if ((InBuffer == NULL) || (OutBuffer == NULL)) 
		return;


Lines 900-906 Link Here

(-)samba-3.0.9-orig/source/smbd/reply.c (-2 / +2 lines)
900	END_PROFILE(SMBsearch);	900	END_PROFILE(SMBsearch);
901	return ERROR_DOS(ERRDOS,ERRnofids);	901	return ERROR_DOS(ERRDOS,ERRnofids);
902	}	902	}
903	dptr_set_wcard(dptr_num, strdup(mask));	903	dptr_set_wcard(dptr_num, SMB_STRDUP(mask));
904	dptr_set_attr(dptr_num, dirtype);	904	dptr_set_attr(dptr_num, dirtype);
905	} else {	905	} else {
906	dirtype = dptr_attr(dptr_num);	906	dirtype = dptr_attr(dptr_num);
Lines 4884-4890 Link Here
4884	if(fsp->wbmpx_ptr != NULL)	4884	if(fsp->wbmpx_ptr != NULL)
4885	wbms = fsp->wbmpx_ptr; /* Use an existing struct */	4885	wbms = fsp->wbmpx_ptr; /* Use an existing struct */
4886	else	4886	else
4887	wbms = (write_bmpx_struct *)malloc(sizeof(write_bmpx_struct));	4887	wbms = SMB_MALLOC_P(write_bmpx_struct);
4888	if(!wbms) {	4888	if(!wbms) {
4889	DEBUG(0,("Out of memory in reply_readmpx\n"));	4889	DEBUG(0,("Out of memory in reply_readmpx\n"));
4890	END_PROFILE(SMBwriteBmpx);	4890	END_PROFILE(SMBwriteBmpx);

Lines 154-160 Link Here

(-)samba-3.0.9-orig/source/smbd/sec_ctx.c (-2 / +2 lines)
154	goto fail;	154	goto fail;
155	}	155	}
156		156
157	if((groups = (gid_t )malloc(sizeof(gid_t)(ngroups+1))) == NULL) {	157	if((groups = SMB_MALLOC_ARRAY(gid_t, ngroups+1)) == NULL) {
158	DEBUG(0,("setup_groups malloc fail !\n"));	158	DEBUG(0,("setup_groups malloc fail !\n"));
159	goto fail;	159	goto fail;
160	}	160	}
Lines 260-266 Link Here
260	ctx_p->ngroups = sys_getgroups(0, NULL);	260	ctx_p->ngroups = sys_getgroups(0, NULL);
261		261
262	if (ctx_p->ngroups != 0) {	262	if (ctx_p->ngroups != 0) {
263	if (!(ctx_p->groups = malloc(ctx_p->ngroups * sizeof(gid_t)))) {	263	if (!(ctx_p->groups = SMB_MALLOC_ARRAY(gid_t, ctx_p->ngroups))) {
264	DEBUG(0, ("Out of memory in push_sec_ctx()\n"));	264	DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
265	delete_nt_token(&ctx_p->token);	265	delete_nt_token(&ctx_p->token);
266	return False;	266	return False;

Lines 151-157 Link Here

(-)samba-3.0.9-orig/source/smbd/session.c (-3 / +3 lines)
151	sessionid.id_str, sessionid.id_num);	151	sessionid.id_str, sessionid.id_num);
152	}	152	}
153		153
154	vuser->session_keystr = strdup(keystr);	154	vuser->session_keystr = SMB_STRDUP(keystr);
155	if (!vuser->session_keystr) {	155	if (!vuser->session_keystr) {
156	DEBUG(0, ("session_claim: strdup() failed for session_keystr\n"));	156	DEBUG(0, ("session_claim: strdup() failed for session_keystr\n"));
157	return False;	157	return False;
Lines 221-228 Link Here
221	const struct sessionid current = (const struct sessionid ) dbuf.dptr;	221	const struct sessionid current = (const struct sessionid ) dbuf.dptr;
222		222
223	sesslist->count += 1;	223	sesslist->count += 1;
224	sesslist->sessions = REALLOC(sesslist->sessions, sesslist->count *	224	sesslist->sessions = SMB_REALLOC_ARRAY(sesslist->sessions, struct sessionid,
225	sizeof(struct sessionid));	225	sesslist->count);
226		226
227	memcpy(&sesslist->sessions[sesslist->count - 1], current,	227	memcpy(&sesslist->sessions[sesslist->count - 1], current,
228	sizeof(struct sessionid));	228	sizeof(struct sessionid));




	 * translated path.
	 */

	translated_path = SMB_STRDUP(orig_translated_path);
	if (!translated_path)
		return;


	}

	if(case_sensitive) {
		original_path = SMB_STRDUP(full_orig_name);
	} else {
		original_path = strdup_upper(full_orig_name);
	}

		return False;

	if (conn->case_sensitive) {
		chk_name = SMB_STRDUP(name);
		if (!chk_name) {
			DEBUG(0, ("stat_cache_lookup: strdup failed!\n"));
			return False;





 again:

	val = TALLOC_REALLOC_ARRAY(mem_ctx, val, char, attr_size);
	if (!val) {
		return False;
	}

		return NULL;
	}

	for (i = 0, ea_namelist = TALLOC(mem_ctx, ea_namelist_size); i < 6;
			ea_namelist = TALLOC_REALLOC_ARRAY(mem_ctx, ea_namelist, char, ea_namelist_size), i++) {
		if (fsp && fsp->fd != -1) {
			sizeret = SMB_VFS_FLISTXATTR(fsp, fsp->fd, ea_namelist, ea_namelist_size);
		} else {

			if (strnequal(p, "system.", 7) || samba_private_attr_name(p))
				continue;
		
			listp = TALLOC_P(mem_ctx, struct ea_list);
			if (!listp)
				return NULL;


	}

	/* Realloc the size of parameters and data we will return */
	params = SMB_REALLOC(*pparams, 28);
	if( params == NULL )
		return(ERROR_DOS(ERRDOS,ERRnomem));
	*pparams = params;


	DEBUG(5,("dir=%s, mask = %s\n",directory, mask));

	pdata = SMB_REALLOC(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
	if( pdata == NULL )
		return(ERROR_DOS(ERRDOS,ERRnomem));


	memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);

	/* Realloc the params space */
	params = SMB_REALLOC(*pparams, 10);
	if (params == NULL)
		return ERROR_DOS(ERRDOS,ERRnomem);
	*pparams = params;

	/* Save the wildcard match and attribs we are using on this directory - 
		needed as lanman2 assumes these are being saved between calls */

	if(!(wcard = SMB_STRDUP(mask))) {
		dptr_close(&dptr_num);
		return ERROR_DOS(ERRDOS,ERRnomem);
	}

			return ERROR_DOS(ERRDOS,ERRunknownlevel);
	}

	pdata = SMB_REALLOC( *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
	if(pdata == NULL)
		return ERROR_DOS(ERRDOS,ERRnomem);


	memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);

	/* Realloc the params space */
	params = SMB_REALLOC(*pparams, 6*SIZEOFWORD);
	if( params == NULL )
		return ERROR_DOS(ERRDOS,ERRnomem);


		return ERROR_DOS(ERRSRV,ERRinvdevice);
	}

	pdata = SMB_REALLOC(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
	if ( pdata == NULL )
		return ERROR_DOS(ERRDOS,ERRnomem);


	if (mode & aDIR)
		file_size = 0;

	params = SMB_REALLOC(*pparams,2);
	if (params == NULL)
	  return ERROR_DOS(ERRDOS,ERRnomem);
	*pparams = params;
	memset((char *)params,'\0',2);
	data_size = max_data_bytes + DIR_ENTRY_SAFETY_MARGIN;
	pdata = SMB_REALLOC(*ppdata, data_size); 
	if ( pdata == NULL )
		return ERROR_DOS(ERRDOS,ERRnomem);
	*ppdata = pdata;

		tran_call,fname, fsp ? fsp->fnum : -1, info_level,total_data));

	/* Realloc the parameter and data sizes */
	params = SMB_REALLOC(*pparams,2);
	if(params == NULL)
		return ERROR_DOS(ERRDOS,ERRnomem);
	*pparams = params;

	}

	/* Realloc the parameter and data sizes */
	params = SMB_REALLOC(*pparams,2);
	if(params == NULL)
		return ERROR_DOS(ERRDOS,ERRnomem);
	*pparams = params;

	}

	/* Realloc the parameter and data sizes */
	params = SMB_REALLOC(*pparams,6);
	if(params == NULL) 
		return ERROR_DOS(ERRDOS,ERRnomem);
	*pparams = params;

	DEBUG(3,("call_trans2findnotifynext\n"));

	/* Realloc the parameter and data sizes */
	params = SMB_REALLOC(*pparams,4);
	if(params == NULL)
		return ERROR_DOS(ERRDOS,ERRnomem);
	*pparams = params;


	if ((SVAL(inbuf,(smb_setup+4)) == LMCAT_SPL) &&
			(SVAL(inbuf,(smb_setup+6)) == LMFUNC_GETJOBID)) {
		pdata = SMB_REALLOC(*ppdata, 32);
		if(pdata == NULL)
			return ERROR_DOS(ERRDOS,ERRnomem);
		*ppdata = pdata;

    
	/* Allocate the space for the maximum needed parameters and data */
	if (total_params > 0)
		params = (char *)SMB_MALLOC(total_params);
	if (total_data > 0)
		data = (char *)SMB_MALLOC(total_data);
  
	if ((total_params && !params)  || (total_data && !data)) {
		DEBUG(2,("Out of memory in reply_trans2\n"));




		return NT_STATUS_OBJECT_NAME_COLLISION;
	}

	entry = SMB_XMALLOC_P(struct vfs_init_function_entry);
	entry->name = smb_xstrdup(name);
	entry->vfs_op_tuples = vfs_op_tuples;


		return False;
	}

	handle = TALLOC_ZERO_P(conn->mem_ctx,vfs_handle_struct);
	if (!handle) {
		DEBUG(0,("talloc_zero() failed!\n"));
		SAFE_FREE(module_name);

	if (element == 0)
		return;

	p = (char *)SMB_MALLOC(elsize);

	if (!p) {
		DEBUG(5,("array_promote: malloc fail\n"));

				pstrcat(tmp_fname, last_component);
#ifdef REALPATH_TAKES_NULL
				SAFE_FREE(resolved_name);
				resolved_name = SMB_STRDUP(tmp_fname);
				if (!resolved_name) {
					DEBUG(0,("reduce_name: malloc fail for %s\n", tmp_fname));
					errno = saved_errno;





#else
#include "includes.h"

#ifdef malloc
#undef malloc
#endif
                                                                                                                 
#ifdef realloc
#undef realloc
#endif
                                                                                                                 
#ifdef calloc
#undef calloc
#endif

#endif

#include "tdb.h"




#include "spinlock.h"
#else
#include "includes.h"

#if defined(PARANOID_MALLOC_CHECKER)
#ifdef malloc
#undef malloc
#endif

#ifdef realloc
#undef realloc
#endif

#ifdef calloc
#undef calloc
#endif

#ifdef strdup
#undef strdup
#endif

#ifdef strndup
#undef strndup
#endif

#endif

#endif

#define TDB_MAGIC_FOOD "TDB file\n"




			len += *i;
			if (bufsize < len)
				goto no_space;
			*b = (char *)SMB_MALLOC(*i);
			if (! *b)
				goto no_space;
			memcpy(*b, buf+4, *i);

	
	for (key = tdb_firstkey(tdb); key.dptr; key = next) {
		/* duplicate key string to ensure null-termination */
		char *key_str = (char*) SMB_STRNDUP(key.dptr, key.dsize);
		if (!key_str) {
			DEBUG(0, ("tdb_search_keys: strndup() failed!\n"));
			smb_panic("strndup failed!\n");


		/* do the pattern checking */
		if (fnmatch(pattern, key_str, 0) == 0) {
			rec = SMB_MALLOC_P(TDB_LIST_NODE);
			ZERO_STRUCTP(rec);

			rec->node_key = key;




	if (!values) /* must be new field, indicate string field */
		return True;
	if (StrCaseCmp(field, "sAMAccountName") == 0) {
		disp_fields[0] = SMB_STRDUP((char *) values[0]);
	}
	if (StrCaseCmp(field, "description") == 0)
		disp_fields[1] = SMB_STRDUP((char *) values[0]);
	return True;
}


	}

	tmp_password = generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
	password = SMB_STRDUP(tmp_password);

	if (!(ads = ads_startup())) {
		return -1;




	if (!opt_password && !opt_machine_pass) {
		char *pass = getpass("Password:");
		if (pass) {
			opt_password = SMB_STRDUP(pass);
		}
	}
	

NTSTATUS connect_pipe(struct cli_state **cli_dst, int pipe_num, BOOL *got_pipe)
{
	NTSTATUS nt_status;
	char *server_name = SMB_STRDUP("127.0.0.1");
	struct cli_state *cli_tmp = NULL;

	if (opt_destination)
		server_name = SMB_STRDUP(opt_destination);

	/* make a connection to a named pipe */
	nt_status = connect_to_ipc(&cli_tmp, NULL, server_name);

{

	if (opt_host) {
		*server_name = SMB_STRDUP(opt_host);
	}		

	if (opt_have_ip) {
		*server_ip = opt_dest_ip;
		if (!*server_name) {
			*server_name = SMB_STRDUP(inet_ntoa(opt_dest_ip));
		}
	} else if (*server_name) {
		/* resolve the IP address */

			if ( !name_status_find(opt_target_workgroup, 0x1b, 0x20, pdc_ip, dc_name) )
				return False;
				
			*server_name = SMB_STRDUP(dc_name);
			*server_ip = pdc_ip;
		}
		

		} else {
			*server_ip = msbrow_ip;
		}
		*server_name = SMB_STRDUP(inet_ntoa(opt_dest_ip));
	} else if (flags & NET_FLAGS_MASTER) {
		struct in_addr brow_ips;
		if (!resolve_name(opt_target_workgroup, &brow_ips, 0x1D))  {

		} else {
			*server_ip = brow_ips;
		}
		*server_name = SMB_STRDUP(inet_ntoa(opt_dest_ip));
	} else if (!(flags & NET_FLAGS_LOCALHOST_DEFAULT_INSANE)) {
		extern struct in_addr loopback_ip;
		*server_ip = loopback_ip;
		*server_name = SMB_STRDUP("127.0.0.1");
	}

	if (!server_name || !*server_name) {

			break;
		case 'U':
			opt_user_specified = True;
			opt_user_name = SMB_STRDUP(opt_user_name);
			p = strchr(opt_user_name,'%');
			if (p) {
				*p = 0;

Lines 101-107 Link Here

(-)samba-3.0.9-orig/source/utils/net_cache.c (-1 / +1 lines)
101	/* number detection */	101	/* number detection */
102	len = (sign) ? strlen(&timeout_str[number_begin]) : len;	102	len = (sign) ? strlen(&timeout_str[number_begin]) : len;
103	number_end = (unit) ? len - 1 : len;	103	number_end = (unit) ? len - 1 : len;
104	number = strndup(&timeout_str[number_begin], number_end);	104	number = SMB_STRNDUP(&timeout_str[number_begin], number_end);
105		105
106	/* calculate actual timeout value */	106	/* calculate actual timeout value */
107	timeout = (time_t)atoi(number);	107	timeout = (time_t)atoi(number);

Lines 126-132 Link Here

(-)samba-3.0.9-orig/source/utils/net_idmap.c (-1 / +1 lines)
126	return NT_STATUS_UNSUCCESSFUL;	126	return NT_STATUS_UNSUCCESSFUL;
127	}	127	}
128		128
129	tdbfile = strdup(lock_path("winbindd_idmap.tdb"));	129	tdbfile = SMB_STRDUP(lock_path("winbindd_idmap.tdb"));
130	if (!tdbfile) {	130	if (!tdbfile) {
131	DEBUG(0, ("idmap_init: out of memory!\n"));	131	DEBUG(0, ("idmap_init: out of memory!\n"));
132	return NT_STATUS_NO_MEMORY;	132	return NT_STATUS_NO_MEMORY;

Lines 198-204 Link Here

(-)samba-3.0.9-orig/source/utils/net_rap.c (-1 / +1 lines)
198	if (!(cli = net_make_ipc_connection(0)))	198	if (!(cli = net_make_ipc_connection(0)))
199	return -1;	199	return -1;
200		200
201	sharename = strdup(argv[0]);	201	sharename = SMB_STRDUP(argv[0]);
202	p = strchr(sharename, '=');	202	p = strchr(sharename, '=');
203	*p = 0;	203	*p = 0;
204	strlcpy(sinfo.share_name, sharename, sizeof(sinfo.share_name));	204	strlcpy(sinfo.share_name, sharename, sizeof(sinfo.share_name));





	/* Look up rids */

	rids = TALLOC_ARRAY(mem_ctx, uint32, num_rids);

	for (i = 0; i < num_rids; i++)
                rids[i] = user_gids[i].g_rid;

	pstring mask;
	char *dst = NULL;

	dst = SMB_STRDUP(opt_destination?opt_destination:"127.0.0.1");

	init_enum_hnd(&hnd, 0);


static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
{
	if (server_aliases == NULL)
		server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);

	server_aliases[num_server_aliases] = *alias;
	num_server_aliases += 1;

			alias.members = NULL;

			if (alias.num_members > 0) {
				alias.members = SMB_MALLOC_ARRAY(DOM_SID, alias.num_members);
						       sizeof(DOM_SID));

				for (j = 0; j < alias.num_members; j++)
					sid_copy(&alias.members[j],


	token->num_sids = 4;

	token->user_sids = SMB_MALLOC_ARRAY(DOM_SID, 4);

	token->user_sids[0] = *user_sid;
	sid_copy(&token->user_sids[1], &global_sid_World);

	if (is_sid_in_token(token, sid))
		return;

	token->user_sids = SMB_REALLOC_ARRAY(token->user_sids, DOM_SID, token->num_sids+1);
				   (token->num_sids+1) * sizeof(DOM_SID));

	sid_copy(&token->user_sids[token->num_sids], sid);


		*num_tokens += 1;
	}

	result = SMB_MALLOC_ARRAY(struct user_token, *num_tokens);

	if (result == NULL) {
		DEBUG(1, ("Could not malloc sid array\n"));

		/* And a new user... */

		*num_tokens += 1;
		*tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
				  *num_tokens *
				  sizeof(struct user_token));
		if (*tokens == NULL) {
			DEBUG(0, ("Could not realloc tokens\n"));
			return False;

		return;

	share_list->num_shares += 1;
	share_list->shares = SMB_REALLOC_ARRAY(share_list->shares, char *, share_list->num_shares);
	share_list->shares[share_list->num_shares-1] = SMB_STRDUP(name);
	share_list->shares[share_list->num_shares-1] = strdup(name);
}

static void rpc_share_userlist_usage(void)

Lines 258-264 Link Here

(-)samba-3.0.9-orig/source/utils/net_rpc_join.c (-1 / +1 lines)
258	{	258	{
259	char *str;	259	char *str;
260	str = generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);	260	str = generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
261	clear_trust_password = strdup(str);	261	clear_trust_password = SMB_STRDUP(str);
262	E_md4hash(clear_trust_password, md4_trust_password);	262	E_md4hash(clear_trust_password, md4_trust_password);
263	}	263	}
264		264




		}

		/* allocate memory */
		if (!(data = (char *)SMB_MALLOC(read_size))) {
			d_printf("malloc fail for size %d\n", read_size);
			nt_status = NT_STATUS_NO_MEMORY;
			goto out;



	/* argument given, get a single printer by name */
	sharename = SMB_STRDUP(argv[0]);

	if (!net_spoolss_open_printer_ex(cli, mem_ctx, sharename,
			MAXIMUM_ALLOWED_ACCESS,	cli->user_name, &hnd)) 

		}

		/* copy devmode (info level 2) */
		ctr_dst.printers_2->devmode = TALLOC_MEMDUP(mem_ctx, 
			ctr_enum.printers_2[i].devmode, sizeof(DEVICEMODE));

		/* do not copy security descriptor (we have another command for that) */


					value.type = REG_SZ;
					value.size = data.uni_str_len * 2;
					value.data_p = TALLOC_MEMDUP(mem_ctx, data.buffer, value.size);

					if (opt_verbose) 
						display_reg_value(subkey, value);

Lines 595-601 Link Here

(-)samba-3.0.9-orig/source/utils/net_rpc_samsync.c (-1 / +1 lines)
595	return NT_STATUS_NO_MEMORY;	595	return NT_STATUS_NO_MEMORY;
596	}	596	}
597		597
598	nt_members = talloc_zero(t, sizeof(char ) delta->num_members);	598	nt_members = TALLOC_ZERO_ARRAY(t, char *, delta->num_members);
599		599
600	for (i=0; i<delta->num_members; i++) {	600	for (i=0; i<delta->num_members; i++) {
601	NTSTATUS nt_status;	601	NTSTATUS nt_status;

Lines 129-136 Link Here

(-)samba-3.0.9-orig/source/utils/net_status.c (-2 / +1 lines)
129	return 0;	129	return 0;
130		130
131	ids->num_entries += 1;	131	ids->num_entries += 1;
132	ids->entries = Realloc(ids->entries,	132	ids->entries = SMB_REALLOC_ARRAY(ids->entries, struct sessionid, ids->num_entries);
133	sizeof(struct sessionid) * ids->num_entries);
134	ids->entries[ids->num_entries-1] = sessionid;	133	ids->entries[ids->num_entries-1] = sessionid;
135		134
136	return 0;	135	return 0;




		return False;
	}

	require_membership_of_sid = SMB_STRDUP(response.data.sid.sid);

	if (require_membership_of_sid)
		return True;

	}

	if (flags & WBFLAG_PAM_UNIX_NAME) {
		*unix_name = SMB_STRDUP((char *)response.extra_data);
		if (!*unix_name) {
			free_response(&response);
			return NT_STATUS_NO_MEMORY;

	if ((strncmp(buf, "PW ", 3) == 0)) {
		/* The calling application wants us to use a local password (rather than winbindd) */

		opt_password = SMB_STRNDUP((const char *)request.data, request.length);

		if (opt_password == NULL) {
			DEBUG(1, ("Out of memory\n"));

	if (strncmp(buf, "PW ", 3) == 0) {
		/* We asked for a password and obviously got it :-) */

		opt_password = SMB_STRNDUP((const char *)request.data, request.length);

		if (opt_password == NULL) {
			DEBUG(1, ("Out of memory\n"));


	/* Server negTokenInit (mech offerings) */
	spnego.type = SPNEGO_NEG_TOKEN_INIT;
	spnego.negTokenInit.mechTypes = SMB_XMALLOC_ARRAY(char *, 3);
#ifdef HAVE_KRB5
	spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_KERBEROS5_OLD);
	spnego.negTokenInit.mechTypes[1] = smb_xstrdup(OID_NTLMSSP);

				  request.negTokenInit.mechToken.length);

			response.type = SPNEGO_NEG_TOKEN_TARG;
			response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
			response.negTokenTarg.mechListMIC = data_blob(NULL, 0);

			status = ntlmssp_update(ntlmssp_state,

			}

			response.type = SPNEGO_NEG_TOKEN_TARG;
			response.negTokenTarg.supportedMech = SMB_STRDUP(OID_KERBEROS5_OLD);
			response.negTokenTarg.mechListMIC = data_blob(NULL, 0);
			response.negTokenTarg.responseToken = data_blob(NULL, 0);


				}

				*domain++ = '\0';
				domain = SMB_STRDUP(domain);
				user = SMB_STRDUP(principal);

				data_blob_free(&ap_rep);
				data_blob_free(&auth_data);

					       &response.negTokenTarg.responseToken);

		response.type = SPNEGO_NEG_TOKEN_TARG;
		response.negTokenTarg.supportedMech = SMB_STRDUP(OID_NTLMSSP);
		response.negTokenTarg.mechListMIC = data_blob(NULL, 0);

		if (NT_STATUS_IS_OK(status)) {
			user = SMB_STRDUP(ntlmssp_state->user);
			domain = SMB_STRDUP(ntlmssp_state->domain);
			ntlmssp_end(&ntlmssp_state);
		}
	}

		return False;
	}

	principal = SMB_MALLOC(spnego.negTokenInit.mechListMIC.length+1);

	if (principal == NULL) {
		DEBUG(1, ("Could not malloc principal\n"));


		/* We asked for a password and obviously got it :-) */

		opt_password = SMB_STRNDUP((const char *)request.data, request.length);
		
		if (opt_password == NULL) {
			DEBUG(1, ("Out of memory\n"));

Lines 429-438 Link Here

(-)samba-3.0.9-orig/source/utils/pdbedit.c (-2 / +2 lines)
429	}	429	}
430		430
431	staticpass = getpass("new password:");	431	staticpass = getpass("new password:");
432	password1 = strdup(staticpass);	432	password1 = SMB_STRDUP(staticpass);
433	memset(staticpass, 0, strlen(staticpass));	433	memset(staticpass, 0, strlen(staticpass));
434	staticpass = getpass("retype new password:");	434	staticpass = getpass("retype new password:");
435	password2 = strdup(staticpass);	435	password2 = SMB_STRDUP(staticpass);
436	memset(staticpass, 0, strlen(staticpass));	436	memset(staticpass, 0, strlen(staticpass));
437	if (strcmp (password1, password2)) {	437	if (strcmp (password1, password2)) {
438	fprintf (stderr, "Passwords does not match!\n");	438	fprintf (stderr, "Passwords does not match!\n");




		return True;
	}

	aces = SMB_CALLOC_ARRAY(SEC_ACE, 1+(*the_acl)->num_aces);
	memcpy(aces, (*the_acl)->ace, (*the_acl)->num_aces * sizeof(SEC_ACE));
	memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
	new = make_sec_acl(ctx,(*the_acl)->revision,1+(*the_acl)->num_aces, aces);

		}

		if (strncmp(tok,"OWNER:", 6) == 0) {
			owner_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
			if (!owner_sid ||
			    !StringToSid(owner_sid, tok+6)) {
				printf("Failed to parse owner sid\n");

		}

		if (strncmp(tok,"GROUP:", 6) == 0) {
			grp_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
			if (!grp_sid ||
			    !StringToSid(grp_sid, tok+6)) {
				printf("Failed to parse group sid\n");

Lines 51-57 Link Here

(-)samba-3.0.9-orig/source/utils/smbtree.c (-1 / +1 lines)
51	struct name_list name_list = (struct name_list )state;	51	struct name_list name_list = (struct name_list )state;
52	struct name_list *new_name;	52	struct name_list *new_name;
53		53
54	new_name = (struct name_list *)malloc(sizeof(struct name_list));	54	new_name = SMB_MALLOC_P(struct name_list);
55		55
56	if (!new_name)	56	if (!new_name)
57	return;	57	return;




			char *ret2;
			if (len == 0) len = 1024;
			else len *= 2;
			ret2 = (char *)SMB_REALLOC(ret, len);
			if (!ret2) return ret;
			ret = ret2;
		}

			
			*p = 0;
			
			variables[num_variables].name = SMB_STRDUP(line);
			variables[num_variables].value = SMB_STRDUP(p+1);

			SAFE_FREE(line);
			

			
			*p = 0;
			
			variables[num_variables].name = SMB_STRDUP(tok);
			variables[num_variables].value = SMB_STRDUP(p+1);

			if (!variables[num_variables].name || 
			    !variables[num_variables].value)

			       variables[i].name, -1, 
			       dest, sizeof(dest), True);
		free(variables[i].name);
		variables[i].name = SMB_STRDUP(dest);

		convert_string(CH_UTF8, CH_UNIX, 
			       variables[i].value, -1,
			       dest, sizeof(dest), True);
		free(variables[i].value);
		variables[i].value = SMB_STRDUP(dest);
	}
}


			become_user_permanently(pass->pw_uid, pass->pw_gid);
			
			/* Save the users name */
			C_user = SMB_STRDUP(user);
			passwd_free(&pass);
			return True;
		}

		if (line[0] == '\r' || line[0] == '\n') break;
		if (strnequal(line,"GET ", 4)) {
			got_request = True;
			url = SMB_STRDUP(&line[4]);
		} else if (strnequal(line,"POST ", 5)) {
			got_request = True;
			request_post = 1;
			url = SMB_STRDUP(&line[5]);
		} else if (strnequal(line,"PUT ", 4)) {
			got_request = True;
			cgi_setup_error("400 Bad Request", "",

Lines 85-91 Link Here

(-)samba-3.0.9-orig/source/web/neg_lang.c (-2 / +2 lines)
85	count++;	85	count++;
86	lang_num++;	86	lang_num++;
87	}	87	}
88	pl = (struct pri_list )malloc(sizeof(struct pri_list) lang_num);	88	pl = SMB_MALLOC_ARRAY(struct pri_list, lang_num);
89	for (i = 0; i < lang_num; i++) {	89	for (i = 0; i < lang_num; i++) {
90	char *pri_code;	90	char *pri_code;
91	if ((pri_code=strstr(lang_list[i], ";q="))) {	91	if ((pri_code=strstr(lang_list[i], ";q="))) {
Lines 95-101 Link Here
95	} else {	95	} else {
96	pl[i].pri = 1;	96	pl[i].pri = 1;
97	}	97	}
98	pl[i].string = strdup(lang_list[i]);	98	pl[i].string = SMB_STRDUP(lang_list[i]);
99	}	99	}
100	str_list_free(&lang_list);	100	str_list_free(&lang_list);
101		101




	if (PID_or_Machine) {
		PIDMAP *newmap;

		if ((newmap = SMB_MALLOC_P(PIDMAP)) == NULL) {
			/* XXX need error message for this?
			   if malloc fails, PID is always shown */
			return;
		}

		newmap->pid = pid;
		newmap->machine = SMB_STRDUP(machine);

		DLIST_ADD(pidmap, newmap);
	}
----BEGIN PGP SIGNATURE-----
----END PGP SIGNATURE-----

Return to bug 64119

Lines 132-138 Link Here

(-)samba-3.0.9-orig/source/auth/auth_util.c (-16 / +16 lines)
132		132
133	DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));	133	DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
134		134
135	user_info = malloc(sizeof(*user_info));	135	*user_info = SMB_MALLOC_P(auth_usersupplied_info);
136	if (!user_info) {	136	if (!user_info) {
137	DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info)));	137	DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info)));
138	return NT_STATUS_NO_MEMORY;	138	return NT_STATUS_NO_MEMORY;
Lines 142-148 Link Here
142		142
143	DEBUG(5,("making strings for %s's user_info struct\n", internal_username));	143	DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
144		144
145	(*user_info)->smb_name.str = strdup(smb_name);	145	(*user_info)->smb_name.str = SMB_STRDUP(smb_name);
146	if ((*user_info)->smb_name.str) {	146	if ((*user_info)->smb_name.str) {
147	(*user_info)->smb_name.len = strlen(smb_name);	147	(*user_info)->smb_name.len = strlen(smb_name);
148	} else {	148	} else {
Lines 150-156 Link Here
150	return NT_STATUS_NO_MEMORY;	150	return NT_STATUS_NO_MEMORY;
151	}	151	}
152		152
153	(*user_info)->internal_username.str = strdup(internal_username);	153	(*user_info)->internal_username.str = SMB_STRDUP(internal_username);
154	if ((*user_info)->internal_username.str) {	154	if ((*user_info)->internal_username.str) {
155	(*user_info)->internal_username.len = strlen(internal_username);	155	(*user_info)->internal_username.len = strlen(internal_username);
156	} else {	156	} else {
Lines 158-164 Link Here
158	return NT_STATUS_NO_MEMORY;	158	return NT_STATUS_NO_MEMORY;
159	}	159	}
160		160
161	(*user_info)->domain.str = strdup(domain);	161	(*user_info)->domain.str = SMB_STRDUP(domain);
162	if ((*user_info)->domain.str) {	162	if ((*user_info)->domain.str) {
163	(*user_info)->domain.len = strlen(domain);	163	(*user_info)->domain.len = strlen(domain);
164	} else {	164	} else {
Lines 166-172 Link Here
166	return NT_STATUS_NO_MEMORY;	166	return NT_STATUS_NO_MEMORY;
167	}	167	}
168		168
169	(*user_info)->client_domain.str = strdup(client_domain);	169	(*user_info)->client_domain.str = SMB_STRDUP(client_domain);
170	if ((*user_info)->client_domain.str) {	170	if ((*user_info)->client_domain.str) {
171	(*user_info)->client_domain.len = strlen(client_domain);	171	(*user_info)->client_domain.len = strlen(client_domain);
172	} else {	172	} else {
Lines 174-180 Link Here
174	return NT_STATUS_NO_MEMORY;	174	return NT_STATUS_NO_MEMORY;
175	}	175	}
176		176
177	(*user_info)->wksta_name.str = strdup(wksta_name);	177	(*user_info)->wksta_name.str = SMB_STRDUP(wksta_name);
178	if ((*user_info)->wksta_name.str) {	178	if ((*user_info)->wksta_name.str) {
179	(*user_info)->wksta_name.len = strlen(wksta_name);	179	(*user_info)->wksta_name.len = strlen(wksta_name);
180	} else {	180	} else {
Lines 523-529 Link Here
523	int i;	523	int i;
524	int sid_ndx;	524	int sid_ndx;
525		525
526	if ((ptoken = malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {	526	if ((ptoken = SMB_MALLOC_P(NT_USER_TOKEN)) == NULL) {
527	DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));	527	DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
528	nt_status = NT_STATUS_NO_MEMORY;	528	nt_status = NT_STATUS_NO_MEMORY;
529	return nt_status;	529	return nt_status;
Lines 533-539 Link Here
533		533
534	ptoken->num_sids = n_groupSIDs + 5;	534	ptoken->num_sids = n_groupSIDs + 5;
535		535
536	if ((ptoken->user_sids = (DOM_SID )malloc( sizeof(DOM_SID) ptoken->num_sids )) == NULL) {	536	if ((ptoken->user_sids = SMB_MALLOC_ARRAY( DOM_SID, ptoken->num_sids )) == NULL) {
537	DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));	537	DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
538	nt_status = NT_STATUS_NO_MEMORY;	538	nt_status = NT_STATUS_NO_MEMORY;
539	return nt_status;	539	return nt_status;
Lines 610-616 Link Here
610	return NULL;	610	return NULL;
611	}	611	}
612		612
613	group_sids = malloc(sizeof(DOM_SID) * ngroups);	613	group_sids = SMB_MALLOC_ARRAY(DOM_SID, ngroups);
614	if (!group_sids) {	614	if (!group_sids) {
615	DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));	615	DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
616	return NULL;	616	return NULL;
Lines 674-680 Link Here
674		674
675	n_unix_groups = groups_max();	675	n_unix_groups = groups_max();
676		676
677	if ((unix_groups = malloc( sizeof(gid_t) n_unix_groups ) ) == NULL) {	677	if ((*unix_groups = SMB_MALLOC_ARRAY( gid_t, n_unix_groups ) ) == NULL) {
678	DEBUG(0, ("get_user_groups: Out of memory allocating unix group list\n"));	678	DEBUG(0, ("get_user_groups: Out of memory allocating unix group list\n"));
679	return NT_STATUS_NO_MEMORY;	679	return NT_STATUS_NO_MEMORY;
680	}	680	}
Lines 683-689 Link Here
683		683
684	gid_t *groups_tmp;	684	gid_t *groups_tmp;
685		685
686	groups_tmp = Realloc(unix_groups, sizeof(gid_t) n_unix_groups);	686	groups_tmp = SMB_REALLOC_ARRAY(*unix_groups, gid_t, n_unix_groups);
687		687
688	if (!groups_tmp) {	688	if (!groups_tmp) {
689	SAFE_FREE(*unix_groups);	689	SAFE_FREE(*unix_groups);
Lines 705-711 Link Here
705		705
706	if (n_unix_groups > 0) {	706	if (n_unix_groups > 0) {
707		707
708	groups = malloc(sizeof(DOM_SID) n_unix_groups);	708	*groups = SMB_MALLOC_ARRAY(DOM_SID, n_unix_groups);
709		709
710	if (!*groups) {	710	if (!*groups) {
711	DEBUG(0, ("get_user_group: malloc() failed for DOM_SID list!\n"));	711	DEBUG(0, ("get_user_group: malloc() failed for DOM_SID list!\n"));
Lines 735-741 Link Here
735		735
736	static NTSTATUS make_server_info(auth_serversupplied_info **server_info)	736	static NTSTATUS make_server_info(auth_serversupplied_info **server_info)
737	{	737	{
738	server_info = malloc(sizeof(*server_info));	738	*server_info = SMB_MALLOC_P(auth_serversupplied_info);
739	if (!*server_info) {	739	if (!*server_info) {
740	DEBUG(0,("make_server_info: malloc failed!\n"));	740	DEBUG(0,("make_server_info: malloc failed!\n"));
741	return NT_STATUS_NO_MEMORY;	741	return NT_STATUS_NO_MEMORY;
Lines 1221-1227 Link Here
1221		1221
1222	/* Create a 'combined' list of all SIDs we might want in the SD */	1222	/* Create a 'combined' list of all SIDs we might want in the SD */
1223		1223
1224	all_group_SIDs = malloc(sizeof(DOM_SID) * (info3->num_groups2 + info3->num_other_sids + n_lgroupSIDs));	1224	all_group_SIDs = SMB_MALLOC_ARRAY(DOM_SID,info3->num_groups2 + info3->num_other_sids + n_lgroupSIDs);
1225		1225
1226	if (!all_group_SIDs) {	1226	if (!all_group_SIDs) {
1227	DEBUG(0, ("malloc() failed for DOM_SID list!\n"));	1227	DEBUG(0, ("malloc() failed for DOM_SID list!\n"));
Lines 1370-1376 Link Here
1370	smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");	1370	smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
1371	}	1371	}
1372		1372
1373	auth_method = talloc(auth_context->mem_ctx, sizeof(*auth_method));	1373	*auth_method = TALLOC_P(auth_context->mem_ctx, auth_methods);
1374	if (!*auth_method) {	1374	if (!*auth_method) {
1375	DEBUG(0,("make_auth_method: malloc failed!\n"));	1375	DEBUG(0,("make_auth_method: malloc failed!\n"));
1376	return False;	1376	return False;
Lines 1405-1411 Link Here
1405	if (!ptoken)	1405	if (!ptoken)
1406	return NULL;	1406	return NULL;
1407		1407
1408	if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)	1408	if ((token = SMB_MALLOC_P(NT_USER_TOKEN)) == NULL)
1409	return NULL;	1409	return NULL;
1410		1410
1411	ZERO_STRUCTP(token);	1411	ZERO_STRUCTP(token);

Lines 387-393 Link Here

(-)samba-3.0.9-orig/source/client/client.c (-14 / +14 lines)
387	{	387	{
388	reset_do_list_queue();	388	reset_do_list_queue();
389	do_list_queue_size = 1024;	389	do_list_queue_size = 1024;
390	do_list_queue = malloc(do_list_queue_size);	390	do_list_queue = SMB_MALLOC(do_list_queue_size);
391	if (do_list_queue == 0) {	391	if (do_list_queue == 0) {
392	d_printf("malloc fail for size %d\n",	392	d_printf("malloc fail for size %d\n",
393	(int)do_list_queue_size);	393	(int)do_list_queue_size);
Lines 425-431 Link Here
425	do_list_queue_size *= 2;	425	do_list_queue_size *= 2;
426	DEBUG(4,("enlarging do_list_queue to %d\n",	426	DEBUG(4,("enlarging do_list_queue to %d\n",
427	(int)do_list_queue_size));	427	(int)do_list_queue_size));
428	dlq = Realloc(do_list_queue, do_list_queue_size);	428	dlq = SMB_REALLOC(do_list_queue, do_list_queue_size);
429	if (! dlq) {	429	if (! dlq) {
430	d_printf("failure enlarging do_list_queue to %d bytes\n",	430	d_printf("failure enlarging do_list_queue to %d bytes\n",
431	(int)do_list_queue_size);	431	(int)do_list_queue_size);
Lines 704-710 Link Here
704	DEBUG(1,("getting file %s of size %.0f as %s ",	704	DEBUG(1,("getting file %s of size %.0f as %s ",
705	rname, (double)size, lname));	705	rname, (double)size, lname));
706		706
707	if(!(data = (char *)malloc(read_size))) {	707	if(!(data = (char *)SMB_MALLOC(read_size))) {
708	d_printf("malloc fail for size %d\n", read_size);	708	d_printf("malloc fail for size %d\n", read_size);
709	cli_close(cli, fnum);	709	cli_close(cli, fnum);
710	return 1;	710	return 1;
Lines 1112-1118 Link Here
1112	DEBUG(1,("putting file %s as %s ",lname,	1112	DEBUG(1,("putting file %s as %s ",lname,
1113	rname));	1113	rname));
1114		1114
1115	buf = (char *)malloc(maxwrite);	1115	buf = (char *)SMB_MALLOC(maxwrite);
1116	if (!buf) {	1116	if (!buf) {
1117	d_printf("ERROR: Not enough memory!\n");	1117	d_printf("ERROR: Not enough memory!\n");
1118	return 1;	1118	return 1;
Lines 1325-1331 Link Here
1325	return -1;	1325	return -1;
1326	}	1326	}
1327	}	1327	}
1328	entry = (struct file_list *) malloc(sizeof (struct file_list));	1328	entry = SMB_MALLOC_P(struct file_list);
1329	if (!entry) {	1329	if (!entry) {
1330	d_printf("Out of memory in file_find\n");	1330	d_printf("Out of memory in file_find\n");
1331	closedir(dir);	1331	closedir(dir);
Lines 2521-2527 Link Here
2521		2521
2522	if ((info->count < MAX_COMPLETIONS - 1) && (strncmp(info->text, f->name, info->len) == 0) && (strcmp(f->name, ".") != 0) && (strcmp(f->name, "..") != 0)) {	2522	if ((info->count < MAX_COMPLETIONS - 1) && (strncmp(info->text, f->name, info->len) == 0) && (strcmp(f->name, ".") != 0) && (strcmp(f->name, "..") != 0)) {
2523	if ((info->dirmask[0] == 0) && !(f->mode & aDIR))	2523	if ((info->dirmask[0] == 0) && !(f->mode & aDIR))
2524	info->matches[info->count] = strdup(f->name);	2524	info->matches[info->count] = SMB_STRDUP(f->name);
2525	else {	2525	else {
2526	pstring tmp;	2526	pstring tmp;
2527		2527
Lines 2532-2538 Link Here
2532	pstrcat(tmp, f->name);	2532	pstrcat(tmp, f->name);
2533	if (f->mode & aDIR)	2533	if (f->mode & aDIR)
2534	pstrcat(tmp, "/");	2534	pstrcat(tmp, "/");
2535	info->matches[info->count] = strdup(tmp);	2535	info->matches[info->count] = SMB_STRDUP(tmp);
2536	}	2536	}
2537	if (info->matches[info->count] == NULL)	2537	if (info->matches[info->count] == NULL)
2538	return;	2538	return;
Lines 2563-2569 Link Here
2563	if (len >= PATH_MAX)	2563	if (len >= PATH_MAX)
2564	return(NULL);	2564	return(NULL);
2565		2565
2566	info.matches = (char *)malloc(sizeof(info.matches[0])MAX_COMPLETIONS);	2566	info.matches = SMB_MALLOC_ARRAY(char *,MAX_COMPLETIONS);
2567	if (!info.matches) return NULL;	2567	if (!info.matches) return NULL;
2568	info.matches[0] = NULL;	2568	info.matches[0] = NULL;
2569		2569
Lines 2584-2592 Link Here
2584	goto cleanup;	2584	goto cleanup;
2585		2585
2586	if (info.count == 2)	2586	if (info.count == 2)
2587	info.matches[0] = strdup(info.matches[1]);	2587	info.matches[0] = SMB_STRDUP(info.matches[1]);
2588	else {	2588	else {
2589	info.matches[0] = malloc(info.samelen+1);	2589	info.matches[0] = SMB_MALLOC(info.samelen+1);
2590	if (!info.matches[0])	2590	if (!info.matches[0])
2591	goto cleanup;	2591	goto cleanup;
2592	strncpy(info.matches[0], info.matches[1], info.samelen);	2592	strncpy(info.matches[0], info.matches[1], info.samelen);
Lines 2641-2654 Link Here
2641	char **matches;	2641	char **matches;
2642	int i, len, samelen, count=1;	2642	int i, len, samelen, count=1;
2643		2643
2644	matches = (char *)malloc(sizeof(matches[0])MAX_COMPLETIONS);	2644	matches = SMB_MALLOC_ARRAY(char *, MAX_COMPLETIONS);
2645	if (!matches) return NULL;	2645	if (!matches) return NULL;
2646	matches[0] = NULL;	2646	matches[0] = NULL;
2647		2647
2648	len = strlen(text);	2648	len = strlen(text);
2649	for (i=0;commands[i].fn && count < MAX_COMPLETIONS-1;i++) {	2649	for (i=0;commands[i].fn && count < MAX_COMPLETIONS-1;i++) {
2650	if (strncmp(text, commands[i].name, len) == 0) {	2650	if (strncmp(text, commands[i].name, len) == 0) {
2651	matches[count] = strdup(commands[i].name);	2651	matches[count] = SMB_STRDUP(commands[i].name);
2652	if (!matches[count])	2652	if (!matches[count])
2653	goto cleanup;	2653	goto cleanup;
2654	if (count == 1)	2654	if (count == 1)
Lines 2665-2674 Link Here
2665	case 1:	2665	case 1:
2666	goto cleanup;	2666	goto cleanup;
2667	case 2:	2667	case 2:
2668	matches[0] = strdup(matches[1]);	2668	matches[0] = SMB_STRDUP(matches[1]);
2669	break;	2669	break;
2670	default:	2670	default:
2671	matches[0] = malloc(samelen+1);	2671	matches[0] = SMB_MALLOC(samelen+1);
2672	if (!matches[0])	2672	if (!matches[0])
2673	goto cleanup;	2673	goto cleanup;
2674	strncpy(matches[0], matches[1], samelen);	2674	strncpy(matches[0], matches[1], samelen);

Lines 146-152 Link Here

(-)samba-3.0.9-orig/source/client/clitar.c (-11 / +11 lines)
146	{	146	{
147	char *tmp;	147	char *tmp;
148		148
149	tmp = (char *)malloc(size+1);	149	tmp = (char *)SMB_MALLOC(size+1);
150		150
151	if (tmp == NULL) {	151	if (tmp == NULL) {
152	DEBUG(0, ("Out of memory in string_create_s\n"));	152	DEBUG(0, ("Out of memory in string_create_s\n"));
Lines 177-183 Link Here
177	if (l+2 >= NAMSIZ) {	177	if (l+2 >= NAMSIZ) {
178	/* write a GNU tar style long header */	178	/* write a GNU tar style long header */
179	char *b;	179	char *b;
180	b = (char *)malloc(l+TBLOCK+100);	180	b = (char *)SMB_MALLOC(l+TBLOCK+100);
181	if (!b) {	181	if (!b) {
182	DEBUG(0,("out of memory\n"));	182	DEBUG(0,("out of memory\n"));
183	exit(1);	183	exit(1);
Lines 385-391 Link Here
385	{	385	{
386	/* initialize tar buffer */	386	/* initialize tar buffer */
387	tbufsiz=blocksize*TBLOCK;	387	tbufsiz=blocksize*TBLOCK;
388	tarbuf=malloc(tbufsiz); /* FIXME: We might not get the buffer */	388	tarbuf=SMB_MALLOC(tbufsiz); /* FIXME: We might not get the buffer */
389		389
390	/* reset tar buffer pointer and tar file counter and total dumped */	390	/* reset tar buffer pointer and tar file counter and total dumped */
391	tp=0; ntarf=0; ttarf=0;	391	tp=0; ntarf=0; ttarf=0;
Lines 1059-1065 Link Here
1059	/* finfo.size here is the length of the filename as written by the "/./@LongLink" name	1059	/* finfo.size here is the length of the filename as written by the "/./@LongLink" name
1060	* header call. */	1060	* header call. */
1061	int namesize = finfo.size + strlen(cur_dir) + 2;	1061	int namesize = finfo.size + strlen(cur_dir) + 2;
1062	char *longname = malloc(namesize);	1062	char *longname = SMB_MALLOC(namesize);
1063	int offset = 0, left = finfo.size;	1063	int offset = 0, left = finfo.size;
1064	BOOL first = True;	1064	BOOL first = True;
1065		1065
Lines 1506-1512 Link Here
1506	while ((! error) && (x_fgets(buf, sizeof(buf)-1, inclusion))) {	1506	while ((! error) && (x_fgets(buf, sizeof(buf)-1, inclusion))) {
1507	if (inclusion_buffer == NULL) {	1507	if (inclusion_buffer == NULL) {
1508	inclusion_buffer_size = 1024;	1508	inclusion_buffer_size = 1024;
1509	if ((inclusion_buffer = malloc(inclusion_buffer_size)) == NULL) {	1509	if ((inclusion_buffer = SMB_MALLOC(inclusion_buffer_size)) == NULL) {
1510	DEBUG(0,("failure allocating buffer to read inclusion file\n"));	1510	DEBUG(0,("failure allocating buffer to read inclusion file\n"));
1511	error = 1;	1511	error = 1;
1512	break;	1512	break;
Lines 1520-1526 Link Here
1520	if ((strlen(buf) + 1 + inclusion_buffer_sofar) >= inclusion_buffer_size) {	1520	if ((strlen(buf) + 1 + inclusion_buffer_sofar) >= inclusion_buffer_size) {
1521	char *ib;	1521	char *ib;
1522	inclusion_buffer_size *= 2;	1522	inclusion_buffer_size *= 2;
1523	ib = Realloc(inclusion_buffer,inclusion_buffer_size);	1523	ib = SMB_REALLOC(inclusion_buffer,inclusion_buffer_size);
1524	if (! ib) {	1524	if (! ib) {
1525	DEBUG(0,("failure enlarging inclusion buffer to %d bytes\n",	1525	DEBUG(0,("failure enlarging inclusion buffer to %d bytes\n",
1526	inclusion_buffer_size));	1526	inclusion_buffer_size));
Lines 1539-1545 Link Here
1539		1539
1540	if (! error) {	1540	if (! error) {
1541	/* Allocate an array of clipn + 1 char's for cliplist /	1541	/* Allocate an array of clipn + 1 char's for cliplist /
1542	cliplist = malloc((clipn + 1) * sizeof(char *));	1542	cliplist = SMB_MALLOC_ARRAY(char *, clipn + 1);
1543	if (cliplist == NULL) {	1543	if (cliplist == NULL) {
1544	DEBUG(0,("failure allocating memory for cliplist\n"));	1544	DEBUG(0,("failure allocating memory for cliplist\n"));
1545	error = 1;	1545	error = 1;
Lines 1550-1556 Link Here
1550	/* set current item to NULL so array will be null-terminated even if	1550	/* set current item to NULL so array will be null-terminated even if
1551	* malloc fails below. */	1551	* malloc fails below. */
1552	cliplist[i] = NULL;	1552	cliplist[i] = NULL;
1553	if ((tmpstr = (char *)malloc(strlen(p)+1)) == NULL) {	1553	if ((tmpstr = (char *)SMB_MALLOC(strlen(p)+1)) == NULL) {
1554	DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", i));	1554	DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", i));
1555	error = 1;	1555	error = 1;
1556	} else {	1556	} else {
Lines 1720-1726 Link Here
1720	clipn=argc-Optind-1;	1720	clipn=argc-Optind-1;
1721	clipcount = clipn;	1721	clipcount = clipn;
1722		1722
1723	if ((tmplist=malloc(clipnsizeof(char ))) == NULL) {	1723	if ((tmplist=SMB_MALLOC_ARRAY(char *,clipn)) == NULL) {
1724	DEBUG(0, ("Could not allocate space to process cliplist, count = %i\n", clipn));	1724	DEBUG(0, ("Could not allocate space to process cliplist, count = %i\n", clipn));
1725	return 0;	1725	return 0;
1726	}	1726	}
Lines 1729-1735 Link Here
1729		1729
1730	DEBUG(5, ("Processing an item, %s\n", cliplist[clipcount]));	1730	DEBUG(5, ("Processing an item, %s\n", cliplist[clipcount]));
1731		1731
1732	if ((tmpstr = (char *)malloc(strlen(cliplist[clipcount])+1)) == NULL) {	1732	if ((tmpstr = (char *)SMB_MALLOC(strlen(cliplist[clipcount])+1)) == NULL) {
1733	DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", clipcount));	1733	DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", clipcount));
1734	return 0;	1734	return 0;
1735	}	1735	}
Lines 1751-1757 Link Here
1751	#ifdef HAVE_REGEX_H	1751	#ifdef HAVE_REGEX_H
1752	int errcode;	1752	int errcode;
1753		1753
1754	if ((preg = (regex_t *)malloc(65536)) == NULL) {	1754	if ((preg = (regex_t *)SMB_MALLOC(65536)) == NULL) {
1755		1755
1756	DEBUG(0, ("Could not allocate buffer for regular expression search\n"));	1756	DEBUG(0, ("Could not allocate buffer for regular expression search\n"));
1757	return;	1757	return;

Lines 469-475 Link Here

(-)samba-3.0.9-orig/source/groupdb/mapping.c (-4 / +4 lines)
469	decode_sid_name_use(group_type, map.sid_name_use);	469	decode_sid_name_use(group_type, map.sid_name_use);
470	DEBUG(11,("enum_group_mapping: returning group %s of type %s\n", map.nt_name ,group_type));	470	DEBUG(11,("enum_group_mapping: returning group %s of type %s\n", map.nt_name ,group_type));
471		471
472	mapt=(GROUP_MAP )Realloc((rmap), (entries+1)*sizeof(GROUP_MAP));	472	mapt= SMB_REALLOC_ARRAY((*rmap), GROUP_MAP, entries+1);
473	if (!mapt) {	473	if (!mapt) {
474	DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));	474	DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
475	SAFE_FREE(*rmap);	475	SAFE_FREE(*rmap);
Lines 599-605 Link Here
599	asprintf(&new_memberstring, "%s %s", (char *)(dbuf.dptr),	599	asprintf(&new_memberstring, "%s %s", (char *)(dbuf.dptr),
600	string_sid);	600	string_sid);
601	} else {	601	} else {
602	new_memberstring = strdup(string_sid);	602	new_memberstring = SMB_STRDUP(string_sid);
603	}	603	}
604		604
605	if (new_memberstring == NULL)	605	if (new_memberstring == NULL)
Lines 739-745 Link Here
739	return tdb_delete(tdb, kbuf) == 0 ?	739	return tdb_delete(tdb, kbuf) == 0 ?
740	NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;	740	NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
741		741
742	member_string = strdup("");	742	member_string = SMB_STRDUP("");
743		743
744	if (member_string == NULL) {	744	if (member_string == NULL) {
745	SAFE_FREE(sids);	745	SAFE_FREE(sids);
Lines 1278-1284 Link Here
1278	if (*num_aliases > max_entries)	1278	if (*num_aliases > max_entries)
1279	*num_aliases = max_entries;	1279	*num_aliases = max_entries;
1280		1280
1281	info = malloc(sizeof(struct acct_info) (*num_aliases));	1281	info = SMB_MALLOC_ARRAY(struct acct_info, num_aliases);
1282		1282
1283	for (i=0; i<*num_aliases; i++) {	1283	for (i=0; i<*num_aliases; i++) {
1284	fstrcpy((*info)[i].acct_name, map[i+start_idx].nt_name);	1284	fstrcpy((*info)[i].acct_name, map[i+start_idx].nt_name);

Lines 53-61 Link Here

(-)samba-3.0.9-orig/source/include/smb.h (-4 / +1 lines)
53	#define _BOOL /* So we don't typedef BOOL again in vfs.h */	53	#define _BOOL /* So we don't typedef BOOL again in vfs.h */
54	#endif	54	#endif
55		55
56	/* limiting size of ipc replies */
57	#define REALLOC(ptr,size) Realloc(ptr,MAX((size),4*1024))
58
59	#define SIZEOFWORD 2	56	#define SIZEOFWORD 2
60		57
61	#ifndef DEF_CREATE_MASK	58	#ifndef DEF_CREATE_MASK
Lines 1656-1662 Link Here
1656	#define SAFE_NETBIOS_CHARS ". -_"	1653	#define SAFE_NETBIOS_CHARS ". -_"
1657		1654
1658	/* generic iconv conversion structure */	1655	/* generic iconv conversion structure */
1659	typedef struct {	1656	typedef struct _smb_iconv_t {
1660	size_t (direct)(void cd, const char *inbuf, size_t inbytesleft,	1657	size_t (direct)(void cd, const char *inbuf, size_t inbytesleft,
1661	char *outbuf, size_t outbytesleft);	1658	char *outbuf, size_t outbytesleft);
1662	size_t (pull)(void cd, const char *inbuf, size_t inbytesleft,	1659	size_t (pull)(void cd, const char *inbuf, size_t inbytesleft,

Lines 261-264 Link Here

(-)samba-3.0.9-orig/source/include/smb_macros.h (+88 lines)
261		261
262	#define IS_DC (lp_server_role()==ROLE_DOMAIN_PDC \|\| lp_server_role()==ROLE_DOMAIN_BDC)	262	#define IS_DC (lp_server_role()==ROLE_DOMAIN_PDC \|\| lp_server_role()==ROLE_DOMAIN_BDC)
263		263
		264	/*****************************************************************************
		265	Safe allocation macros.
		266	*****************************************************************************/
		267
		268	#define SMB_MALLOC_ARRAY(type,count) (type *)malloc_array(sizeof(type),(count))
		269	#define SMB_REALLOC(p,s) Realloc((p),(s))
		270	#define SMB_REALLOC_ARRAY(p,type,count) (type *)realloc_array((p),sizeof(type),(count))
		271	#define SMB_CALLOC_ARRAY(type,count) (type *)calloc_array(sizeof(type),(count))
		272	#define SMB_XMALLOC_P(type) (type *)smb_xmalloc_array(sizeof(type),1)
		273	#define SMB_XMALLOC_ARRAY(type,count) (type *)smb_xmalloc_array(sizeof(type),(count))
		274
		275	/* limiting size of ipc replies */
		276	#define SMB_REALLOC_LIMIT(ptr,size) SMB_REALLOC(ptr,MAX((size),4*1024))
		277
		278	/* #define PARANOID_MALLOC_CHECKER 1 */
		279
		280	#if defined(PARANOID_MALLOC_CHECKER)
		281
		282	#define TALLOC(ctx, size) talloc_((ctx),(size))
		283	#define TALLOC_P(ctx, type) (type *)talloc_((ctx),sizeof(type))
		284	#define TALLOC_ARRAY(ctx, type, count) (type *)talloc_array_((ctx),sizeof(type),(count))
		285	#define TALLOC_MEMDUP(ctx, ptr, size) talloc_memdup_((ctx),(ptr),(size))
		286	#define TALLOC_ZERO(ctx, size) talloc_zero_((ctx),(size))
		287	#define TALLOC_ZERO_P(ctx, type) (type *)talloc_zero_((ctx),sizeof(type))
		288	#define TALLOC_ZERO_ARRAY(ctx, type, count) (type *)talloc_zero_array_((ctx),sizeof(type),(count))
		289	#define TALLOC_REALLOC(ctx, ptr, count) talloc_realloc_((ctx),(ptr),(count))
		290	#define TALLOC_REALLOC_ARRAY(ctx, ptr, type, count) (type *)talloc_realloc_array_((ctx),(ptr),sizeof(type),(count))
		291
		292	#define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem_((ps),sizeof(type),(count))
		293
		294	/* Get medieval on our ass about malloc.... */
		295
		296	/* Restrictions on malloc/realloc/calloc. */
		297	#ifdef malloc
		298	#undef malloc
		299	#endif
		300	#define malloc(s) __ERROR_DONT_USE_MALLOC_DIRECTLY
		301
		302	#ifdef realloc
		303	#undef realloc
		304	#endif
		305	#define realloc(p,s) __ERROR_DONT_USE_REALLOC_DIRECTLY
		306
		307	#ifdef calloc
		308	#undef calloc
		309	#endif
		310	#define calloc(n,s) __ERROR_DONT_USE_CALLOC_DIRECTLY
		311
		312	#ifdef strndup
		313	#undef strndup
		314	#endif
		315	#define strndup(s,n) __ERROR_DONT_USE_STRNDUP_DIRECTLY
		316
		317	#ifdef strdup
		318	#undef strdup
		319	#endif
		320	#define strdup(s) __ERROR_DONT_USE_STRDUP_DIRECTLY
		321
		322	#define SMB_MALLOC(s) malloc_(s)
		323	#define SMB_MALLOC_P(type) (type *)malloc_(sizeof(type))
		324
		325	#define SMB_STRDUP(s) smb_xstrdup(s)
		326	#define SMB_STRNDUP(s,n) smb_xstrndup(s,n)
		327
328	#else
329
330	#define TALLOC(ctx, size) talloc((ctx),(size))
331	#define TALLOC_P(ctx, type) (type *)talloc((ctx),sizeof(type))
332	#define TALLOC_ARRAY(ctx, type, count) (type *)talloc_array((ctx),sizeof(type),(count))
333	#define TALLOC_MEMDUP(ctx, ptr, size) talloc_memdup((ctx),(ptr),(size))
334	#define TALLOC_ZERO(ctx, size) talloc_zero((ctx),(size))
335	#define TALLOC_ZERO_P(ctx, type) (type *)talloc_zero((ctx),sizeof(type))
336	#define TALLOC_ZERO_ARRAY(ctx, type, count) (type *)talloc_zero_array((ctx),sizeof(type),(count))
337	#define TALLOC_REALLOC(ctx, ptr, count) talloc_realloc((ctx),(ptr),(count))
338	#define TALLOC_REALLOC_ARRAY(ctx, ptr, type, count) (type *)talloc_realloc_array((ctx),(ptr),sizeof(type),(count))
339
340	#define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem((ps),sizeof(type),(count))
341
342	/* Regular malloc code. */
343
344	#define SMB_MALLOC(s) malloc(s)
345	#define SMB_MALLOC_P(type) (type *)malloc(sizeof(type))
346
347	#define SMB_STRDUP(s) strdup(s)
348	#define SMB_STRNDUP(s,n) strndup(s,n)
349
350	#endif
351
264	#endif /* _SMB_MACROS_H */	352	#endif /* _SMB_MACROS_H */

Lines 148-154 Link Here

(-)samba-3.0.9-orig/source/intl/lang_tdb.c (-4 / +4 lines)
148	strerror(errno)));	148	strerror(errno)));
149	goto done;	149	goto done;
150	}	150	}
151	current_lang = strdup(lang);	151	current_lang = SMB_STRDUP(lang);
152	result = True;	152	result = True;
153	goto done;	153	goto done;
154	}	154	}
Lines 160-166 Link Here
160	tdb_store_int32(tdb, "/LOADTIME/", (int)time(NULL));	160	tdb_store_int32(tdb, "/LOADTIME/", (int)time(NULL));
161	}	161	}
162		162
163	current_lang = strdup(lang);	163	current_lang = SMB_STRDUP(lang);
164	result = True;	164	result = True;
165		165
166	done:	166	done:
Lines 194-200 Link Here
194	count++;	194	count++;
195	}	195	}
196		196
197	if (!(msgid_quoted = malloc(strlen(msgid) + count + 1)))	197	if (!(msgid_quoted = SMB_MALLOC(strlen(msgid) + count + 1)))
198	return msgid;	198	return msgid;
199		199
200	/* string_sub() is unsuitable here as it replaces some punctuation	200	/* string_sub() is unsuitable here as it replaces some punctuation
Lines 221-227 Link Here
221	/* if the message isn't found then we still need to return a pointer	221	/* if the message isn't found then we still need to return a pointer
222	that can be freed. Pity. */	222	that can be freed. Pity. */
223	if (!data.dptr)	223	if (!data.dptr)
224	return strdup(msgid);	224	return SMB_STRDUP(msgid);
225		225
226	return (const char *)data.dptr;	226	return (const char *)data.dptr;
227	}	227	}

Lines 59-65 Link Here

(-)samba-3.0.9-orig/source/lib/adt_tree.c (-8 / +8 lines)
59	{	59	{
60	SORTED_TREE *tree = NULL;	60	SORTED_TREE *tree = NULL;
61		61
62	if ( !(tree = (SORTED_TREE*)malloc( sizeof(SORTED_TREE) )) )	62	if ( !(tree = SMB_MALLOC_P(SORTED_TREE)) )
63	return NULL;	63	return NULL;
64		64
65	ZERO_STRUCTP( tree );	65	ZERO_STRUCTP( tree );
Lines 67-73 Link Here
67	tree->compare = cmp_fn;	67	tree->compare = cmp_fn;
68	tree->free_func = free_fn;	68	tree->free_func = free_fn;
69		69
70	if ( !(tree->root = (TREE_NODE*)malloc( sizeof(TREE_NODE) )) ) {	70	if ( !(tree->root = SMB_MALLOC_P(TREE_NODE)) ) {
71	SAFE_FREE( tree );	71	SAFE_FREE( tree );
72	return NULL;	72	return NULL;
73	}	73	}
Lines 126-140 Link Here
126	TREE_NODE **siblings;	126	TREE_NODE **siblings;
127	int i;	127	int i;
128		128
129	if ( !(infant = (TREE_NODE*)malloc( sizeof(TREE_NODE) )) )	129	if ( !(infant = SMB_MALLOC_P(TREE_NODE)) )
130	return NULL;	130	return NULL;
131		131
132	ZERO_STRUCTP( infant );	132	ZERO_STRUCTP( infant );
133		133
134	infant->key = strdup( key );	134	infant->key = SMB_STRDUP( key );
135	infant->parent = node;	135	infant->parent = node;
136		136
137	siblings = Realloc( node->children, sizeof(TREE_NODE)(node->num_children+1) );	137	siblings = SMB_REALLOC_ARRAY( node->children, TREE_NODE *, node->num_children+1 );
138		138
139	if ( siblings )	139	if ( siblings )
140	node->children = siblings;	140	node->children = siblings;
Lines 260-266 Link Here
260	/* move past the first '/' */	260	/* move past the first '/' */
261		261
262	path++;	262	path++;
263	path2 = strdup( path );	263	path2 = SMB_STRDUP( path );
264	if ( !path2 ) {	264	if ( !path2 ) {
265	DEBUG(0,("sorted_tree_add: strdup() failed on string [%s]!?!?!\n", path));	265	DEBUG(0,("sorted_tree_add: strdup() failed on string [%s]!?!?!\n", path));
266	return False;	266	return False;
Lines 405-413 Link Here
405	/* make a copy to play with */	405	/* make a copy to play with */
406		406
407	if ( *key == '/' )	407	if ( *key == '/' )
408	keystr = strdup( key+1 );	408	keystr = SMB_STRDUP( key+1 );
409	else	409	else
410	keystr = strdup( key );	410	keystr = SMB_STRDUP( key );
411		411
412	if ( !keystr ) {	412	if ( !keystr ) {
413	DEBUG(0,("sorted_tree_find: strdup() failed on string [%s]!?!?!\n", key));	413	DEBUG(0,("sorted_tree_find: strdup() failed on string [%s]!?!?!\n", key));

Lines 30-41 Link Here

(-)samba-3.0.9-orig/source/lib/bitmap.c (-4 / +4 lines)
30	{	30	{
31	struct bitmap *bm;	31	struct bitmap *bm;
32		32
33	bm = (struct bitmap )malloc(sizeof(bm));	33	bm = SMB_MALLOC_P(struct bitmap);
34		34
35	if (!bm) return NULL;	35	if (!bm) return NULL;
36		36
37	bm->n = n;	37	bm->n = n;
38	bm->b = (uint32 )malloc(sizeof(bm->b[0])(n+31)/32);	38	bm->b = SMB_MALLOC_ARRAY(uint32, (n+31)/32);
39	if (!bm->b) {	39	if (!bm->b) {
40	SAFE_FREE(bm);	40	SAFE_FREE(bm);
41	return NULL;	41	return NULL;
Lines 68-79 Link Here
68		68
69	if (!mem_ctx) return NULL;	69	if (!mem_ctx) return NULL;
70		70
71	bm = (struct bitmap )talloc(mem_ctx, sizeof(bm));	71	bm = TALLOC_P(mem_ctx, struct bitmap);
72		72
73	if (!bm) return NULL;	73	if (!bm) return NULL;
74		74
75	bm->n = n;	75	bm->n = n;
76	bm->b = (uint32 )talloc(mem_ctx, sizeof(bm->b[0])(n+31)/32);	76	bm->b = TALLOC_ARRAY(mem_ctx, uint32, (n+31)/32);
77	if (!bm->b) {	77	if (!bm->b) {
78	return NULL;	78	return NULL;
79	}	79	}

Lines 538-546 Link Here

(-)samba-3.0.9-orig/source/lib/charcnv.c (-5 / +5 lines)
538	}	538	}
539		539
540	if (ctx)	540	if (ctx)
541	ob = (char *)talloc_realloc(ctx, ob, destlen);	541	ob = (char *)TALLOC_REALLOC(ctx, ob, destlen);
542	else	542	else
543	ob = (char *)Realloc(ob, destlen);	543	ob = (char *)SMB_REALLOC(ob, destlen);
544		544
545	if (!ob) {	545	if (!ob) {
546	DEBUG(0, ("convert_string_allocate: realloc failed!\n"));	546	DEBUG(0, ("convert_string_allocate: realloc failed!\n"));
Lines 588-596 Link Here
588		588
589	destlen = destlen - o_len;	589	destlen = destlen - o_len;
590	if (ctx)	590	if (ctx)
591	dest = (char )talloc_realloc(ctx,ob,destlen);	591	dest = (char )TALLOC_REALLOC(ctx,ob,destlen);
592	else	592	else
593	dest = (char )Realloc(ob,destlen);	593	dest = (char )SMB_REALLOC(ob,destlen);
594	if (destlen && !*dest) {	594	if (destlen && !*dest) {
595	DEBUG(0, ("convert_string_allocate: out of memory!\n"));	595	DEBUG(0, ("convert_string_allocate: out of memory!\n"));
596	if (!ctx)	596	if (!ctx)
Lines 763-769 Link Here
763	}	763	}
764	}	764	}
765		765
766	return strdup(out_buffer);	766	return SMB_STRDUP(out_buffer);
767	}	767	}
768		768
769	size_t unix_strlower(const char src, size_t srclen, char dest, size_t destlen)	769	size_t unix_strlower(const char src, size_t srclen, char dest, size_t destlen)

Lines 47-53 Link Here

(-)samba-3.0.9-orig/source/lib/data_blob.c (-3 / +3 lines)
47	if (p) {	47	if (p) {
48	ret.data = smb_xmemdup(p, length);	48	ret.data = smb_xmemdup(p, length);
49	} else {	49	} else {
50	ret.data = smb_xmalloc(length);	50	ret.data = SMB_XMALLOC_ARRAY(char, length);
51	}	51	}
52	ret.length = length;	52	ret.length = length;
53	ret.free = free_data_blob;	53	ret.free = free_data_blob;
Lines 67-77 Link Here
67	}	67	}
68		68
69	if (p) {	69	if (p) {
70	ret.data = talloc_memdup(mem_ctx, p, length);	70	ret.data = TALLOC_MEMDUP(mem_ctx, p, length);
71	if (ret.data == NULL)	71	if (ret.data == NULL)
72	smb_panic("data_blob_talloc: talloc_memdup failed.\n");	72	smb_panic("data_blob_talloc: talloc_memdup failed.\n");
73	} else {	73	} else {
74	ret.data = talloc(mem_ctx, length);	74	ret.data = TALLOC(mem_ctx, length);
75	if (ret.data == NULL)	75	if (ret.data == NULL)
76	smb_panic("data_blob_talloc: talloc failed.\n");	76	smb_panic("data_blob_talloc: talloc failed.\n");
77	}	77	}

Lines 192-198 Link Here

(-)samba-3.0.9-orig/source/lib/debug.c (-7 / +6 lines)
192	if (DEBUGLEVEL_CLASS == &debug_all_class_hack)	192	if (DEBUGLEVEL_CLASS == &debug_all_class_hack)
193	return NULL;	193	return NULL;
194		194
195	list = calloc(debug_num_classes + 1, sizeof(char *));	195	list = SMB_CALLOC_ARRAY(char *, debug_num_classes + 1);
196	if (!list)	196	if (!list)
197	return NULL;	197	return NULL;
198		198
Lines 210-216 Link Here
210	}	210	}
211		211
212	/* create single string list - add space for newline */	212	/* create single string list - add space for newline */
213	b = buf = malloc(dim+1);	213	b = buf = SMB_MALLOC(dim+1);
214	if (!buf) {	214	if (!buf) {
215	err = True;	215	err = True;
216	goto done;	216	goto done;
Lines 292-298 Link Here
292	/* Initial loading... */	292	/* Initial loading... */
293	new_ptr = NULL;	293	new_ptr = NULL;
294	}	294	}
295	new_ptr = Realloc(new_ptr, sizeof(int) * (debug_num_classes + 1));	295	new_ptr = SMB_REALLOC_ARRAY(new_ptr, int, debug_num_classes + 1);
296	if (!new_ptr)	296	if (!new_ptr)
297	return -1;	297	return -1;
298	DEBUGLEVEL_CLASS = new_ptr;	298	DEBUGLEVEL_CLASS = new_ptr;
Lines 309-327 Link Here
309	if (new_ptr == &debug_all_class_isset_hack) {	309	if (new_ptr == &debug_all_class_isset_hack) {
310	new_ptr = NULL;	310	new_ptr = NULL;
311	}	311	}
312	new_ptr = Realloc(new_ptr, sizeof(BOOL) * (debug_num_classes + 1));	312	new_ptr = SMB_REALLOC_ARRAY(new_ptr, BOOL, debug_num_classes + 1);
313	if (!new_ptr)	313	if (!new_ptr)
314	return -1;	314	return -1;
315	DEBUGLEVEL_CLASS_ISSET = new_ptr;	315	DEBUGLEVEL_CLASS_ISSET = new_ptr;
316	DEBUGLEVEL_CLASS_ISSET[ndx] = False;	316	DEBUGLEVEL_CLASS_ISSET[ndx] = False;
317		317
318	new_ptr = Realloc(classname_table,	318	new_ptr = SMB_REALLOC_ARRAY(classname_table, char *, debug_num_classes + 1);
319	sizeof(char ) (debug_num_classes + 1));
320	if (!new_ptr)	319	if (!new_ptr)
321	return -1;	320	return -1;
322	classname_table = new_ptr;	321	classname_table = new_ptr;
323		322
324	classname_table[ndx] = strdup(classname);	323	classname_table[ndx] = SMB_STRDUP(classname);
325	if (! classname_table[ndx])	324	if (! classname_table[ndx])
326	return -1;	325	return -1;
327		326

Lines 117-125 Link Here

(-)samba-3.0.9-orig/source/lib/gencache.c (-12 / +11 lines)
117	if (!valstr)	117	if (!valstr)
118	return False;	118	return False;
119		119
120	keybuf.dptr = strdup(keystr);	120	keybuf.dptr = SMB_STRDUP(keystr);
121	keybuf.dsize = strlen(keystr)+1;	121	keybuf.dsize = strlen(keystr)+1;
122	databuf.dptr = strdup(valstr);	122	databuf.dptr = SMB_STRDUP(valstr);
123	databuf.dsize = strlen(valstr)+1;	123	databuf.dsize = strlen(valstr)+1;
124	DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="	124	DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
125	" %s (%d seconds %s)\n", keybuf.dptr, value,ctime(&timeout),	125	" %s (%d seconds %s)\n", keybuf.dptr, value,ctime(&timeout),
Lines 170-178 Link Here
170	= %s\n", keystr, old_valstr, ctime(&old_timeout)));	170	= %s\n", keystr, old_valstr, ctime(&old_timeout)));
171		171
172	asprintf(&datastr, CACHE_DATA_FMT, (int)timeout, valstr);	172	asprintf(&datastr, CACHE_DATA_FMT, (int)timeout, valstr);
173	keybuf.dptr = strdup(keystr);	173	keybuf.dptr = SMB_STRDUP(keystr);
174	keybuf.dsize = strlen(keystr)+1;	174	keybuf.dsize = strlen(keystr)+1;
175	databuf.dptr = strdup(datastr);	175	databuf.dptr = SMB_STRDUP(datastr);
176	databuf.dsize = strlen(datastr)+1;	176	databuf.dsize = strlen(datastr)+1;
177	DEBUGADD(10, ("New value = %s, new timeout = %s (%d seconds %s)", valstr,	177	DEBUGADD(10, ("New value = %s, new timeout = %s (%d seconds %s)", valstr,
178	ctime(&timeout), (int)(timeout - time(NULL)),	178	ctime(&timeout), (int)(timeout - time(NULL)),
Lines 209-215 Link Here
209		209
210	if (!gencache_init()) return False;	210	if (!gencache_init()) return False;
211		211
212	keybuf.dptr = strdup(keystr);	212	keybuf.dptr = SMB_STRDUP(keystr);
213	keybuf.dsize = strlen(keystr)+1;	213	keybuf.dsize = strlen(keystr)+1;
214	DEBUG(10, ("Deleting cache entry (key = %s)\n", keystr));	214	DEBUG(10, ("Deleting cache entry (key = %s)\n", keystr));
215	ret = tdb_delete(cache, keybuf);	215	ret = tdb_delete(cache, keybuf);
Lines 242-259 Link Here
242	if (!gencache_init())	242	if (!gencache_init())
243	return False;	243	return False;
244		244
245	keybuf.dptr = strdup(keystr);	245	keybuf.dptr = SMB_STRDUP(keystr);
246	keybuf.dsize = strlen(keystr)+1;	246	keybuf.dsize = strlen(keystr)+1;
247	databuf = tdb_fetch(cache, keybuf);	247	databuf = tdb_fetch(cache, keybuf);
248	SAFE_FREE(keybuf.dptr);	248	SAFE_FREE(keybuf.dptr);
249		249
250	if (databuf.dptr && databuf.dsize > TIMEOUT_LEN) {	250	if (databuf.dptr && databuf.dsize > TIMEOUT_LEN) {
251	char* entry_buf = strndup(databuf.dptr, databuf.dsize);	251	char* entry_buf = SMB_STRNDUP(databuf.dptr, databuf.dsize);
252	char *v;	252	char *v;
253	time_t t;	253	time_t t;
254		254
255	v = (char)malloc(sizeof(char)	255	v = SMB_MALLOC(databuf.dsize - TIMEOUT_LEN);
256	(databuf.dsize - TIMEOUT_LEN));
257		256
258	SAFE_FREE(databuf.dptr);	257	SAFE_FREE(databuf.dptr);
259	sscanf(entry_buf, CACHE_DATA_FMT, (int*)&t, v);	258	sscanf(entry_buf, CACHE_DATA_FMT, (int*)&t, v);
Lines 320-326 Link Here
320		319
321	while (node) {	320	while (node) {
322	/* ensure null termination of the key string */	321	/* ensure null termination of the key string */
323	keystr = strndup(node->node_key.dptr, node->node_key.dsize);	322	keystr = SMB_STRNDUP(node->node_key.dptr, node->node_key.dsize);
324		323
325	/*	324	/*
326	* We don't use gencache_get function, because we need to iterate through	325	* We don't use gencache_get function, because we need to iterate through
Lines 333-341 Link Here
333	node = node->next;	332	node = node->next;
334	continue;	333	continue;
335	}	334	}
336	entry = strndup(databuf.dptr, databuf.dsize);	335	entry = SMB_STRNDUP(databuf.dptr, databuf.dsize);
337	SAFE_FREE(databuf.dptr);	336	SAFE_FREE(databuf.dptr);
338	valstr = (char)malloc(sizeof(char) (databuf.dsize - TIMEOUT_LEN));	337	valstr = SMB_MALLOC(databuf.dsize - TIMEOUT_LEN);
339	sscanf(entry, CACHE_DATA_FMT, (int*)(&timeout), valstr);	338	sscanf(entry, CACHE_DATA_FMT, (int*)(&timeout), valstr);
340		339
341	DEBUG(10, ("Calling function with arguments (key = %s, value = %s, timeout = %s)\n",	340	DEBUG(10, ("Calling function with arguments (key = %s, value = %s, timeout = %s)\n",

Lines 209-223 Link Here

(-)samba-3.0.9-orig/source/lib/iconv.c (-4 / +4 lines)
209	from = charsets;	209	from = charsets;
210	to = charsets;	210	to = charsets;
211		211
212	ret = (smb_iconv_t)malloc(sizeof(*ret));	212	ret = SMB_MALLOC_P(struct _smb_iconv_t);
213	if (!ret) {	213	if (!ret) {
214	errno = ENOMEM;	214	errno = ENOMEM;
215	return (smb_iconv_t)-1;	215	return (smb_iconv_t)-1;
216	}	216	}
217	memset(ret, 0, sizeof(*ret));	217	memset(ret, 0, sizeof(struct _smb_iconv_t));
218		218
219	ret->from_name = strdup(fromcode);	219	ret->from_name = SMB_STRDUP(fromcode);
220	ret->to_name = strdup(tocode);	220	ret->to_name = SMB_STRDUP(tocode);
221		221
222	/* check for the simplest null conversion */	222	/* check for the simplest null conversion */
223	if (strcasecmp(fromcode, tocode) == 0) {	223	if (strcasecmp(fromcode, tocode) == 0) {

Lines 75-81 Link Here

(-)samba-3.0.9-orig/source/lib/privileges.c (-6 / +6 lines)
75	if ( !old_la )	75	if ( !old_la )
76	return NT_STATUS_OK;	76	return NT_STATUS_OK;
77		77
78	new_la = (LUID_ATTR )talloc(mem_ctx, sizeof(LUID_ATTR));	78	*new_la = TALLOC_P(mem_ctx, LUID_ATTR);
79	ALLOC_CHECK(new_la, ret, done, "dupalloc_luid_attr");	79	ALLOC_CHECK(new_la, ret, done, "dupalloc_luid_attr");
80		80
81	(*new_la)->luid.high = old_la->luid.high;	81	(*new_la)->luid.high = old_la->luid.high;
Lines 97-103 Link Here
97	TALLOC_CTX *mem_ctx = talloc_init("privilege set");	97	TALLOC_CTX *mem_ctx = talloc_init("privilege set");
98	ALLOC_CHECK(mem_ctx, ret, done, "init_privilege");	98	ALLOC_CHECK(mem_ctx, ret, done, "init_privilege");
99		99
100	*priv_set = talloc_zero(mem_ctx, sizeof(PRIVILEGE_SET));	100	*priv_set = TALLOC_ZERO_P(mem_ctx, PRIVILEGE_SET);
101	ALLOC_CHECK(*priv_set, ret, done, "init_privilege");	101	ALLOC_CHECK(*priv_set, ret, done, "init_privilege");
102		102
103	(*priv_set)->mem_ctx = mem_ctx;	103	(*priv_set)->mem_ctx = mem_ctx;
Lines 112-118 Link Here
112	{	112	{
113	NTSTATUS ret;	113	NTSTATUS ret;
114		114
115	*priv_set = talloc_zero(mem_ctx, sizeof(PRIVILEGE_SET));	115	*priv_set = TALLOC_ZERO_P(mem_ctx, PRIVILEGE_SET);
116	ALLOC_CHECK(*priv_set, ret, done, "init_privilege");	116	ALLOC_CHECK(*priv_set, ret, done, "init_privilege");
117		117
118	(*priv_set)->mem_ctx = mem_ctx;	118	(*priv_set)->mem_ctx = mem_ctx;
Lines 154-160 Link Here
154		154
155	/* we can allocate memory to add the new privilege */	155	/* we can allocate memory to add the new privilege */
156		156
157	new_set = (LUID_ATTR )talloc_realloc(priv_set->mem_ctx, priv_set->set, (priv_set->count + 1) (sizeof(LUID_ATTR)));	157	new_set = TALLOC_REALLOC_ARRAY(priv_set->mem_ctx, priv_set->set, LUID_ATTR, priv_set->count + 1);
158	ALLOC_CHECK(new_set, ret, done, "add_privilege");	158	ALLOC_CHECK(new_set, ret, done, "add_privilege");
159		159
160	new_set[priv_set->count].luid.high = set.luid.high;	160	new_set[priv_set->count].luid.high = set.luid.high;
Lines 269-275 Link Here
269		269
270	old_set = priv_set->set;	270	old_set = priv_set->set;
271		271
272	new_set = (LUID_ATTR )talloc(priv_set->mem_ctx, (priv_set->count - 1) (sizeof(LUID_ATTR)));	272	new_set = TALLOC_ARRAY(priv_set->mem_ctx, LUID_ATTR, priv_set->count - 1);
273	ALLOC_CHECK(new_set, ret, done, "remove_privilege");	273	ALLOC_CHECK(new_set, ret, done, "remove_privilege");
274		274
275	for (i=0, j=0; i < priv_set->count; i++) {	275	for (i=0, j=0; i < priv_set->count; i++) {
Lines 329-335 Link Here
329		329
330	old_set = priv_set->set;	330	old_set = priv_set->set;
331		331
332	new_set = (LUID_ATTR )talloc(new_priv_set->mem_ctx, (priv_set->count - 1) (sizeof(LUID_ATTR)));	332	new_set = TALLOC_ARRAY(new_priv_set->mem_ctx, LUID_ATTR, priv_set->count - 1);
333	ALLOC_CHECK(new_set, ret, done, "dup_priv_set");	333	ALLOC_CHECK(new_set, ret, done, "dup_priv_set");
334		334
335	for (i=0; i < priv_set->count; i++) {	335	for (i=0; i < priv_set->count; i++) {

Lines 187-193 Link Here

(-)samba-3.0.9-orig/source/lib/secdesc.c (-3 / +3 lines)
187		187
188	*sd_size = 0;	188	*sd_size = 0;
189		189
190	if(( dst = (SEC_DESC *)talloc_zero(ctx, sizeof(SEC_DESC))) == NULL)	190	if(( dst = TALLOC_ZERO_P(ctx, SEC_DESC)) == NULL)
191	return NULL;	191	return NULL;
192		192
193	dst->revision = revision;	193	dst->revision = revision;
Lines 284-290 Link Here
284	{	284	{
285	SEC_DESC_BUF *dst;	285	SEC_DESC_BUF *dst;
286		286
287	if((dst = (SEC_DESC_BUF *)talloc_zero(ctx, sizeof(SEC_DESC_BUF))) == NULL)	287	if((dst = TALLOC_ZERO_P(ctx, SEC_DESC_BUF)) == NULL)
288	return NULL;	288	return NULL;
289		289
290	/* max buffer size (allocated size) */	290	/* max buffer size (allocated size) */
Lines 417-423 Link Here
417		417
418	the_acl = parent_ctr->dacl;	418	the_acl = parent_ctr->dacl;
419		419
420	if (!(new_ace_list = talloc(ctx, sizeof(SEC_ACE) * the_acl->num_aces)))	420	if (!(new_ace_list = TALLOC_ARRAY(ctx, SEC_ACE, the_acl->num_aces)))
421	return NULL;	421	return NULL;
422		422
423	for (i = 0; the_acl && i < the_acl->num_aces; i++) {	423	for (i = 0; the_acl && i < the_acl->num_aces; i++) {

Lines 239-245 Link Here

(-)samba-3.0.9-orig/source/lib/smbldap.c (-13 / +12 lines)
239	i++;	239	i++;
240	i++;	240	i++;
241		241
242	names = (char*)malloc( sizeof(char)*i );	242	names = SMB_MALLOC_ARRAY( char*, i );
243	if ( !names ) {	243	if ( !names ) {
244	DEBUG(0,("get_attr_list: out of memory\n"));	244	DEBUG(0,("get_attr_list: out of memory\n"));
245	return NULL;	245	return NULL;
Lines 247-253 Link Here
247		247
248	i = 0;	248	i = 0;
249	while ( table[i].attrib != LDAP_ATTR_LIST_END ) {	249	while ( table[i].attrib != LDAP_ATTR_LIST_END ) {
250	names[i] = strdup( table[i].name );	250	names[i] = SMB_STRDUP( table[i].name );
251	i++;	251	i++;
252	}	252	}
253	names[i] = NULL;	253	names[i] = NULL;
Lines 295-301 Link Here
295	if (!size) {	295	if (!size) {
296	/* Upgrade 2.2 style entry */	296	/* Upgrade 2.2 style entry */
297	char *p;	297	char *p;
298	char* old_style_key = strdup(*dn);	298	char* old_style_key = SMB_STRDUP(*dn);
299	char *data;	299	char *data;
300	fstring old_style_pw;	300	fstring old_style_pw;
301		301
Lines 408-414 Link Here
408	#endif	408	#endif
409		409
410	if (mods == NULL) {	410	if (mods == NULL) {
411	mods = (LDAPMod *) malloc(sizeof(LDAPMod ));	411	mods = SMB_MALLOC_P(LDAPMod *);
412	if (mods == NULL) {	412	if (mods == NULL) {
413	DEBUG(0, ("make_a_mod: out of memory!\n"));	413	DEBUG(0, ("make_a_mod: out of memory!\n"));
414	return;	414	return;
Lines 422-440 Link Here
422	}	422	}
423		423
424	if (mods[i] == NULL) {	424	if (mods[i] == NULL) {
425	mods = (LDAPMod *) Realloc (mods, (i + 2) sizeof (LDAPMod *));	425	mods = SMB_REALLOC_ARRAY (mods, LDAPMod *, i + 2);
426	if (mods == NULL) {	426	if (mods == NULL) {
427	DEBUG(0, ("make_a_mod: out of memory!\n"));	427	DEBUG(0, ("make_a_mod: out of memory!\n"));
428	return;	428	return;
429	}	429	}
430	mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod));	430	mods[i] = SMB_MALLOC_P(LDAPMod);
431	if (mods[i] == NULL) {	431	if (mods[i] == NULL) {
432	DEBUG(0, ("make_a_mod: out of memory!\n"));	432	DEBUG(0, ("make_a_mod: out of memory!\n"));
433	return;	433	return;
434	}	434	}
435	mods[i]->mod_op = modop;	435	mods[i]->mod_op = modop;
436	mods[i]->mod_values = NULL;	436	mods[i]->mod_values = NULL;
437	mods[i]->mod_type = strdup(attribute);	437	mods[i]->mod_type = SMB_STRDUP(attribute);
438	mods[i + 1] = NULL;	438	mods[i + 1] = NULL;
439	}	439	}
440		440
Lines 445-452 Link Here
445	if (mods[i]->mod_values != NULL) {	445	if (mods[i]->mod_values != NULL) {
446	for (; mods[i]->mod_values[j] != NULL; j++);	446	for (; mods[i]->mod_values[j] != NULL; j++);
447	}	447	}
448	mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values,	448	mods[i]->mod_values = SMB_REALLOC_ARRAY(mods[i]->mod_values, char *, j + 2);
449	(j + 2) * sizeof (char *));
450		449
451	if (mods[i]->mod_values == NULL) {	450	if (mods[i]->mod_values == NULL) {
452	DEBUG (0, ("make_a_mod: Memory allocation failure!\n"));	451	DEBUG (0, ("make_a_mod: Memory allocation failure!\n"));
Lines 574-580 Link Here
574	return;	573	return;
575	}	574	}
576		575
577	t = smb_xmalloc(sizeof(*t));	576	t = SMB_XMALLOC_P(struct smbldap_state_lookup);
578	ZERO_STRUCTP(t);	577	ZERO_STRUCTP(t);
579		578
580	DLIST_ADD_END(smbldap_state_lookup_list, t, tmp);	579	DLIST_ADD_END(smbldap_state_lookup_list, t, tmp);
Lines 718-728 Link Here
718	DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n",	717	DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n",
719	ldap_state->bind_dn));	718	ldap_state->bind_dn));
720		719
721	*whop = strdup(ldap_state->bind_dn);	720	*whop = SMB_STRDUP(ldap_state->bind_dn);
722	if (!*whop) {	721	if (!*whop) {
723	return LDAP_NO_MEMORY;	722	return LDAP_NO_MEMORY;
724	}	723	}
725	*credp = strdup(ldap_state->bind_secret);	724	*credp = SMB_STRDUP(ldap_state->bind_secret);
726	if (!*credp) {	725	if (!*credp) {
727	SAFE_FREE(*whop);	726	SAFE_FREE(*whop);
728	return LDAP_NO_MEMORY;	727	return LDAP_NO_MEMORY;
Lines 1207-1213 Link Here
1207		1206
1208	NTSTATUS smbldap_init(TALLOC_CTX mem_ctx, const char location, struct smbldap_state **smbldap_state)	1207	NTSTATUS smbldap_init(TALLOC_CTX mem_ctx, const char location, struct smbldap_state **smbldap_state)
1209	{	1208	{
1210	smbldap_state = talloc_zero(mem_ctx, sizeof(*smbldap_state));	1209	*smbldap_state = TALLOC_ZERO_P(mem_ctx, struct smbldap_state);
1211	if (!*smbldap_state) {	1210	if (!*smbldap_state) {
1212	DEBUG(0, ("talloc() failed for ldapsam private_data!\n"));	1211	DEBUG(0, ("talloc() failed for ldapsam private_data!\n"));
1213	return NT_STATUS_NO_MEMORY;	1212	return NT_STATUS_NO_MEMORY;

Lines 224-230 Link Here

(-)samba-3.0.9-orig/source/lib/substitute.c (-5 / +5 lines)
224		224
225	r = p + 3;	225	r = p + 3;
226	copylen = q - r;	226	copylen = q - r;
227	envname = (char )malloc(copylen + 1 + 4); / reserve space for use later add %$() chars */	227	envname = (char )SMB_MALLOC(copylen + 1 + 4); / reserve space for use later add %$() chars */
228	if (envname == NULL) return NULL;	228	if (envname == NULL) return NULL;
229	strncpy(envname,r,copylen);	229	strncpy(envname,r,copylen);
230	envname[copylen] = '\0';	230	envname[copylen] = '\0';
Lines 508-514 Link Here
508	return NULL;	508	return NULL;
509	}	509	}
510		510
511	a_string = strdup(str);	511	a_string = SMB_STRDUP(str);
512	if (a_string == NULL) {	512	if (a_string == NULL) {
513	DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));	513	DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));
514	return NULL;	514	return NULL;
Lines 526-532 Link Here
526	t = realloc_string_sub(t, "%U", r);	526	t = realloc_string_sub(t, "%U", r);
527	break;	527	break;
528	case 'G' :	528	case 'G' :
529	r = strdup(smb_name);	529	r = SMB_STRDUP(smb_name);
530	if (r == NULL) goto error;	530	if (r == NULL) goto error;
531	if ((pass = Get_Pwnam(r))!=NULL) {	531	if ((pass = Get_Pwnam(r))!=NULL) {
532	t = realloc_string_sub(t, "%G", gidtoname(pass->pw_gid));	532	t = realloc_string_sub(t, "%G", gidtoname(pass->pw_gid));
Lines 623-629 Link Here
623	char a_string, ret_string;	623	char a_string, ret_string;
624	char b, p, s, t;	624	char b, p, s, t;
625		625
626	a_string = strdup(input_string);	626	a_string = SMB_STRDUP(input_string);
627	if (a_string == NULL) {	627	if (a_string == NULL) {
628	DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));	628	DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));
629	return NULL;	629	return NULL;
Lines 700-706 Link Here
700	char a_string, ret_string;	700	char a_string, ret_string;
701	char b, p, s, t, *h;	701	char b, p, s, t, *h;
702		702
703	a_string = strdup(str);	703	a_string = SMB_STRDUP(str);
704	if (a_string == NULL) {	704	if (a_string == NULL) {
705	DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));	705	DEBUG(0, ("alloc_sub_specified: Out of memory!\n"));
706	return NULL;	706	return NULL;

Lines 282-288 Link Here

(-)samba-3.0.9-orig/source/lib/util_file.c (-5 / +5 lines)
282		282
283	if (!s2) {	283	if (!s2) {
284	maxlen = MIN(maxlen,8);	284	maxlen = MIN(maxlen,8);
285	s = (char *)malloc(maxlen);	285	s = (char *)SMB_MALLOC(maxlen);
286	}	286	}
287		287
288	if (!s) {	288	if (!s) {
Lines 325-331 Link Here
325	char *t;	325	char *t;
326		326
327	maxlen *= 2;	327	maxlen *= 2;
328	t = (char *)Realloc(s,maxlen);	328	t = (char *)SMB_REALLOC(s,maxlen);
329	if (!t) {	329	if (!t) {
330	DEBUG(0,("fgets_slash: failed to expand buffer!\n"));	330	DEBUG(0,("fgets_slash: failed to expand buffer!\n"));
331	SAFE_FREE(s);	331	SAFE_FREE(s);
Lines 358-364 Link Here
358	total = 0;	358	total = 0;
359		359
360	while ((n = read(fd, buf, sizeof(buf))) > 0) {	360	while ((n = read(fd, buf, sizeof(buf))) > 0) {
361	tp = Realloc(p, total + n + 1);	361	tp = SMB_REALLOC(p, total + n + 1);
362	if (!tp) {	362	if (!tp) {
363	DEBUG(0,("file_pload: failed to expand buffer!\n"));	363	DEBUG(0,("file_pload: failed to expand buffer!\n"));
364	close(fd);	364	close(fd);
Lines 397-403 Link Here
397	return NULL;	397	return NULL;
398	}	398	}
399		399
400	p = (char *)malloc(sbuf.st_size+1);	400	p = (char *)SMB_MALLOC(sbuf.st_size+1);
401	if (!p) {	401	if (!p) {
402	return NULL;	402	return NULL;
403	}	403	}
Lines 492-498 Link Here
492	if (s[0] == '\n') i++;	492	if (s[0] == '\n') i++;
493	}	493	}
494		494
495	ret = (char *)malloc(sizeof(ret[0])(i+2));	495	ret = SMB_MALLOC_ARRAY(char *, i+2);
496	if (!ret) {	496	if (!ret) {
497	SAFE_FREE(p);	497	SAFE_FREE(p);
498	return NULL;	498	return NULL;

Lines 33-39 Link Here

(-)samba-3.0.9-orig/source/lib/util_getent.c (-15 / +15 lines)
33	struct sys_grent *gent;	33	struct sys_grent *gent;
34	struct group *grp;	34	struct group *grp;
35		35
36	gent = (struct sys_grent *) malloc(sizeof(struct sys_grent));	36	gent = SMB_MALLOC_P(struct sys_grent);
37	if (gent == NULL) {	37	if (gent == NULL) {
38	DEBUG (0, ("Out of memory in getgrent_list!\n"));	38	DEBUG (0, ("Out of memory in getgrent_list!\n"));
39	return NULL;	39	return NULL;
Lines 53-63 Link Here
53	int i,num;	53	int i,num;
54		54
55	if (grp->gr_name) {	55	if (grp->gr_name) {
56	if ((gent->gr_name = strdup(grp->gr_name)) == NULL)	56	if ((gent->gr_name = SMB_STRDUP(grp->gr_name)) == NULL)
57	goto err;	57	goto err;
58	}	58	}
59	if (grp->gr_passwd) {	59	if (grp->gr_passwd) {
60	if ((gent->gr_passwd = strdup(grp->gr_passwd)) == NULL)	60	if ((gent->gr_passwd = SMB_STRDUP(grp->gr_passwd)) == NULL)
61	goto err;	61	goto err;
62	}	62	}
63	gent->gr_gid = grp->gr_gid;	63	gent->gr_gid = grp->gr_gid;
Lines 67-86 Link Here
67	;	67	;
68		68
69	/* alloc space for gr_mem string pointers */	69	/* alloc space for gr_mem string pointers */
70	if ((gent->gr_mem = (char *) malloc((num+1) sizeof(char *))) == NULL)	70	if ((gent->gr_mem = SMB_MALLOC_ARRAY(char *, num+1)) == NULL)
71	goto err;	71	goto err;
72		72
73	memset(gent->gr_mem, '\0', (num+1) * sizeof(char *));	73	memset(gent->gr_mem, '\0', (num+1) * sizeof(char *));
74		74
75	for (i=0; i < num; i++) {	75	for (i=0; i < num; i++) {
76	if ((gent->gr_mem[i] = strdup(grp->gr_mem[i])) == NULL)	76	if ((gent->gr_mem[i] = SMB_STRDUP(grp->gr_mem[i])) == NULL)
77	goto err;	77	goto err;
78	}	78	}
79	gent->gr_mem[num] = NULL;	79	gent->gr_mem[num] = NULL;
80		80
81	grp = getgrent();	81	grp = getgrent();
82	if (grp) {	82	if (grp) {
83	gent->next = (struct sys_grent *) malloc(sizeof(struct sys_grent));	83	gent->next = SMB_MALLOC_P(struct sys_grent);
84	if (gent->next == NULL)	84	if (gent->next == NULL)
85	goto err;	85	goto err;
86	gent = gent->next;	86	gent = gent->next;
Lines 134-140 Link Here
134	struct sys_pwent *pent;	134	struct sys_pwent *pent;
135	struct passwd *pwd;	135	struct passwd *pwd;
136		136
137	pent = (struct sys_pwent *) malloc(sizeof(struct sys_pwent));	137	pent = SMB_MALLOC_P(struct sys_pwent);
138	if (pent == NULL) {	138	if (pent == NULL) {
139	DEBUG (0, ("Out of memory in getpwent_list!\n"));	139	DEBUG (0, ("Out of memory in getpwent_list!\n"));
140	return NULL;	140	return NULL;
Lines 146-176 Link Here
146	while (pwd != NULL) {	146	while (pwd != NULL) {
147	memset(pent, '\0', sizeof(struct sys_pwent));	147	memset(pent, '\0', sizeof(struct sys_pwent));
148	if (pwd->pw_name) {	148	if (pwd->pw_name) {
149	if ((pent->pw_name = strdup(pwd->pw_name)) == NULL)	149	if ((pent->pw_name = SMB_STRDUP(pwd->pw_name)) == NULL)
150	goto err;	150	goto err;
151	}	151	}
152	if (pwd->pw_passwd) {	152	if (pwd->pw_passwd) {
153	if ((pent->pw_passwd = strdup(pwd->pw_passwd)) == NULL)	153	if ((pent->pw_passwd = SMB_STRDUP(pwd->pw_passwd)) == NULL)
154	goto err;	154	goto err;
155	}	155	}
156	pent->pw_uid = pwd->pw_uid;	156	pent->pw_uid = pwd->pw_uid;
157	pent->pw_gid = pwd->pw_gid;	157	pent->pw_gid = pwd->pw_gid;
158	if (pwd->pw_gecos) {	158	if (pwd->pw_gecos) {
159	if ((pent->pw_gecos = strdup(pwd->pw_gecos)) == NULL)	159	if ((pent->pw_gecos = SMB_STRDUP(pwd->pw_gecos)) == NULL)
160	goto err;	160	goto err;
161	}	161	}
162	if (pwd->pw_dir) {	162	if (pwd->pw_dir) {
163	if ((pent->pw_dir = strdup(pwd->pw_dir)) == NULL)	163	if ((pent->pw_dir = SMB_STRDUP(pwd->pw_dir)) == NULL)
164	goto err;	164	goto err;
165	}	165	}
166	if (pwd->pw_shell) {	166	if (pwd->pw_shell) {
167	if ((pent->pw_shell = strdup(pwd->pw_shell)) == NULL)	167	if ((pent->pw_shell = SMB_STRDUP(pwd->pw_shell)) == NULL)
168	goto err;	168	goto err;
169	}	169	}
170		170
171	pwd = getpwent();	171	pwd = getpwent();
172	if (pwd) {	172	if (pwd) {
173	pent->next = (struct sys_pwent *) malloc(sizeof(struct sys_pwent));	173	pent->next = SMB_MALLOC_P(struct sys_pwent);
174	if (pent->next == NULL)	174	if (pent->next == NULL)
175	goto err;	175	goto err;
176	pent = pent->next;	176	pent = pent->next;
Lines 223-234 Link Here
223	;	223	;
224		224
225	for (i = 0; i < num_users; i++) {	225	for (i = 0; i < num_users; i++) {
226	struct sys_userlist entry = (struct sys_userlist )malloc(sizeof(*entry));	226	struct sys_userlist *entry = SMB_MALLOC_P(struct sys_userlist);
227	if (entry == NULL) {	227	if (entry == NULL) {
228	free_userlist(list_head);	228	free_userlist(list_head);
229	return NULL;	229	return NULL;
230	}	230	}
231	entry->unix_name = (char *)strdup(grp->gr_mem[i]);	231	entry->unix_name = (char *)SMB_STRDUP(grp->gr_mem[i]);
232	if (entry->unix_name == NULL) {	232	if (entry->unix_name == NULL) {
233	SAFE_FREE(entry);	233	SAFE_FREE(entry);
234	free_userlist(list_head);	234	free_userlist(list_head);

Lines 304-310 Link Here

(-)samba-3.0.9-orig/source/lib/util_sid.c (-3 / +3 lines)
304		304
305	memset((char *)sidout, '\0', sizeof(DOM_SID));	305	memset((char *)sidout, '\0', sizeof(DOM_SID));
306		306
307	p = q = strdup(sidstr + 2);	307	p = q = SMB_STRDUP(sidstr + 2);
308	if (p == NULL) {	308	if (p == NULL) {
309	DEBUG(0, ("string_to_sid: out of memory!\n"));	309	DEBUG(0, ("string_to_sid: out of memory!\n"));
310	return False;	310	return False;
Lines 621-627 Link Here
621	{	621	{
622	char buf, s;	622	char buf, s;
623	int len = sid_size(sid);	623	int len = sid_size(sid);
624	buf = malloc(len);	624	buf = SMB_MALLOC(len);
625	if (!buf)	625	if (!buf)
626	return NULL;	626	return NULL;
627	sid_linearize(buf, len, sid);	627	sid_linearize(buf, len, sid);
Lines 641-647 Link Here
641	if(!src)	641	if(!src)
642	return NULL;	642	return NULL;
643		643
644	if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) {	644	if((dst = TALLOC_ZERO_P(ctx, DOM_SID)) != NULL) {
645	sid_copy( dst, src);	645	sid_copy( dst, src);
646	}	646	}
647		647

Lines 134-140 Link Here

(-)samba-3.0.9-orig/source/lib/util_str.c (-19 / +19 lines)
134	*ctok=ictok;	134	*ctok=ictok;
135	s=(char *)last_ptr;	135	s=(char *)last_ptr;
136		136
137	if (!(ret=iret=malloc((ictok+1)sizeof(char ))))	137	if (!(ret=iret=SMB_MALLOC_ARRAY(char *,ictok+1)))
138	return NULL;	138	return NULL;
139		139
140	while(ictok--) {	140	while(ictok--) {
Lines 815-821 Link Here
815	int i;	815	int i;
816	char *hex_buffer;	816	char *hex_buffer;
817		817
818	out_hex_buffer = smb_xmalloc((len2)+1);	818	out_hex_buffer = SMB_XMALLOC_ARRAY(char, (len2)+1);
819	hex_buffer = *out_hex_buffer;	819	hex_buffer = *out_hex_buffer;
820		820
821	for (i = 0; i < len; i++)	821	for (i = 0; i < len; i++)
Lines 863-869 Link Here
863		863
864	if (l == 0) {	864	if (l == 0) {
865	if (!null_string) {	865	if (!null_string) {
866	if((null_string = (char *)malloc(1)) == NULL) {	866	if((null_string = (char *)SMB_MALLOC(1)) == NULL) {
867	DEBUG(0,("string_init: malloc fail for null_string.\n"));	867	DEBUG(0,("string_init: malloc fail for null_string.\n"));
868	return False;	868	return False;
869	}	869	}
Lines 871-877 Link Here
871	}	871	}
872	*dest = null_string;	872	*dest = null_string;
873	} else {	873	} else {
874	(*dest) = strdup(src);	874	(*dest) = SMB_STRDUP(src);
875	if ((*dest) == NULL) {	875	if ((*dest) == NULL) {
876	DEBUG(0,("Out of memory in string_init\n"));	876	DEBUG(0,("Out of memory in string_init\n"));
877	return False;	877	return False;
Lines 990-996 Link Here
990		990
991	s = string;	991	s = string;
992		992
993	in = strdup(insert);	993	in = SMB_STRDUP(insert);
994	if (!in) {	994	if (!in) {
995	DEBUG(0, ("realloc_string_sub: out of memory!\n"));	995	DEBUG(0, ("realloc_string_sub: out of memory!\n"));
996	return NULL;	996	return NULL;
Lines 1019-1025 Link Here
1019	while ((p = strstr_m(s,pattern))) {	1019	while ((p = strstr_m(s,pattern))) {
1020	if (ld > 0) {	1020	if (ld > 0) {
1021	int offset = PTR_DIFF(s,string);	1021	int offset = PTR_DIFF(s,string);
1022	char *t = Realloc(string, ls + ld + 1);	1022	char *t = SMB_REALLOC(string, ls + ld + 1);
1023	if (!t) {	1023	if (!t) {
1024	DEBUG(0, ("realloc_string_sub: out of memory!\n"));	1024	DEBUG(0, ("realloc_string_sub: out of memory!\n"));
1025	SAFE_FREE(in);	1025	SAFE_FREE(in);
Lines 1110-1116 Link Here
1110	}	1110	}
1111	}	1111	}
1112		1112
1113	r = rp = (smb_ucs2_t )malloc((lt + 1)(sizeof(smb_ucs2_t)));	1113	r = rp = SMB_MALLOC_ARRAY(smb_ucs2_t, lt + 1);
1114	if (!r) {	1114	if (!r) {
1115	DEBUG(0, ("all_string_sub_w: out of memory!\n"));	1115	DEBUG(0, ("all_string_sub_w: out of memory!\n"));
1116	return NULL;	1116	return NULL;
Lines 1478-1484 Link Here
1478	char *s;	1478	char *s;
1479	int i, j;	1479	int i, j;
1480	const char *hex = "0123456789ABCDEF";	1480	const char *hex = "0123456789ABCDEF";
1481	s = malloc(len * 3 + 1);	1481	s = SMB_MALLOC(len * 3 + 1);
1482	if (!s)	1482	if (!s)
1483	return NULL;	1483	return NULL;
1484	for (j=i=0;i<len;i++) {	1484	for (j=i=0;i<len;i++) {
Lines 1533-1539 Link Here
1533	char *ret;	1533	char *ret;
1534		1534
1535	n = strnlen(s, n);	1535	n = strnlen(s, n);
1536	ret = malloc(n+1);	1536	ret = SMB_MALLOC(n+1);
1537	if (!ret)	1537	if (!ret)
1538	return NULL;	1538	return NULL;
1539	memcpy(ret, s, n);	1539	memcpy(ret, s, n);
Lines 1573-1579 Link Here
1573		1573
1574	if (!string \|\| !*string)	1574	if (!string \|\| !*string)
1575	return NULL;	1575	return NULL;
1576	s = strdup(string);	1576	s = SMB_STRDUP(string);
1577	if (!s) {	1577	if (!s) {
1578	DEBUG(0,("str_list_make: Unable to allocate memory"));	1578	DEBUG(0,("str_list_make: Unable to allocate memory"));
1579	return NULL;	1579	return NULL;
Lines 1587-1593 Link Here
1587	while (next_token(&str, tok, sep, sizeof(tok))) {	1587	while (next_token(&str, tok, sep, sizeof(tok))) {
1588	if (num == lsize) {	1588	if (num == lsize) {
1589	lsize += S_LIST_ABS;	1589	lsize += S_LIST_ABS;
1590	rlist = (char )Realloc(list, ((sizeof(char )) * (lsize +1)));	1590	rlist = SMB_REALLOC_ARRAY(list, char *, lsize +1);
1591	if (!rlist) {	1591	if (!rlist) {
1592	DEBUG(0,("str_list_make: Unable to allocate memory"));	1592	DEBUG(0,("str_list_make: Unable to allocate memory"));
1593	str_list_free(&list);	1593	str_list_free(&list);
Lines 1598-1604 Link Here
1598	memset (&list[num], 0, ((sizeof(char*)) (S_LIST_ABS +1)));	1598	memset (&list[num], 0, ((sizeof(char*)) (S_LIST_ABS +1)));
1599	}	1599	}
1600		1600
1601	list[num] = strdup(tok);	1601	list[num] = SMB_STRDUP(tok);
1602	if (!list[num]) {	1602	if (!list[num]) {
1603	DEBUG(0,("str_list_make: Unable to allocate memory"));	1603	DEBUG(0,("str_list_make: Unable to allocate memory"));
1604	str_list_free(&list);	1604	str_list_free(&list);
Lines 1628-1634 Link Here
1628	while (src[num]) {	1628	while (src[num]) {
1629	if (num == lsize) {	1629	if (num == lsize) {
1630	lsize += S_LIST_ABS;	1630	lsize += S_LIST_ABS;
1631	rlist = (char )Realloc(list, ((sizeof(char )) * (lsize +1)));	1631	rlist = SMB_REALLOC_ARRAY(list, char *, lsize +1);
1632	if (!rlist) {	1632	if (!rlist) {
1633	DEBUG(0,("str_list_copy: Unable to re-allocate memory"));	1633	DEBUG(0,("str_list_copy: Unable to re-allocate memory"));
1634	str_list_free(&list);	1634	str_list_free(&list);
Lines 1638-1644 Link Here
1638	memset (&list[num], 0, ((sizeof(char *)) (S_LIST_ABS +1)));	1638	memset (&list[num], 0, ((sizeof(char *)) (S_LIST_ABS +1)));
1639	}	1639	}
1640		1640
1641	list[num] = strdup(src[num]);	1641	list[num] = SMB_STRDUP(src[num]);
1642	if (!list[num]) {	1642	if (!list[num]) {
1643	DEBUG(0,("str_list_copy: Unable to allocate memory"));	1643	DEBUG(0,("str_list_copy: Unable to allocate memory"));
1644	str_list_free(&list);	1644	str_list_free(&list);
Lines 1740-1746 Link Here
1740	t = *list;	1740	t = *list;
1741	d = p -t;	1741	d = p -t;
1742	if (ld) {	1742	if (ld) {
1743	t = (char *) malloc(ls +ld +1);	1743	t = (char *) SMB_MALLOC(ls +ld +1);
1744	if (!t) {	1744	if (!t) {
1745	DEBUG(0,("str_list_substitute: Unable to allocate memory"));	1745	DEBUG(0,("str_list_substitute: Unable to allocate memory"));
1746	return False;	1746	return False;
Lines 1863-1869 Link Here
1863	return 0;	1863	return 0;
1864		1864
1865	count = count_chars(ipstr_list, IPSTR_LIST_CHAR) + 1;	1865	count = count_chars(ipstr_list, IPSTR_LIST_CHAR) + 1;
1866	if ( (ip_list = (struct ip_service)malloc(count * sizeof(struct ip_service))) == NULL ) {	1866	if ( (*ip_list = SMB_MALLOC_ARRAY(struct ip_service, count)) == NULL ) {
1867	DEBUG(0,("ipstr_list_parse: malloc failed for %lu entries\n", (unsigned long)count));	1867	DEBUG(0,("ipstr_list_parse: malloc failed for %lu entries\n", (unsigned long)count));
1868	return 0;	1868	return 0;
1869	}	1869	}
Lines 2011-2017 Link Here
2011	size_t out_cnt = 0;	2011	size_t out_cnt = 0;
2012	size_t len = data.length;	2012	size_t len = data.length;
2013	size_t output_len = data.length * 2;	2013	size_t output_len = data.length * 2;
2014	char result = malloc(output_len); / get us plenty of space */	2014	char result = SMB_MALLOC(output_len); / get us plenty of space */
2015		2015
2016	while (len-- && out_cnt < (data.length * 2) - 5) {	2016	while (len-- && out_cnt < (data.length * 2) - 5) {
2017	int c = (unsigned char) *(data.data++);	2017	int c = (unsigned char) *(data.data++);
Lines 2072-2082 Link Here
2072	int new_len = strlen(right) + 1;	2072	int new_len = strlen(right) + 1;
2073		2073
2074	if (*left == NULL) {	2074	if (*left == NULL) {
2075	*left = malloc(new_len);	2075	*left = SMB_MALLOC(new_len);
2076	*left[0] = '\0';	2076	*left[0] = '\0';
2077	} else {	2077	} else {
2078	new_len += strlen(*left);	2078	new_len += strlen(*left);
2079	left = Realloc(left, new_len);	2079	left = SMB_REALLOC(left, new_len);
2080	}	2080	}
2081		2081
2082	if (*left == NULL)	2082	if (*left == NULL)

Lines 61-67 Link Here

(-)samba-3.0.9-orig/source/lib/util_unistr.c (-7 / +7 lines)
61	not available */	61	not available */
62	if (!upcase_table) {	62	if (!upcase_table) {
63	DEBUG(1,("creating lame upcase table\n"));	63	DEBUG(1,("creating lame upcase table\n"));
64	upcase_table = malloc(0x20000);	64	upcase_table = SMB_MALLOC(0x20000);
65	for (i=0;i<0x10000;i++) {	65	for (i=0;i<0x10000;i++) {
66	smb_ucs2_t v;	66	smb_ucs2_t v;
67	SSVAL(&v, 0, i);	67	SSVAL(&v, 0, i);
Lines 76-82 Link Here
76		76
77	if (!lowcase_table) {	77	if (!lowcase_table) {
78	DEBUG(1,("creating lame lowcase table\n"));	78	DEBUG(1,("creating lame lowcase table\n"));
79	lowcase_table = malloc(0x20000);	79	lowcase_table = SMB_MALLOC(0x20000);
80	for (i=0;i<0x10000;i++) {	80	for (i=0;i<0x10000;i++) {
81	smb_ucs2_t v;	81	smb_ucs2_t v;
82	SSVAL(&v, 0, i);	82	SSVAL(&v, 0, i);
Lines 175-181 Link Here
175	if (valid_table) free(valid_table);	175	if (valid_table) free(valid_table);
176		176
177	DEBUG(2,("creating default valid table\n"));	177	DEBUG(2,("creating default valid table\n"));
178	valid_table = malloc(0x10000);	178	valid_table = SMB_MALLOC(0x10000);
179	for (i=0;i<128;i++)	179	for (i=0;i<128;i++)
180	valid_table[i] = isalnum(i) \|\| strchr(allowed,i);	180	valid_table[i] = isalnum(i) \|\| strchr(allowed,i);
181		181
Lines 302-308 Link Here
302	char *s;	302	char *s;
303	int maxlen = (str->uni_str_len+1)*4;	303	int maxlen = (str->uni_str_len+1)*4;
304	if (!str->buffer) return NULL;	304	if (!str->buffer) return NULL;
305	s = (char )talloc(ctx, maxlen); / convervative */	305	s = (char )TALLOC(ctx, maxlen); / convervative */
306	if (!s) return NULL;	306	if (!s) return NULL;
307	pull_ucs2(NULL, s, str->buffer, maxlen, str->uni_str_len*2,	307	pull_ucs2(NULL, s, str->buffer, maxlen, str->uni_str_len*2,
308	STR_NOALIGN);	308	STR_NOALIGN);
Lines 586-592 Link Here
586	smb_ucs2_t *dest;	586	smb_ucs2_t *dest;
587		587
588	if (!len) len = strlen_w(src);	588	if (!len) len = strlen_w(src);
589	dest = (smb_ucs2_t )malloc((len + 1) sizeof(smb_ucs2_t));	589	dest = SMB_MALLOC_ARRAY(smb_ucs2_t, len + 1);
590	if (!dest) {	590	if (!dest) {
591	DEBUG(0,("strdup_w: out of memory!\n"));	591	DEBUG(0,("strdup_w: out of memory!\n"));
592	return NULL;	592	return NULL;
Lines 825-836 Link Here
825		825
826	/* allocate UNISTR2 destination if not given */	826	/* allocate UNISTR2 destination if not given */
827	if (!dst) {	827	if (!dst) {
828	dst = (UNISTR2*) talloc(ctx, sizeof(UNISTR2));	828	dst = TALLOC_P(ctx, UNISTR2);
829	if (!dst)	829	if (!dst)
830	return NULL;	830	return NULL;
831	}	831	}
832	if (!dst->buffer) {	832	if (!dst->buffer) {
833	dst->buffer = (uint16) talloc(ctx, sizeof(uint16) (len + 1));	833	dst->buffer = TALLOC_ARRAY(ctx, uint16, len + 1);
834	if (!dst->buffer)	834	if (!dst->buffer)
835	return NULL;	835	return NULL;
836	}	836	}

Lines 72-79 Link Here

(-)samba-3.0.9-orig/source/lib/wins_srv.c (-6 / +6 lines)
72	{	72	{
73	char keystr = NULL, wins_ip_addr = NULL, *src_ip_addr = NULL;	73	char keystr = NULL, wins_ip_addr = NULL, *src_ip_addr = NULL;
74		74
75	wins_ip_addr = strdup(inet_ntoa(wins_ip));	75	wins_ip_addr = SMB_STRDUP(inet_ntoa(wins_ip));
76	src_ip_addr = strdup(inet_ntoa(src_ip));	76	src_ip_addr = SMB_STRDUP(inet_ntoa(src_ip));
77		77
78	if ( !wins_ip_addr \|\| !src_ip_addr ) {	78	if ( !wins_ip_addr \|\| !src_ip_addr ) {
79	DEBUG(0,("wins_srv_keystr: malloc error\n"));	79	DEBUG(0,("wins_srv_keystr: malloc error\n"));
Lines 212-220 Link Here
212	if (lp_wins_support()) {	212	if (lp_wins_support()) {
213	/* give the caller something to chew on. This makes	213	/* give the caller something to chew on. This makes
214	the rest of the logic simpler (ie. less special cases) */	214	the rest of the logic simpler (ie. less special cases) */
215	ret = (char *)malloc(sizeof(char )*2);	215	ret = SMB_MALLOC_ARRAY(char *, 2);
216	if (!ret) return NULL;	216	if (!ret) return NULL;
217	ret[0] = strdup("*");	217	ret[0] = SMB_STRDUP("*");
218	ret[1] = NULL;	218	ret[1] = NULL;
219	return ret;	219	return ret;
220	}	220	}
Lines 242-249 Link Here
242	}	242	}
243		243
244	/* add it to the list */	244	/* add it to the list */
245	ret = (char *)Realloc(ret, (count+2) sizeof(char *));	245	ret = SMB_REALLOC_ARRAY(ret, char *, count+2);
246	ret[count] = strdup(t_ip.tag);	246	ret[count] = SMB_STRDUP(t_ip.tag);
247	if (!ret[count]) break;	247	if (!ret[count]) break;
248	count++;	248	count++;
249	}	249	}

Lines 31-37 Link Here

(-)samba-3.0.9-orig/source/libads/ads_struct.c (-6 / +6 lines)
31	char *ret;	31	char *ret;
32	int len;	32	int len;
33		33
34	r = strdup(realm);	34	r = SMB_STRDUP(realm);
35		35
36	if (!r \|\| !*r)	36	if (!r \|\| !*r)
37	return r;	37	return r;
Lines 42-48 Link Here
42		42
43	len = (numbits+1)*(strlen(field)+1) + strlen(r) + 1;	43	len = (numbits+1)*(strlen(field)+1) + strlen(r) + 1;
44		44
45	ret = malloc(len);	45	ret = SMB_MALLOC(len);
46	if (!ret)	46	if (!ret)
47	return NULL;	47	return NULL;
48		48
Lines 87-98 Link Here
87	{	87	{
88	ADS_STRUCT *ads;	88	ADS_STRUCT *ads;
89		89
90	ads = (ADS_STRUCT )smb_xmalloc(sizeof(ads));	90	ads = SMB_XMALLOC_P(ADS_STRUCT);
91	ZERO_STRUCTP(ads);	91	ZERO_STRUCTP(ads);
92		92
93	ads->server.realm = realm? strdup(realm) : NULL;	93	ads->server.realm = realm? SMB_STRDUP(realm) : NULL;
94	ads->server.workgroup = workgroup ? strdup(workgroup) : NULL;	94	ads->server.workgroup = workgroup ? SMB_STRDUP(workgroup) : NULL;
95	ads->server.ldap_server = ldap_server? strdup(ldap_server) : NULL;	95	ads->server.ldap_server = ldap_server? SMB_STRDUP(ldap_server) : NULL;
96		96
97	/* we need to know if this is a foreign realm */	97	/* we need to know if this is a foreign realm */
98	if (realm && *realm && !strequal(lp_realm(), realm)) {	98	if (realm && *realm && !strequal(lp_realm(), realm)) {

Lines 59-65 Link Here

(-)samba-3.0.9-orig/source/libads/authdata.c (-22 / +12 lines)
59	return False;	59	return False;
60		60
61	if (UNMARSHALLING(ps) && type_10->len) {	61	if (UNMARSHALLING(ps) && type_10->len) {
62	type_10->username = (uint16 *) prs_alloc_mem(ps, type_10->len);	62	type_10->username = PRS_ALLOC_MEM(ps, uint16, type_10->len);
63	if (!type_10->username) {	63	if (!type_10->username) {
64	DEBUG(3, ("No memory available\n"));	64	DEBUG(3, ("No memory available\n"));
65	return False;	65	return False;
Lines 85-92 Link Here
85	depth++;	85	depth++;
86		86
87	if (UNMARSHALLING(ps)) {	87	if (UNMARSHALLING(ps)) {
88	sid_and_attr->sid =	88	sid_and_attr->sid = PRS_ALLOC_MEM(ps, DOM_SID2, 1);
89	(DOM_SID2 * ) prs_alloc_mem(ps, sizeof(DOM_SID2));
90	if (!sid_and_attr->sid) {	89	if (!sid_and_attr->sid) {
91	DEBUG(3, ("No memory available\n"));	90	DEBUG(3, ("No memory available\n"));
92	return False;	91	return False;
Lines 135-142 Link Here
135	return False;	134	return False;
136		135
137	if (UNMARSHALLING(ps)) {	136	if (UNMARSHALLING(ps)) {
138	array->krb_sid_and_attrs = (KRB_SID_AND_ATTRS *)	137	array->krb_sid_and_attrs = PRS_ALLOC_MEM(ps, KRB_SID_AND_ATTRS, num);
139	prs_alloc_mem(ps, sizeof(KRB_SID_AND_ATTRS) * num);
140	if (!array->krb_sid_and_attrs) {	138	if (!array->krb_sid_and_attrs) {
141	DEBUG(3, ("No memory available\n"));	139	DEBUG(3, ("No memory available\n"));
142	return False;	140	return False;
Lines 199-206 Link Here
199	return False;	197	return False;
200		198
201	if (UNMARSHALLING(ps)) {	199	if (UNMARSHALLING(ps)) {
202	array->group_membership = (GROUP_MEMBERSHIP *)	200	array->group_membership = PRS_ALLOC_MEM(ps, GROUP_MEMBERSHIP, num);
203	prs_alloc_mem(ps, sizeof(GROUP_MEMBERSHIP) * num);
204	if (!array->group_membership) {	201	if (!array->group_membership) {
205	DEBUG(3, ("No memory available\n"));	202	DEBUG(3, ("No memory available\n"));
206	return False;	203	return False;
Lines 423-429 Link Here
423	if (!prs_uint32("type", ps, depth, &data->type))	420	if (!prs_uint32("type", ps, depth, &data->type))
424	return False;	421	return False;
425	if (UNMARSHALLING(ps)) {	422	if (UNMARSHALLING(ps)) {
426	data->signature = (unsigned char *)prs_alloc_mem(ps, siglen);	423	data->signature = PRS_ALLOC_MEM(ps, unsigned char, siglen);
427	if (!data->signature) {	424	if (!data->signature) {
428	DEBUG(3, ("No memory available\n"));	425	DEBUG(3, ("No memory available\n"));
429	return False;	426	return False;
Lines 454-461 Link Here
454	}	451	}
455		452
456	if (UNMARSHALLING(ps) && hdr->size > 0) {	453	if (UNMARSHALLING(ps) && hdr->size > 0) {
457	hdr->ctr = (PAC_INFO_CTR *)	454	hdr->ctr = PRS_ALLOC_MEM(ps, PAC_INFO_CTR, 1);
458	prs_alloc_mem(ps, sizeof(PAC_INFO_CTR));
459	if (!hdr->ctr) {	455	if (!hdr->ctr) {
460	DEBUG(3, ("No memory available\n"));	456	DEBUG(3, ("No memory available\n"));
461	return False;	457	return False;
Lines 466-473 Link Here
466	case PAC_TYPE_LOGON_INFO:	462	case PAC_TYPE_LOGON_INFO:
467	DEBUG(5, ("PAC_TYPE_LOGON_INFO\n"));	463	DEBUG(5, ("PAC_TYPE_LOGON_INFO\n"));
468	if (UNMARSHALLING(ps))	464	if (UNMARSHALLING(ps))
469	hdr->ctr->pac.logon_info = (PAC_LOGON_INFO *)	465	hdr->ctr->pac.logon_info = PRS_ALLOC_MEM(ps, PAC_LOGON_INFO, 1);
470	prs_alloc_mem(ps, sizeof(PAC_LOGON_INFO));
471	if (!hdr->ctr->pac.logon_info) {	466	if (!hdr->ctr->pac.logon_info) {
472	DEBUG(3, ("No memory available\n"));	467	DEBUG(3, ("No memory available\n"));
473	return False;	468	return False;
Lines 480-487 Link Here
480	case PAC_TYPE_SERVER_CHECKSUM:	475	case PAC_TYPE_SERVER_CHECKSUM:
481	DEBUG(5, ("PAC_TYPE_SERVER_CHECKSUM\n"));	476	DEBUG(5, ("PAC_TYPE_SERVER_CHECKSUM\n"));
482	if (UNMARSHALLING(ps))	477	if (UNMARSHALLING(ps))
483	hdr->ctr->pac.srv_cksum = (PAC_SIGNATURE_DATA *)	478	hdr->ctr->pac.srv_cksum = PRS_ALLOC_MEM(ps, PAC_SIGNATURE_DATA, 1);
484	prs_alloc_mem(ps, sizeof(PAC_SIGNATURE_DATA));
485	if (!hdr->ctr->pac.srv_cksum) {	479	if (!hdr->ctr->pac.srv_cksum) {
486	DEBUG(3, ("No memory available\n"));	480	DEBUG(3, ("No memory available\n"));
487	return False;	481	return False;
Lines 494-501 Link Here
494	case PAC_TYPE_PRIVSVR_CHECKSUM:	488	case PAC_TYPE_PRIVSVR_CHECKSUM:
495	DEBUG(5, ("PAC_TYPE_PRIVSVR_CHECKSUM\n"));	489	DEBUG(5, ("PAC_TYPE_PRIVSVR_CHECKSUM\n"));
496	if (UNMARSHALLING(ps))	490	if (UNMARSHALLING(ps))
497	hdr->ctr->pac.privsrv_cksum = (PAC_SIGNATURE_DATA *)	491	hdr->ctr->pac.privsrv_cksum = PRS_ALLOC_MEM(ps, PAC_SIGNATURE_DATA, 1);
498	prs_alloc_mem(ps, sizeof(PAC_SIGNATURE_DATA));
499	if (!hdr->ctr->pac.privsrv_cksum) {	492	if (!hdr->ctr->pac.privsrv_cksum) {
500	DEBUG(3, ("No memory available\n"));	493	DEBUG(3, ("No memory available\n"));
501	return False;	494	return False;
Lines 509-516 Link Here
509	case PAC_TYPE_UNKNOWN_10:	502	case PAC_TYPE_UNKNOWN_10:
510	DEBUG(5, ("PAC_TYPE_UNKNOWN_10\n"));	503	DEBUG(5, ("PAC_TYPE_UNKNOWN_10\n"));
511	if (UNMARSHALLING(ps))	504	if (UNMARSHALLING(ps))
512	hdr->ctr->pac.type_10 = (UNKNOWN_TYPE_10 *)	505	hdr->ctr->pac.type_10 = PRS_ALLOC_MEM(ps, UNKNOWN_TYPE_10, 1);
513	prs_alloc_mem(ps, sizeof(UNKNOWN_TYPE_10));
514	if (!hdr->ctr->pac.type_10) {	506	if (!hdr->ctr->pac.type_10) {
515	DEBUG(3, ("No memory available\n"));	507	DEBUG(3, ("No memory available\n"));
516	return False;	508	return False;
Lines 571-579 Link Here
571	return False;	563	return False;
572		564
573	if (UNMARSHALLING(ps) && data->num_buffers > 0) {	565	if (UNMARSHALLING(ps) && data->num_buffers > 0) {
574	if ((data->pac_info_hdr_ptr = (PAC_INFO_HDR *)	566	if ((data->pac_info_hdr_ptr = PRS_ALLOC_MEM(ps, PAC_INFO_HDR, data->num_buffers)) == NULL) {
575	prs_alloc_mem(ps, sizeof(PAC_INFO_HDR) *
576	data->num_buffers)) == NULL) {
577	return False;	567	return False;
578	}	568	}
579	}	569	}
Lines 606-612 Link Here
606		596
607	data_blob_free(&pac_data_blob);	597	data_blob_free(&pac_data_blob);
608		598
609	pac_data = (PAC_DATA *) talloc_zero(ctx, sizeof(PAC_DATA));	599	pac_data = TALLOC_ZERO_P(ctx, PAC_DATA);
610	pac_io_pac_data("pac data", pac_data, &ps, 0);	600	pac_io_pac_data("pac data", pac_data, &ps, 0);
611		601
612	prs_mem_free(&ps);	602	prs_mem_free(&ps);

Lines 54-60 Link Here

(-)samba-3.0.9-orig/source/libads/krb5_setpw.c (-4 / +4 lines)
54	DATA_BLOB ret;	54	DATA_BLOB ret;
55		55
56		56
57	princ = strdup(principal);	57	princ = SMB_STRDUP(principal);
58		58
59	if ((c = strchr_m(princ, '/')) == NULL) {	59	if ((c = strchr_m(princ, '/')) == NULL) {
60	c = princ;	60	c = princ;
Lines 156-162 Link Here
156	return ret;	156	return ret;
157	}	157	}
158		158
159	packet->data = (char *)malloc(ap_req->length + cipherpw.length + 6);	159	packet->data = (char *)SMB_MALLOC(ap_req->length + cipherpw.length + 6);
160	if (!packet->data)	160	if (!packet->data)
161	return -1;	161	return -1;
162		162
Lines 407-413 Link Here
407	free(chpw_req.data);	407	free(chpw_req.data);
408		408
409	chpw_rep.length = 1500;	409	chpw_rep.length = 1500;
410	chpw_rep.data = (char *) malloc(chpw_rep.length);	410	chpw_rep.data = (char *) SMB_MALLOC(chpw_rep.length);
411	if (!chpw_rep.data) {	411	if (!chpw_rep.data) {
412	close(sock);	412	close(sock);
413	free(ap_req.data);	413	free(ap_req.data);
Lines 631-637 Link Here
631	/* We have to obtain an INITIAL changepw ticket for changing password */	631	/* We have to obtain an INITIAL changepw ticket for changing password */
632	asprintf(&chpw_princ, "kadmin/changepw@%s",	632	asprintf(&chpw_princ, "kadmin/changepw@%s",
633	(char *) krb5_princ_realm(context, princ));	633	(char *) krb5_princ_realm(context, princ));
634	password = strdup(oldpw);	634	password = SMB_STRDUP(oldpw);
635	ret = krb5_get_init_creds_password(context, &creds, princ, password,	635	ret = krb5_get_init_creds_password(context, &creds, princ, password,
636	kerb_prompter, NULL,	636	kerb_prompter, NULL,
637	0, chpw_princ, &opts);	637	0, chpw_princ, &opts);

Lines 85-91 Link Here

(-)samba-3.0.9-orig/source/libads/ldap.c (-30 / +30 lines)
85	DEBUG(5,("ads_try_connect: trying ldap server '%s' port %u\n", server, port));	85	DEBUG(5,("ads_try_connect: trying ldap server '%s' port %u\n", server, port));
86		86
87	/* this copes with inet_ntoa brokenness */	87	/* this copes with inet_ntoa brokenness */
88	srv = strdup(server);	88	srv = SMB_STRDUP(server);
89		89
90	ads->ld = ldap_open_with_timeout(srv, port, lp_ldap_timeout());	90	ads->ld = ldap_open_with_timeout(srv, port, lp_ldap_timeout());
91	if (!ads->ld) {	91	if (!ads->ld) {
Lines 262-272 Link Here
262	}	262	}
263		263
264	if (!ads->auth.realm) {	264	if (!ads->auth.realm) {
265	ads->auth.realm = strdup(ads->config.realm);	265	ads->auth.realm = SMB_STRDUP(ads->config.realm);
266	}	266	}
267		267
268	if (!ads->auth.kdc_server) {	268	if (!ads->auth.kdc_server) {
269	ads->auth.kdc_server = strdup(inet_ntoa(ads->ldap_ip));	269	ads->auth.kdc_server = SMB_STRDUP(inet_ntoa(ads->ldap_ip));
270	}	270	}
271		271
272	#if KRB5_DNS_HACK	272	#if KRB5_DNS_HACK
Lines 304-316 Link Here
304		304
305	if (!in_val) return NULL;	305	if (!in_val) return NULL;
306		306
307	value = talloc_zero(ctx, sizeof(struct berval));	307	value = TALLOC_ZERO_P(ctx, struct berval);
308	if (value == NULL)	308	if (value == NULL)
309	return NULL;	309	return NULL;
310	if (in_val->bv_len == 0) return value;	310	if (in_val->bv_len == 0) return value;
311		311
312	value->bv_len = in_val->bv_len;	312	value->bv_len = in_val->bv_len;
313	value->bv_val = talloc_memdup(ctx, in_val->bv_val, in_val->bv_len);	313	value->bv_val = TALLOC_MEMDUP(ctx, in_val->bv_val, in_val->bv_len);
314	return value;	314	return value;
315	}	315	}
316		316
Lines 324-332 Link Here
324	int i;	324	int i;
325		325
326	if (!in_vals) return NULL;	326	if (!in_vals) return NULL;
327	for (i=0; in_vals[i]; i++); /* count values */	327	for (i=0; in_vals[i]; i++)
328	values = (struct berval **) talloc_zero(ctx,	328	; /* count values */
329	(i+1)sizeof(struct berval ));	329	values = TALLOC_ZERO_ARRAY(ctx, struct berval *, i+1);
330	if (!values) return NULL;	330	if (!values) return NULL;
331		331
332	for (i=0; in_vals[i]; i++) {	332	for (i=0; in_vals[i]; i++) {
Lines 344-351 Link Here
344	int i;	344	int i;
345		345
346	if (!in_vals) return NULL;	346	if (!in_vals) return NULL;
347	for (i=0; in_vals[i]; i++); /* count values */	347	for (i=0; in_vals[i]; i++)
348	values = (char ** ) talloc_zero(ctx, (i+1)sizeof(char ));	348	; /* count values */
		349	values = TALLOC_ZERO_ARRAY(ctx, char *, i+1);
349	if (!values) return NULL;	350	if (!values) return NULL;
350		351
351	for (i=0; in_vals[i]; i++) {	352	for (i=0; in_vals[i]; i++) {
Lines 363-370 Link Here
363	int i;	364	int i;
364		365
365	if (!in_vals) return NULL;	366	if (!in_vals) return NULL;
366	for (i=0; in_vals[i]; i++); /* count values */	367	for (i=0; in_vals[i]; i++)
367	values = (char *) talloc_zero(ctx, (i+1)sizeof(char *));	368	; /* count values */
		369	values = TALLOC_ZERO_ARRAY(ctx, char *, i+1);
368	if (!values) return NULL;	370	if (!values) return NULL;
369		371
370	for (i=0; in_vals[i]; i++) {	372	for (i=0; in_vals[i]; i++) {
Lines 787-794 Link Here
787	#define ADS_MODLIST_ALLOC_SIZE 10	789	#define ADS_MODLIST_ALLOC_SIZE 10
788	LDAPMod **mods;	790	LDAPMod **mods;
789		791
790	if ((mods = (LDAPMod *) talloc_zero(ctx, sizeof(LDAPMod ) *	792	if ((mods = TALLOC_ZERO_ARRAY(ctx, LDAPMod *, ADS_MODLIST_ALLOC_SIZE + 1)))
791	(ADS_MODLIST_ALLOC_SIZE + 1))))
792	/* -1 is safety to make sure we don't go over the end.	793	/* -1 is safety to make sure we don't go over the end.
793	need to reset it to NULL before doing ldap modify */	794	need to reset it to NULL before doing ldap modify */
794	mods[ADS_MODLIST_ALLOC_SIZE] = (LDAPMod *) -1;	795	mods[ADS_MODLIST_ALLOC_SIZE] = (LDAPMod *) -1;
Lines 824-831 Link Here
824	for (curmod=0; modlist[curmod] && modlist[curmod] != (LDAPMod *) -1;	825	for (curmod=0; modlist[curmod] && modlist[curmod] != (LDAPMod *) -1;
825	curmod++);	826	curmod++);
826	if (modlist[curmod] == (LDAPMod *) -1) {	827	if (modlist[curmod] == (LDAPMod *) -1) {
827	if (!(modlist = talloc_realloc(ctx, modlist,	828	if (!(modlist = TALLOC_REALLOC_ARRAY(ctx, modlist, LDAPMod *,
828	(curmod+ADS_MODLIST_ALLOC_SIZE+1)sizeof(LDAPMod ))))	829	curmod+ADS_MODLIST_ALLOC_SIZE+1)))
829	return ADS_ERROR(LDAP_NO_MEMORY);	830	return ADS_ERROR(LDAP_NO_MEMORY);
830	memset(&modlist[curmod], 0,	831	memset(&modlist[curmod], 0,
831	ADS_MODLIST_ALLOC_SIZEsizeof(LDAPMod ));	832	ADS_MODLIST_ALLOC_SIZEsizeof(LDAPMod ));
Lines 833-839 Link Here
833	*mods = modlist;	834	*mods = modlist;
834	}	835	}
835		836
836	if (!(modlist[curmod] = talloc_zero(ctx, sizeof(LDAPMod))))	837	if (!(modlist[curmod] = TALLOC_ZERO_P(ctx, LDAPMod)))
837	return ADS_ERROR(LDAP_NO_MEMORY);	838	return ADS_ERROR(LDAP_NO_MEMORY);
838	modlist[curmod]->mod_type = talloc_strdup(ctx, name);	839	modlist[curmod]->mod_type = talloc_strdup(ctx, name);
839	if (mod_op & LDAP_MOD_BVALUES) {	840	if (mod_op & LDAP_MOD_BVALUES) {
Lines 1009-1019 Link Here
1009	ret = ads_default_ou_string(ads, WELL_KNOWN_GUID_COMPUTERS);	1010	ret = ads_default_ou_string(ads, WELL_KNOWN_GUID_COMPUTERS);
1010		1011
1011	/* samba4 might not yet respond to a wellknownobject-query */	1012	/* samba4 might not yet respond to a wellknownobject-query */
1012	return ret ? ret : strdup("cn=Computers");	1013	return ret ? ret : SMB_STRDUP("cn=Computers");
1013	}	1014	}
1014		1015
1015	if (strequal(org_unit, "Computers")) {	1016	if (strequal(org_unit, "Computers")) {
1016	return strdup("cn=Computers");	1017	return SMB_STRDUP("cn=Computers");
1017	}	1018	}
1018		1019
1019	return ads_build_path(org_unit, "\\/", "ou=", 1);	1020	return ads_build_path(org_unit, "\\/", "ou=", 1);
Lines 1070-1076 Link Here
1070	for (i=1; i < new_ln; i++) {	1071	for (i=1; i < new_ln; i++) {
1071	char *s;	1072	char *s;
1072	asprintf(&s, "%s,%s", ret, wkn_dn_exp[i]);	1073	asprintf(&s, "%s,%s", ret, wkn_dn_exp[i]);
1073	ret = strdup(s);	1074	ret = SMB_STRDUP(s);
1074	free(s);	1075	free(s);
1075	}	1076	}
1076		1077
Lines 1704-1710 Link Here
1704	char *machine;	1705	char *machine;
1705		1706
1706	/* machine name must be lowercase */	1707	/* machine name must be lowercase */
1707	machine = strdup(machine_name);	1708	machine = SMB_STRDUP(machine_name);
1708	strlower_m(machine);	1709	strlower_m(machine);
1709		1710
1710	/*	1711	/*
Lines 1754-1760 Link Here
1754	int rc;	1755	int rc;
1755		1756
1756	/* hostname must be lowercase */	1757	/* hostname must be lowercase */
1757	host = strdup(hostname);	1758	host = SMB_STRDUP(hostname);
1758	strlower_m(host);	1759	strlower_m(host);
1759		1760
1760	status = ads_find_machine_acct(ads, &res, host);	1761	status = ads_find_machine_acct(ads, &res, host);
Lines 1878-1884 Link Here
1878	if (!(mods = ads_init_mods(ctx))) return ADS_ERROR(LDAP_NO_MEMORY);	1879	if (!(mods = ads_init_mods(ctx))) return ADS_ERROR(LDAP_NO_MEMORY);
1879		1880
1880	bval.bv_len = prs_offset(&ps_wire);	1881	bval.bv_len = prs_offset(&ps_wire);
1881	bval.bv_val = talloc(ctx, bval.bv_len);	1882	bval.bv_val = TALLOC(ctx, bval.bv_len);
1882	if (!bval.bv_val) {	1883	if (!bval.bv_val) {
1883	ret = ADS_ERROR(LDAP_NO_MEMORY);	1884	ret = ADS_ERROR(LDAP_NO_MEMORY);
1884	goto ads_set_sd_error;	1885	goto ads_set_sd_error;
Lines 1978-1984 Link Here
1978		1979
1979	*num_values = ldap_count_values(values);	1980	*num_values = ldap_count_values(values);
1980		1981
1981	ret = talloc(mem_ctx, sizeof(char ) (*num_values+1));	1982	ret = TALLOC_ARRAY(mem_ctx, char , num_values + 1);
1982	if (!ret) {	1983	if (!ret) {
1983	ldap_value_free(values);	1984	ldap_value_free(values);
1984	return NULL;	1985	return NULL;
Lines 2089-2097 Link Here
2089	return NULL;	2090	return NULL;
2090	}	2091	}
2091		2092
2092	strings = talloc_realloc(mem_ctx, current_strings,	2093	strings = TALLOC_REALLOC_ARRAY(mem_ctx, current_strings, char *,
2093	sizeof(current_strings)	2094	*num_strings + num_new_strings);
2094	(*num_strings + num_new_strings));
2095		2095
2096	if (strings == NULL) {	2096	if (strings == NULL) {
2097	ldap_memfree(range_attr);	2097	ldap_memfree(range_attr);
Lines 2228-2234 Link Here
2228	for (i=0; values[i]; i++)	2228	for (i=0; values[i]; i++)
2229	/* nop */ ;	2229	/* nop */ ;
2230		2230
2231	(sids) = talloc(mem_ctx, sizeof(DOM_SID) i);	2231	(*sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, i);
2232	if (!(*sids)) {	2232	if (!(*sids)) {
2233	ldap_value_free_len(values);	2233	ldap_value_free_len(values);
2234	return 0;	2234	return 0;
Lines 2409-2415 Link Here
2409		2409
2410	SAFE_FREE(ads->config.ldap_server_name);	2410	SAFE_FREE(ads->config.ldap_server_name);
2411		2411
2412	ads->config.ldap_server_name = strdup(p+1);	2412	ads->config.ldap_server_name = SMB_STRDUP(p+1);
2413	p = strchr(ads->config.ldap_server_name, '$');	2413	p = strchr(ads->config.ldap_server_name, '$');
2414	if (!p \|\| p[1] != '@') {	2414	if (!p \|\| p[1] != '@') {
2415	talloc_destroy(ctx);	2415	talloc_destroy(ctx);
Lines 2424-2430 Link Here
2424	SAFE_FREE(ads->config.realm);	2424	SAFE_FREE(ads->config.realm);
2425	SAFE_FREE(ads->config.bind_path);	2425	SAFE_FREE(ads->config.bind_path);
2426		2426
2427	ads->config.realm = strdup(p+2);	2427	ads->config.realm = SMB_STRDUP(p+2);
2428	ads->config.bind_path = ads_build_dn(ads->config.realm);	2428	ads->config.bind_path = ads_build_dn(ads->config.realm);
2429		2429
2430	DEBUG(3,("got ldap server name %s@%s, using bind path: %s\n",	2430	DEBUG(3,("got ldap server name %s@%s, using bind path: %s\n",

Lines 32-38 Link Here

(-)samba-3.0.9-orig/source/libsmb/asn1.c (-5 / +5 lines)
32	if (data->has_error) return False;	32	if (data->has_error) return False;
33	if (data->length < data->ofs+len) {	33	if (data->length < data->ofs+len) {
34	uint8 *newp;	34	uint8 *newp;
35	newp = Realloc(data->data, data->ofs+len);	35	newp = SMB_REALLOC(data->data, data->ofs+len);
36	if (!newp) {	36	if (!newp) {
37	SAFE_FREE(data->data);	37	SAFE_FREE(data->data);
38	data->has_error = True;	38	data->has_error = True;
Lines 58-64 Link Here
58	struct nesting *nesting;	58	struct nesting *nesting;
59		59
60	asn1_write_uint8(data, tag);	60	asn1_write_uint8(data, tag);
61	nesting = (struct nesting *)malloc(sizeof(struct nesting));	61	nesting = SMB_MALLOC_P(struct nesting);
62	if (!nesting) {	62	if (!nesting) {
63	data->has_error = True;	63	data->has_error = True;
64	return False;	64	return False;
Lines 255-261 Link Here
255	data->has_error = True;	255	data->has_error = True;
256	return False;	256	return False;
257	}	257	}
258	nesting = (struct nesting *)malloc(sizeof(struct nesting));	258	nesting = SMB_MALLOC_P(struct nesting);
259	if (!nesting) {	259	if (!nesting) {
260	data->has_error = True;	260	data->has_error = True;
261	return False;	261	return False;
Lines 350-356 Link Here
350		350
351	asn1_end_tag(data);	351	asn1_end_tag(data);
352		352
353	*OID = strdup(oid_str);	353	*OID = SMB_STRDUP(oid_str);
354		354
355	return !data->has_error;	355	return !data->has_error;
356	}	356	}
Lines 380-386 Link Here
380	data->has_error = True;	380	data->has_error = True;
381	return False;	381	return False;
382	}	382	}
383	*s = malloc(len+1);	383	*s = SMB_MALLOC(len+1);
384	if (! *s) {	384	if (! *s) {
385	data->has_error = True;	385	data->has_error = True;
386	return False;	386	return False;

Lines 1302-1308 Link Here

(-)samba-3.0.9-orig/source/libsmb/clifile.c (-3 / +3 lines)
1302	pstring path2;	1302	pstring path2;
1303	clistr_pull(cli, path2, p,	1303	clistr_pull(cli, path2, p,
1304	sizeof(path2), len, STR_ASCII);	1304	sizeof(path2), len, STR_ASCII);
1305	*tmp_path = strdup(path2);	1305	*tmp_path = SMB_STRDUP(path2);
1306	}	1306	}
1307		1307
1308	return SVAL(cli->inbuf,smb_vwv0);	1308	return SVAL(cli->inbuf,smb_vwv0);
Lines 1353-1359 Link Here
1353	size_t ea_namelen = strlen(ea_name);	1353	size_t ea_namelen = strlen(ea_name);
1354		1354
1355	data_len = 4 + 4 + ea_namelen + 1 + ea_len;	1355	data_len = 4 + 4 + ea_namelen + 1 + ea_len;
1356	data = malloc(data_len);	1356	data = SMB_MALLOC(data_len);
1357	if (!data) {	1357	if (!data) {
1358	return False;	1358	return False;
1359	}	1359	}
Lines 1509-1515 Link Here
1509	goto out;	1509	goto out;
1510	}	1510	}
1511		1511
1512	ea_list = (struct ea_struct )talloc(ctx, num_eassizeof(struct ea_struct));	1512	ea_list = TALLOC_ARRAY(ctx, struct ea_struct, num_eas);
1513	if (!ea_list) {	1513	if (!ea_list) {
1514	goto out;	1514	goto out;
1515	}	1515	}