Attachment 27150 Details for Bug 64119

[patch] samba2-secfix-intoverflow.diff

samba2-secfix-intoverflow.diff (text/plain), 111.99 KB, created by Thomas Biege on 2004-12-17 03:31:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-12-17 03:31:40 UTC

Size: 111.99 KB

patch

obsolete

>diff -Ebru samba-2.2.8a.orig/source/aparser/parser.c samba-2.2.8a/source/aparser/parser.c
>--- samba-2.2.8a.orig/source/aparser/parser.c	2000-06-09 04:59:49.000000000 +0200
>+++ samba-2.2.8a/source/aparser/parser.c	2004-12-16 11:59:22.000000000 +0100
>@@ -1,4 +1,6 @@
> #include "parser.h"
>+#include <limits.h>
>+
> 
> /*******************************************************************
>  Attempt, if needed, to grow a data buffer.
>@@ -44,6 +46,17 @@
> 		 * If the current buffer size is bigger than the space needed, just 
> 		 * double it, else add extra_space.
> 		 */
>+		if(ps->buffer_size >= UINT_MAX/2)
>+		{
>+			DEBUG(0,("io_grow: integer overflow detected.\n"));
>+			return False;
>+		}
>+		if(ps->buffer_size >= UINT_MAX - extra_space)
>+		{
>+			DEBUG(0,("io_grow: integer overflow detected.\n"));
>+			return False;
>+		}
>+
> 		new_size = MAX(ps->buffer_size*2, ps->buffer_size + extra_space);		
> 
> 		if ((new_data = Realloc(ps->data_p, new_size)) == NULL) {
>diff -Ebru samba-2.2.8a.orig/source/auth/pampass.c samba-2.2.8a/source/auth/pampass.c
>--- samba-2.2.8a.orig/source/auth/pampass.c	2002-02-01 23:12:42.000000000 +0100
>+++ samba-2.2.8a/source/auth/pampass.c	2004-12-16 12:02:30.000000000 +0100
>@@ -126,7 +126,7 @@
> 		return PAM_CONV_ERR;
> 	}
> 
>-	reply = malloc(sizeof(struct pam_response) * num_msg);
>+	reply = malloc_array(sizeof(struct pam_response), num_msg);
> 	if (!reply)
> 		return PAM_CONV_ERR;
> 
>@@ -286,7 +286,7 @@
> 		return PAM_CONV_ERR;
> 	}
> 
>-	reply = malloc(sizeof(struct pam_response) * num_msg);
>+	reply = malloc_array(sizeof(struct pam_response), num_msg);
> 	if (!reply) {
> 		DEBUG(0,("smb_pam_passchange_conv: malloc for reply failed!\n"));
> 		free_pw_chat(pw_chat);
>diff -Ebru samba-2.2.8a.orig/source/client/client.c samba-2.2.8a/source/client/client.c
>--- samba-2.2.8a.orig/source/client/client.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/client/client.c	2004-12-16 19:14:24.919572494 +0100
>@@ -421,6 +421,12 @@
> 	long new_end = do_list_queue_end + ((long)strlen(entry)) + 1;
> 	while (new_end > do_list_queue_size)
> 	{
>+		if(do_list_queue_size >= UINT_MAX/2)
>+		{
>+			DEBUG(0,("add_to_do_list_queue: integer overflow detected.\n"));
>+			reset_do_list_queue();
>+			return;
>+		}
> 		do_list_queue_size *= 2;
> 		DEBUG(4,("enlarging do_list_queue to %d\n",
> 			 (int)do_list_queue_size));
>@@ -2045,7 +2051,7 @@
> 	/* for words not at the start of the line fallback to filename completion */
> 	if (start) return NULL;
> 
>-	matches = (char **)malloc(sizeof(matches[0])*MAX_COMPLETIONS);
>+	matches = (char **)malloc_array(sizeof(matches[0]), MAX_COMPLETIONS);
> 	if (!matches) return NULL;
> 
> 	matches[count++] = strdup(text);
>diff -Ebru samba-2.2.8a.orig/source/client/clitar.c samba-2.2.8a/source/client/clitar.c
>--- samba-2.2.8a.orig/source/client/clitar.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/client/clitar.c	2004-12-16 20:05:26.413179795 +0100
>@@ -113,7 +113,7 @@
> 
> char tar_type='\0';
> static char **cliplist=NULL;
>-static int clipn=0;
>+static unsigned int clipn=0;
> static BOOL must_free_cliplist = False;
> 
> extern file_info def_finfo;
>@@ -157,6 +157,12 @@
> {
>   char *tmp;
> 
>+  if(size >= INT_MAX-1)
>+  {
>+	DEBUG(0, ("string_create_s: integer overflow detected."));
>+	return NULL;
>+  }
>+
>   tmp = (char *)malloc(size+1);
> 
>   if (tmp == NULL) {
>@@ -187,6 +193,12 @@
>   if (l >= NAMSIZ - 1) {
> 	  /* write a GNU tar style long header */
> 	  char *b;
>+	
>+	  if(l >= (INT_MAX - TBLOCK - 100))
>+	  {
>+		DEBUG(0,("writetarheader: integer overflow detected.\n"));
>+		exit(1);
>+	  }
> 	  b = (char *)malloc(l+TBLOCK+100);
> 	  if (!b) {
> 		  DEBUG(0,("out of memory\n"));
>@@ -388,7 +400,13 @@
> {
>   /* initialize tar buffer */
>   tbufsiz=blocksize*TBLOCK;
>-  tarbuf=malloc(tbufsiz);      /* FIXME: We might not get the buffer */
>+  tarbuf=malloc(tbufsiz);
>+
>+  if(tarbuf == NULL)
>+  {
>+	DEBUG(0,("initarbuf: out of memory.\n"));
>+	exit(-1);
>+  }
> 
>   /* reset tar buffer pointer and tar file counter and total dumped */
>   tp=0; ntarf=0; ttarf=0;
>@@ -1128,11 +1146,19 @@
> */
> static char * get_longfilename(file_info2 finfo)
> {
>-  int namesize = strlen(finfo.name) + strlen(cur_dir) + 2;
>+  size_t namesize = strlen(finfo.name) + strlen(cur_dir) + 2;
>   char *longname = malloc(namesize);
>   SMB_BIG_INT offset = 0, left = finfo.size;
>   BOOL first = True;
> 
>+  if(strlen(finfo.name) >= (UINT_MAX - strlen(cur_dir) - 2))
>+  {
>+    DEBUG(0,("get_longfilename: integer overflow detected.\n"));
>+    return NULL;
>+  }
>+  namesize = strlen(finfo.name) + strlen(cur_dir) + 2;
>+  longname = malloc(namesize);
>+
>   DEBUG(5, ("Restoring a long file name: %s\n", finfo.name));
>   DEBUG(5, ("Len = %.0f\n", (double)finfo.size));
> 
>@@ -1583,7 +1609,7 @@
>   FILE *inclusion = NULL;
>   char buf[MAXPATHLEN + 1];
>   char *inclusion_buffer = NULL;
>-  int inclusion_buffer_size = 0;
>+  size_t inclusion_buffer_size = 0;
>   int inclusion_buffer_sofar = 0;
>   char *p;
>   char *tmpstr;
>@@ -1616,6 +1642,11 @@
>     
>     if ((strlen(buf) + 1 + inclusion_buffer_sofar) >= inclusion_buffer_size) {
>       char *ib;
>+      if(inclusion_buffer_size >= UINT_MAX/2)
>+      {
>+        DEBUG(0,("read_inclusion_file: integer overflow detected.\n"));
>+        return 0;
>+      }
>       inclusion_buffer_size *= 2;
>       ib = Realloc(inclusion_buffer,inclusion_buffer_size);
>       if (! ib) {
>@@ -1628,13 +1659,24 @@
>     
>     safe_strcpy(inclusion_buffer + inclusion_buffer_sofar, buf, inclusion_buffer_size - inclusion_buffer_sofar);
>     inclusion_buffer_sofar += strlen(buf) + 1;
>+
>+    if(clipn > (UINT_MAX-1))
>+    {
>+      DEBUG(0,("read_inclusion_file: integer overflow detected.\n"));
>+      abort();
>+    }
>     clipn++;
>   }
>   fclose(inclusion);
> 
>   if (! error) {
>     /* Allocate an array of clipn + 1 char*'s for cliplist */
>-    cliplist = malloc((clipn + 1) * sizeof(char *));
>+    if(clipn > (UINT_MAX-1))
>+    {
>+      DEBUG(0,("read_inclusion_file: integer overflow detected.\n"));
>+      abort();
>+    }
>+    cliplist = malloc_array((clipn + 1), sizeof(char *));
>     if (cliplist == NULL) {
>       DEBUG(0,("failure allocating memory for cliplist\n"));
>       error = 1;
>@@ -1808,13 +1850,13 @@
>   } else if (Optind+1<argc && !tar_re_search) { /* For backwards compatibility */
>     char *tmpstr;
>     char **tmplist;
>-    int clipcount;
>+    unsigned int clipcount;
> 
>     cliplist=argv+Optind+1;
>     clipn=argc-Optind-1;
>     clipcount = clipn;
> 
>-    if ((tmplist=malloc(clipn*sizeof(char *))) == NULL) {
>+    if ((tmplist=malloc_array(clipn, sizeof(char *))) == NULL) {
>       DEBUG(0, ("Could not allocate space to process cliplist, count = %i\n", 
>                clipn)
>            );
>@@ -1848,18 +1890,18 @@
>     if ((preg = (regex_t *)malloc(65536)) == NULL) {
> 
>       DEBUG(0, ("Could not allocate buffer for regular expression search\n"));
>-      return;
>+      return 0;
> 
>     }
> 
>-    if (errcode = regcomp(preg, argv[Optind + 1], REG_EXTENDED | REG_ICASE)) {
>+    if((errcode = regcomp(preg, argv[Optind + 1], REG_EXTENDED | REG_ICASE))) {
>       char errstr[1024];
>       size_t errlen;
> 
>       errlen = regerror(errcode, preg, errstr, sizeof(errstr) - 1);
>       
>       DEBUG(0, ("Could not compile pattern buffer for re search: %s\n%s\n", argv[Optind + 1], errstr));
>-      return;
>+      return 0;
> 
>     }
> #endif
>Nur in samba-2.2.8a/source: fileusingmalloc-sorted.txt.
>diff -Ebru samba-2.2.8a.orig/source/groupdb/aliasdb.c samba-2.2.8a/source/groupdb/aliasdb.c
>--- samba-2.2.8a.orig/source/groupdb/aliasdb.c	2002-02-01 23:12:44.000000000 +0100
>+++ samba-2.2.8a/source/groupdb/aliasdb.c	2004-12-16 12:52:54.000000000 +0100
>@@ -143,6 +143,13 @@
> 	if (alss == NULL || num_alss == NULL || als == NULL)
> 		return False;
> 
>+	if( (*num_alss) == INT_MAX || ((*num_alss)+1) >= UINT_MAX/sizeof(LOCAL_GRP))
>+	{
>+		DEBUG(0,("add_domain_alias: integer overflow detected.\n"));
>+		if (*alss)
>+			 free(*alss);
>+		return False;
>+	}
> 	talss = (LOCAL_GRP *)Realloc((*alss), ((*num_alss)+1) * sizeof(LOCAL_GRP));
>     if (talss == NULL) {
> 		if (*alss)
>diff -Ebru samba-2.2.8a.orig/source/groupdb/aliasfile.c samba-2.2.8a/source/groupdb/aliasfile.c
>--- samba-2.2.8a.orig/source/groupdb/aliasfile.c	2002-02-01 23:12:45.000000000 +0100
>+++ samba-2.2.8a/source/groupdb/aliasfile.c	2004-12-16 13:14:57.000000000 +0100
>@@ -128,6 +128,14 @@
> 		DOM_SID sid;
> 		uint8 type;
> 
>+		if((*num_mem) == INT_MAX || ((*num_mem)+1) >= UINT_MAX/sizeof(LOCAL_GRP_MEMBER))
>+		{
>+			DEBUG(0,("get_alias_memebers: integer overflow detected.\n"));
>+			if (*members)
>+				free(*members);
>+			return NULL;
>+		}
>+
> 		if (lookup_sid(name, &sid, &type)) {
> 			mbrs = Realloc((*members), ((*num_mem)+1) * sizeof(LOCAL_GRP_MEMBER));
> 			(*num_mem)++;
>diff -Ebru samba-2.2.8a.orig/source/groupdb/groupdb.c samba-2.2.8a/source/groupdb/groupdb.c
>--- samba-2.2.8a.orig/source/groupdb/groupdb.c	2002-02-01 23:12:45.000000000 +0100
>+++ samba-2.2.8a/source/groupdb/groupdb.c	2004-12-16 13:18:05.000000000 +0100
>@@ -141,6 +141,14 @@
> 	if (grps == NULL || num_grps == NULL || grp == NULL)
> 		return False;
> 
>+	if((*num_grps) == INT_MAX || (*num_grps)+1 >= UINT_MAX/sizeof(DOMAIN_GRP))
>+	{
>+		DEBUG(0,("add_domain_group: integer overflow detected.\n"));
>+		if (*grps)
>+			free(*grps);
>+		return False;
>+	}
>+
> 	tgrps = (DOMAIN_GRP *)Realloc((*grps), ((*num_grps)+1) * sizeof(DOMAIN_GRP));
> 	if (tgrps == NULL) {
> 		if (*grps)
>diff -Ebru samba-2.2.8a.orig/source/groupdb/groupfile.c samba-2.2.8a/source/groupdb/groupfile.c
>--- samba-2.2.8a.orig/source/groupdb/groupfile.c	2002-02-01 23:12:45.000000000 +0100
>+++ samba-2.2.8a/source/groupdb/groupfile.c	2004-12-16 13:20:24.000000000 +0100
>@@ -129,6 +129,14 @@
> 	{
> 		DOMAIN_GRP_MEMBER *mbrs;
> 
>+		if((*num_mem) == INT_MAX || (*num_mem)+1 >= UINT_MAX/sizeof(DOMAIN_GRP_MEMBER))
>+		{
>+			DEBUG(0,("get_group_members: integer overflow detected.\n"));
>+			if (*members)
>+				free(*members);
>+			return False;
>+		}
>+
> 		mbrs = (DOMAIN_GRP_MEMBER *)Realloc((*members), ((*num_mem)+1) * sizeof(DOMAIN_GRP_MEMBER));
> 		if (mbrs == NULL) {
> 			if (*members)
>diff -Ebru samba-2.2.8a.orig/source/include/includes.h samba-2.2.8a/source/include/includes.h
>--- samba-2.2.8a.orig/source/include/includes.h	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/include/includes.h	2004-12-16 12:05:14.000000000 +0100
>@@ -145,6 +145,9 @@
> 
> #ifdef HAVE_LIMITS_H
> #include <limits.h>
>+#else
>+#define UINT_MAX	4294967295U
>+#define INT_MAX		2147483647
> #endif
> 
> #ifdef HAVE_SYS_IOCTL_H
>diff -Ebru samba-2.2.8a.orig/source/include/proto.h samba-2.2.8a/source/include/proto.h
>--- samba-2.2.8a.orig/source/include/proto.h	2004-12-15 11:43:53.000000000 +0100
>+++ samba-2.2.8a/source/include/proto.h	2004-12-16 18:00:12.000000000 +0100
>@@ -444,12 +444,14 @@
> 
> TALLOC_CTX *talloc_init(void);
> void *talloc(TALLOC_CTX *t, size_t size);
>+void *talloc_array(TALLOC_CTX *ctx, size_t el_size, unsigned int count);
> void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size);
> void talloc_destroy_pool(TALLOC_CTX *t);
> void talloc_destroy(TALLOC_CTX *t);
> size_t talloc_pool_size(TALLOC_CTX *t);
> const char * talloc_pool_name(TALLOC_CTX const *t);
> void *talloc_zero(TALLOC_CTX *t, size_t size);
>+void *talloc_zero_array(TALLOC_CTX *t, size_t el_size, unsigned int count);
> void *talloc_memdup(TALLOC_CTX *t, const void *p, size_t size);
> char *talloc_strdup(TALLOC_CTX *t, const char *p);
> char *talloc_describe_all(TALLOC_CTX *rt);
>@@ -501,6 +503,9 @@
> 
> /* The following definitions come from lib/util.c  */
> 
>+void *malloc_array(size_t el_size, unsigned int count);
>+void *calloc_array(size_t size, size_t nmemb);
>+void *realloc_array(void *p,size_t el_size, unsigned int count);
> const char *tmpdir(void);
> BOOL in_group(gid_t group, gid_t current_gid, int ngroups, gid_t *groups);
> const char *Atoic(const char *p, int *n, const char *c);
>diff -Ebru samba-2.2.8a.orig/source/lib/bitmap.c samba-2.2.8a/source/lib/bitmap.c
>--- samba-2.2.8a.orig/source/lib/bitmap.c	2002-02-01 23:13:10.000000000 +0100
>+++ samba-2.2.8a/source/lib/bitmap.c	2004-12-16 13:21:24.000000000 +0100
>@@ -37,7 +37,7 @@
> 	if (!bm) return NULL;
> 	
> 	bm->n = n;
>-	bm->b = (uint32 *)malloc(sizeof(bm->b[0])*(n+31)/32);
>+	bm->b = (uint32 *)malloc_array(sizeof(bm->b[0]), (n+31)/32);
> 	if (!bm->b) {
> 		SAFE_FREE(bm);
> 		return NULL;
>diff -Ebru samba-2.2.8a.orig/source/lib/hash.c samba-2.2.8a/source/lib/hash.c
>--- samba-2.2.8a.orig/source/lib/hash.c	2003-02-28 16:56:19.000000000 +0100
>+++ samba-2.2.8a/source/lib/hash.c	2004-12-16 13:22:39.000000000 +0100
>@@ -67,7 +67,7 @@
> 
> 	DEBUG(5, ("Hash size = %d.\n", table->size));
> 
>-	if(!(table->buckets = (ubi_dlList *) malloc(sizeof(ubi_dlList) * table->size))) {
>+	if(!(table->buckets = (ubi_dlList *) malloc_array(sizeof(ubi_dlList), table->size))) {
> 		DEBUG(0,("hash_table_init: malloc fail !\n"));
> 		return False;
> 	}
>diff -Ebru samba-2.2.8a.orig/source/lib/messages.c samba-2.2.8a/source/lib/messages.c
>--- samba-2.2.8a.orig/source/lib/messages.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/lib/messages.c	2004-12-16 13:37:18.000000000 +0100
>@@ -221,6 +221,11 @@
> 	}
> 
> 	/* we're adding to an existing entry */
>+	if(dbuf.dsize >= (UINT_MAX-len) || (dbuf.dsize+len) > (UINT_MAX-sizeof(rec)))
>+	{
>+		DEBUG(0,("message_send_pid: integer overflow detected.\n"));
>+		goto failed;
>+	}
> 	p = (void *)malloc(dbuf.dsize + len + sizeof(rec));
> 	if (!p) goto failed;
> 
>diff -Ebru samba-2.2.8a.orig/source/lib/replace.c samba-2.2.8a/source/lib/replace.c
>--- samba-2.2.8a.orig/source/lib/replace.c	2002-06-01 00:08:36.000000000 +0200
>+++ samba-2.2.8a/source/lib/replace.c	2004-12-16 13:37:33.000000000 +0100
>@@ -202,7 +202,7 @@
> 	struct group *g;
> 	char   *gr;
> 	
>-	if((grouplst = (gid_t *)malloc(sizeof(gid_t) * max_gr)) == NULL) {
>+	if((grouplst = (gid_t *)malloc_array(sizeof(gid_t), max_gr)) == NULL) {
> 		DEBUG(0,("initgroups: malloc fail !\n"));
> 		return -1;
> 	}
>diff -Ebru samba-2.2.8a.orig/source/lib/sysacls.c samba-2.2.8a/source/lib/sysacls.c
>--- samba-2.2.8a.orig/source/lib/sysacls.c	2002-06-05 21:31:29.000000000 +0200
>+++ samba-2.2.8a/source/lib/sysacls.c	2004-12-16 18:09:40.000000000 +0100
>@@ -729,7 +729,7 @@
> 	 * acl[] array, this actually allocates an ACL with room
> 	 * for (count+1) entries
> 	 */
>-	if ((a = malloc(sizeof(*a) + count * sizeof(struct acl))) == NULL) {
>+	if ((a = malloc_array(sizeof(*a) + count, sizeof(struct acl))) == NULL) {
> 		errno = ENOMEM;
> 		return NULL;
> 	}
>@@ -893,7 +893,7 @@
> 		 * allocate a temporary buffer for the complete ACL
> 		 */
> 		acl_count = acc_acl->count + def_acl->count;
>-		acl_p = acl_buf = malloc(acl_count * sizeof(acl_buf[0]));
>+		acl_p = acl_buf = malloc_array(acl_count, sizeof(acl_buf[0]));
> 
> 		if (acl_buf == NULL) {
> 			sys_acl_free_acl(tmp_acl);
>@@ -1355,7 +1355,7 @@
> {
> 	SMB_ACL_T	a;
> 
>-	if (count < 0) {
>+	if (count < 0 || count > INT_MAX-sizeof(*a)) {
> 		errno = EINVAL;
> 		return NULL;
> 	}
>@@ -1832,7 +1832,7 @@
> 		 * allocate a temporary buffer for the complete ACL
> 		 */
> 		acl_count = acc_acl->count + def_acl->count;
>-		acl_p = acl_buf = malloc(acl_count * sizeof(acl_buf[0]));
>+		acl_p = acl_buf = malloc_array(acl_count, sizeof(acl_buf[0]));
> 
> 		if (acl_buf == NULL) {
> 			sys_acl_free_acl(tmp_acl);
>diff -Ebru samba-2.2.8a.orig/source/lib/system.c samba-2.2.8a/source/lib/system.c
>--- samba-2.2.8a.orig/source/lib/system.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/lib/system.c	2004-12-16 14:14:12.000000000 +0100
>@@ -674,7 +674,7 @@
> 	if (setlen == 0)
> 		setlen = groups_max();
> 
>-	if((group_list = (GID_T *)malloc(setlen * sizeof(GID_T))) == NULL) {
>+	if((group_list = (GID_T *)malloc_array(setlen, sizeof(GID_T))) == NULL) {
> 		DEBUG(0,("sys_getgroups: Malloc fail.\n"));
> 		return -1;
> 	}
>@@ -723,7 +723,7 @@
> 	 * GID_T array of size setlen.
> 	 */
> 
>-	if((group_list = (GID_T *)malloc(setlen * sizeof(GID_T))) == NULL) {
>+	if((group_list = (GID_T *)malloc_array(setlen, sizeof(GID_T))) == NULL) {
> 		DEBUG(0,("sys_setgroups: Malloc fail.\n"));
> 		return -1;    
> 	}
>@@ -1071,7 +1071,7 @@
> 	for( argcl = 1; ptr; ptr = strtok(NULL, " \t"))
> 		argcl++;
> 
>-	if((argl = (char **)malloc((argcl + 1) * sizeof(char *))) == NULL)
>+	if((argl = (char **)malloc_array((argcl + 1), sizeof(char *))) == NULL)
> 		return NULL;
> 
> 	/*
>diff -Ebru samba-2.2.8a.orig/source/lib/talloc.c samba-2.2.8a/source/lib/talloc.c
>--- samba-2.2.8a.orig/source/lib/talloc.c	2002-06-05 21:31:29.000000000 +0200
>+++ samba-2.2.8a/source/lib/talloc.c	2004-12-16 18:48:44.000000000 +0100
>@@ -179,6 +179,26 @@
> 	return p;
> }
> 
>+#define MAX_TALLOC_SIZE INT_MAX
>+void *talloc_array(TALLOC_CTX *ctx, size_t el_size, unsigned int count)
>+{
>+	if (count >= MAX_TALLOC_SIZE/el_size) {
>+		return NULL;
>+	}
>+	return talloc(ctx, el_size * count);
>+}
>+
>+void *talloc_zero_array(TALLOC_CTX *t, size_t el_size, unsigned int count)
>+{
>+	void *p = talloc_array(t, el_size, count);
>+
>+	if (p)
>+		memset(p, '\0', el_size*count);
>+
>+	return p;
>+}
>+
>+
> /** A talloc version of realloc */
> void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size)
> {
>diff -Ebru samba-2.2.8a.orig/source/lib/username.c samba-2.2.8a/source/lib/username.c
>--- samba-2.2.8a.orig/source/lib/username.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/lib/username.c	2004-12-16 14:16:59.000000000 +0100
>@@ -336,7 +336,7 @@
>  		return False;
>  	}
>  
>- 	if ((groups = (gid_t *)malloc(sizeof(gid_t) * num_groups )) == NULL) {
>+ 	if ((groups = (gid_t *)malloc_array(sizeof(gid_t), num_groups )) == NULL) {
>  		DEBUG(0,("user_in_winbind_group_list: malloc fail.\n"));
>  		goto err;
>  	}
>diff -Ebru samba-2.2.8a.orig/source/lib/util.c samba-2.2.8a/source/lib/util.c
>--- samba-2.2.8a.orig/source/lib/util.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/lib/util.c	2004-12-16 16:47:25.000000000 +0100
>@@ -86,6 +86,41 @@
> fstring global_myworkgroup = "";
> char **my_netbios_names;
> 
>+/* a but huge but well... */
>+#define MAX_ALLOC_SIZE INT_MAX
>+
>+/****************************************************************************
>+ Type-safe malloc.
>+****************************************************************************/
>+
>+void *malloc_array(size_t el_size, unsigned int count)
>+{
>+	if (count >= MAX_ALLOC_SIZE/el_size) {
>+		return NULL;
>+	}
>+	return malloc(el_size*count);
>+}
>+
>+/****************************************************************************
>+ Type-safe calloc.
>+****************************************************************************/
>+
>+void *calloc_array(size_t size, size_t nmemb)
>+{
>+	if (nmemb >= MAX_ALLOC_SIZE/size) {
>+		return NULL;
>+	}
>+	return calloc(nmemb, size);
>+}
>+
>+void *realloc_array(void *p,size_t el_size, unsigned int count)
>+{
>+	if (count >= MAX_ALLOC_SIZE/el_size) {
>+ 		return NULL;
>+	}
>+	return Realloc(p,el_size*count);
>+}
>+
> 
> /****************************************************************************
>  Find a suitable temporary directory. The result should be copied immediately
>@@ -159,6 +194,12 @@
> 	while ((p = Atoic(p, &val, ":,")) != NULL && (*p) != ':') {
> 		uint32 *tn;
> 
>+		if((*count) == INT_MAX || ((*count)+1) >= INT_MAX/sizeof(uint32))
>+		{
>+			DEBUG(0,("get_numlist: integer overflow detected.\n"));
>+			SAFE_FREE(*num);
>+			return NULL;
>+		}
> 		tn = Realloc((*num), ((*count)+1) * sizeof(uint32));
> 		if (tn == NULL)
> 		{
>diff -Ebru samba-2.2.8a.orig/source/lib/util_file.c samba-2.2.8a/source/lib/util_file.c
>--- samba-2.2.8a.orig/source/lib/util_file.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/lib/util_file.c	2004-12-16 14:39:26.000000000 +0100
>@@ -367,6 +367,13 @@
> 	total = 0;
> 
> 	while ((n = read(fd, buf, sizeof(buf))) > 0) {
>+		if(total >= UINT_MAX-n)
>+		{
>+			DEBUG(0,("file_pload: integer overflow detected.\n"));
>+			close(fd);
>+			SAFE_FREE(p);
>+			return NULL;
>+		}
> 		tp = Realloc(p, total + n + 1);
> 		if (!tp) {
> 			DEBUG(0,("file_pload: failed to exand buffer!\n"));
>@@ -398,6 +405,9 @@
> 
> 	if (sys_fstat(fd, &sbuf) != 0) return NULL;
> 
>+	if(sbuf.st_size == UINT_MAX) /* very large file */
>+		return NULL;
>+
> 	p = (char *)malloc(sbuf.st_size+1);
> 	if (!p) return NULL;
> 
>@@ -447,7 +457,7 @@
> 		if (s[0] == '\n') i++;
> 	}
> 
>-	ret = (char **)malloc(sizeof(ret[0])*(i+2));
>+	ret = (char **)malloc_array(sizeof(ret[0]), (i+2));
> 	if (!ret) {
> 		SAFE_FREE(p);
> 		return NULL;
>diff -Ebru samba-2.2.8a.orig/source/lib/util_getent.c samba-2.2.8a/source/lib/util_getent.c
>--- samba-2.2.8a.orig/source/lib/util_getent.c	2003-02-28 16:56:19.000000000 +0100
>+++ samba-2.2.8a/source/lib/util_getent.c	2004-12-16 14:41:07.000000000 +0100
>@@ -89,7 +89,7 @@
> 			;
> 		
> 		/* alloc space for gr_mem string pointers */
>-		if ((gent->gr_mem = (char **) malloc((num+1) * sizeof(char *))) == NULL)
>+		if ((gent->gr_mem = (char **) malloc_array((num+1), sizeof(char *))) == NULL)
> 			goto err;
> 
> 		memset(gent->gr_mem, '\0', (num+1) * sizeof(char *));
>diff -Ebru samba-2.2.8a.orig/source/lib/util_seaccess.c samba-2.2.8a/source/lib/util_seaccess.c
>--- samba-2.2.8a.orig/source/lib/util_seaccess.c	2002-04-30 15:26:55.000000000 +0200
>+++ samba-2.2.8a/source/lib/util_seaccess.c	2004-12-16 14:41:26.000000000 +0100
>@@ -352,7 +352,7 @@
> 
> 	the_acl = parent_ctr->dacl;
> 
>-	if (!(new_ace_list = talloc(ctx, sizeof(SEC_ACE) * the_acl->num_aces))) 
>+	if (!(new_ace_list = talloc_array(ctx, sizeof(SEC_ACE), the_acl->num_aces))) 
> 		return NULL;
> 
> 	for (i = 0; the_acl && i < the_acl->num_aces; i++) {
>diff -Ebru samba-2.2.8a.orig/source/lib/util_sid.c samba-2.2.8a/source/lib/util_sid.c
>--- samba-2.2.8a.orig/source/lib/util_sid.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/lib/util_sid.c	2004-12-16 14:44:02.000000000 +0100
>@@ -785,7 +785,7 @@
> char *sid_binstring(DOM_SID *sid)
> {
> 	char *buf, *s;
>-	int len = sid_size(sid);
>+	unsigned int len = sid_size(sid);
> 	buf = malloc(len);
> 	if (!buf) return NULL;
> 	sid_linearize(buf, len, sid);
>diff -Ebru samba-2.2.8a.orig/source/lib/util_str.c samba-2.2.8a/source/lib/util_str.c
>--- samba-2.2.8a.orig/source/lib/util_str.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/lib/util_str.c	2004-12-16 14:46:39.000000000 +0100
>@@ -103,7 +103,7 @@
>   *ctok=ictok;
>   s=last_ptr;
> 
>-  if (!(ret=iret=malloc(ictok*sizeof(char *)))) return NULL;
>+  if (!(ret=iret=malloc_array(ictok, sizeof(char *)))) return NULL;
>   
>   while(ictok--) {    
>     *iret++=s;
>@@ -1360,6 +1360,8 @@
> 	char *s;
> 	int i, j;
> 	const char *hex = "0123456789ABCDEF";
>+	if(len <= 0 || len >= INT_MAX/3)
>+		return NULL;
> 	s = malloc(len * 3 + 1);
> 	if (!s) return NULL;
> 	for (j=i=0;i<len;i++) {
>diff -Ebru samba-2.2.8a.orig/source/lib/util_unistr.c samba-2.2.8a/source/lib/util_unistr.c
>--- samba-2.2.8a.orig/source/lib/util_unistr.c	2002-12-10 15:58:15.000000000 +0100
>+++ samba-2.2.8a/source/lib/util_unistr.c	2004-12-16 14:48:56.000000000 +0100
>@@ -1150,10 +1150,12 @@
> 
> smb_ucs2_t *strdup_w(const smb_ucs2_t *s)
> {
>-	size_t newlen = (strlen_w(s)+1)*sizeof(smb_ucs2_t);
>-	smb_ucs2_t *newstr = (smb_ucs2_t *)malloc(newlen);
>+	size_t newlen;
>+	smb_ucs2_t *newstr = (smb_ucs2_t *)malloc_array((strlen_w(s)+1), sizeof(smb_ucs2_t));
>+	
>     if (newstr == NULL)
>         return NULL;
>+	newlen = (strlen_w(s)+1)*sizeof(smb_ucs2_t);
>     safe_strcpy_w(newstr, s, newlen);
>     return newstr;
> }
>@@ -1382,7 +1384,7 @@
> 	*ctok = ictok;
> 	s = last_ptr;
> 
>-	if (!(ret=iret=malloc(ictok*sizeof(smb_ucs2_t *))))
>+	if (!(ret=iret=malloc_array(ictok, sizeof(smb_ucs2_t *))))
> 		return NULL;
>   
> 	while(ictok--) {
>@@ -1870,7 +1872,7 @@
> 	if (l == 0)
> 		*dest = null_string;
> 	else {
>-		(*dest) = (smb_ucs2_t *)malloc(sizeof(smb_ucs2_t)*(l+1));
>+		(*dest) = (smb_ucs2_t *)malloc_array(sizeof(smb_ucs2_t), (l+1));
> 		if ((*dest) == NULL) {
> 			DEBUG(0,("Out of memory in string_init_w\n"));
> 			return False;
>diff -Ebru samba-2.2.8a.orig/source/libsmb/clilist.c samba-2.2.8a/source/libsmb/clilist.c
>--- samba-2.2.8a.orig/source/libsmb/clilist.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/clilist.c	2004-12-16 13:38:57.000000000 +0100
>@@ -263,6 +263,11 @@
> 		}
>  
> 		/* and add them to the dirlist pool */
>+		if(dirlist_len >= UINT_MAX - data_len)
>+		{
>+			DEBUG(0,("cli_list_new: integer overflow detected.\n"));
>+			break;
>+		}
> 		tdl = Realloc(dirlist,dirlist_len + data_len);
> 
> 		if (!tdl) {
>diff -Ebru samba-2.2.8a.orig/source/libsmb/cli_lsarpc.c samba-2.2.8a/source/libsmb/cli_lsarpc.c
>--- samba-2.2.8a.orig/source/libsmb/cli_lsarpc.c	2002-06-06 23:31:33.000000000 +0200
>+++ samba-2.2.8a/source/libsmb/cli_lsarpc.c	2004-12-16 13:48:20.000000000 +0100
>@@ -282,21 +282,21 @@
> 		goto done;
> 	}
> 
>-	if (!((*domains) = (char **)talloc(mem_ctx, sizeof(char *) *
>+	if (!((*domains) = (char **)talloc_array(mem_ctx, sizeof(char *),
> 					   num_sids))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*names) = (char **)talloc(mem_ctx, sizeof(char *) *
>+	if (!((*names) = (char **)talloc_array(mem_ctx, sizeof(char *),
> 					 num_sids))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*types) = (uint32 *)talloc(mem_ctx, sizeof(uint32) *
>+	if (!((*types) = (uint32 *)talloc_array(mem_ctx, sizeof(uint32),
> 					  num_sids))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
>@@ -400,14 +400,14 @@
> 		goto done;
> 	}
> 
>-	if (!((*sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) *
>+	if (!((*sids = (DOM_SID *)talloc_array(mem_ctx, sizeof(DOM_SID),
> 					 num_names)))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*types = (uint32 *)talloc(mem_ctx, sizeof(uint32) *
>+	if (!((*types = (uint32 *)talloc_array(mem_ctx, sizeof(uint32),
> 					 num_names)))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
>@@ -589,7 +589,7 @@
> 
> 		/* Allocate memory for trusted domain names and sids */
> 
>-		*domain_names = (char **)talloc(mem_ctx, sizeof(char *) *
>+		*domain_names = (char **)talloc_array(mem_ctx, sizeof(char *),
> 						r.num_domains);
> 
> 		if (!*domain_names) {
>@@ -598,7 +598,7 @@
> 			goto done;
> 		}
> 
>-		*domain_sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) *
>+		*domain_sids = (DOM_SID *)talloc_array(mem_ctx, sizeof(DOM_SID),
> 						 r.num_domains);
> 		if (!domain_sids) {
> 			DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
>@@ -674,19 +674,19 @@
> 	*enum_context = r.enum_context;
> 	*count = r.count;
> 
>-	if (!((*privs_name = (char **)talloc(mem_ctx, sizeof(char *) * r.count)))) {
>+	if (!((*privs_name = (char **)talloc_array(mem_ctx, sizeof(char *), r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*privs_high = (uint32 *)talloc(mem_ctx, sizeof(uint32) * r.count)))) {
>+	if (!((*privs_high = (uint32 *)talloc_array(mem_ctx, sizeof(uint32), r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*privs_low = (uint32 *)talloc(mem_ctx, sizeof(uint32) * r.count)))) {
>+	if (!((*privs_low = (uint32 *)talloc_array(mem_ctx, sizeof(uint32), r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
>@@ -810,7 +810,7 @@
> 
> 	/* Return output parameters */
> 
>-	*sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * r.sids.num_entries);
>+	*sids = (DOM_SID *)talloc_array(mem_ctx, sizeof(DOM_SID), r.sids.num_entries);
> 	if (!*sids) {
> 		DEBUG(0, ("(cli_lsa_enum_sids): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
>@@ -935,7 +935,7 @@
> 	if (r.count == 0)
> 		goto done;
> 
>-	if (!((*set = (LUID_ATTR *)talloc(mem_ctx, sizeof(LUID_ATTR) * r.count)))) {
>+	if (!((*set = (LUID_ATTR *)talloc_array(mem_ctx, sizeof(LUID_ATTR), r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privsaccount): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
>diff -Ebru samba-2.2.8a.orig/source/libsmb/clireadwrite.c samba-2.2.8a/source/libsmb/clireadwrite.c
>--- samba-2.2.8a.orig/source/libsmb/clireadwrite.c	2003-02-28 16:56:19.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/clireadwrite.c	2004-12-16 13:52:40.000000000 +0100
>@@ -241,6 +241,8 @@
> 	BOOL bigoffset = False;
> 
> 	if (size > cli->bufsize) {
>+		if(size >= (UINT_MAX-1024))
>+			return False;
> 		cli->outbuf = realloc(cli->outbuf, size + 1024);
> 		cli->inbuf = realloc(cli->inbuf, size + 1024);
> 		if (cli->outbuf == NULL || cli->inbuf == NULL)
>diff -Ebru samba-2.2.8a.orig/source/libsmb/cli_samr.c samba-2.2.8a/source/libsmb/cli_samr.c
>--- samba-2.2.8a.orig/source/libsmb/cli_samr.c	2003-03-14 22:34:47.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/cli_samr.c	2004-12-16 13:54:21.000000000 +0100
>@@ -552,7 +552,7 @@
> 	*num_dom_groups = r.num_entries2;
> 
> 	if (!((*dom_groups) = (struct acct_info *)
>-	      talloc(mem_ctx, sizeof(struct acct_info) * *num_dom_groups))) {
>+	      talloc_array(mem_ctx, sizeof(struct acct_info), *num_dom_groups))) {
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
>@@ -630,7 +630,7 @@
> 	*num_dom_groups = r.num_entries2;
> 
> 	if (!((*dom_groups) = (struct acct_info *)
>-	      talloc(mem_ctx, sizeof(struct acct_info) * *num_dom_groups))) {
>+	      talloc_array(mem_ctx, sizeof(struct acct_info), *num_dom_groups))) {
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
>@@ -703,7 +703,7 @@
> 
> 	*num_mem = r.num_sids;
> 
>-	if (!(*sids = talloc(mem_ctx, sizeof(DOM_SID) * *num_mem))) {
>+	if (!(*sids = talloc_array(mem_ctx, sizeof(DOM_SID), *num_mem))) {
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
>@@ -972,8 +972,8 @@
> 	}
> 
> 	*num_names = r.num_names1;
>-	*names = talloc(mem_ctx, sizeof(char *) * r.num_names1);
>-	*name_types = talloc(mem_ctx, sizeof(uint32) * r.num_names1);
>+	*names = talloc_array(mem_ctx, sizeof(char *), r.num_names1);
>+	*name_types = talloc_array(mem_ctx, sizeof(uint32), r.num_names1);
> 
> 	for (i = 0; i < r.num_names1; i++) {
> 		fstring tmp;
>@@ -1040,8 +1040,8 @@
> 	}
> 
> 	*num_rids = r.num_rids1;
>-	*rids = talloc(mem_ctx, sizeof(uint32) * r.num_rids1);
>-	*rid_types = talloc(mem_ctx, sizeof(uint32) * r.num_rids1);
>+	*rids = talloc_array(mem_ctx, sizeof(uint32), r.num_rids1);
>+	*rid_types = talloc_array(mem_ctx, sizeof(uint32), r.num_rids1);
> 
> 	for (i = 0; i < r.num_rids1; i++) {
> 		(*rids)[i] = r.rids[i];
>diff -Ebru samba-2.2.8a.orig/source/libsmb/cli_spoolss.c samba-2.2.8a/source/libsmb/cli_spoolss.c
>--- samba-2.2.8a.orig/source/libsmb/cli_spoolss.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/cli_spoolss.c	2004-12-16 13:56:59.000000000 +0100
>@@ -70,7 +70,7 @@
>         uint32 i;
>         PRINTER_INFO_0  *inf;
> 
>-        inf=(PRINTER_INFO_0 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_0));
>+        inf=(PRINTER_INFO_0 *)talloc_array(mem_ctx, returned, sizeof(PRINTER_INFO_0));
> 
>         buffer->prs.data_offset=0;
> 
>@@ -89,7 +89,7 @@
>         uint32 i;
>         PRINTER_INFO_1  *inf;
> 
>-        inf=(PRINTER_INFO_1 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_1));
>+        inf=(PRINTER_INFO_1 *)talloc_array(mem_ctx, returned, sizeof(PRINTER_INFO_1));
> 
>         buffer->prs.data_offset=0;
> 
>@@ -108,7 +108,7 @@
>         uint32 i;
>         PRINTER_INFO_2  *inf;
> 
>-        inf=(PRINTER_INFO_2 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_2));
>+        inf=(PRINTER_INFO_2 *)talloc_array(mem_ctx, returned, sizeof(PRINTER_INFO_2));
> 
>         buffer->prs.data_offset=0;
> 
>@@ -129,7 +129,7 @@
>         uint32 i;
>         PRINTER_INFO_3  *inf;
> 
>-        inf=(PRINTER_INFO_3 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_3));
>+        inf=(PRINTER_INFO_3 *)talloc_array(mem_ctx, returned, sizeof(PRINTER_INFO_3));
> 
>         buffer->prs.data_offset=0;
> 
>@@ -149,7 +149,7 @@
>         uint32 i;
>         PORT_INFO_1 *inf;
> 
>-        inf=(PORT_INFO_1*)talloc(mem_ctx, returned*sizeof(PORT_INFO_1));
>+        inf=(PORT_INFO_1*)talloc_array(mem_ctx, returned, sizeof(PORT_INFO_1));
> 
>         prs_set_offset(&buffer->prs, 0);
> 
>@@ -168,7 +168,7 @@
>         uint32 i;
>         PORT_INFO_2 *inf;
> 
>-        inf=(PORT_INFO_2*)talloc(mem_ctx, returned*sizeof(PORT_INFO_2));
>+        inf=(PORT_INFO_2*)talloc_array(mem_ctx, returned, sizeof(PORT_INFO_2));
> 
>         prs_set_offset(&buffer->prs, 0);
> 
>@@ -187,7 +187,7 @@
>         uint32 i;
>         DRIVER_INFO_1 *inf;
> 
>-        inf=(DRIVER_INFO_1 *)talloc(mem_ctx, returned*sizeof(DRIVER_INFO_1));
>+        inf=(DRIVER_INFO_1 *)talloc_array(mem_ctx, returned, sizeof(DRIVER_INFO_1));
> 
>         buffer->prs.data_offset=0;
> 
>@@ -206,7 +206,7 @@
>         uint32 i;
>         DRIVER_INFO_2 *inf;
> 
>-        inf=(DRIVER_INFO_2 *)talloc(mem_ctx, returned*sizeof(DRIVER_INFO_2));
>+        inf=(DRIVER_INFO_2 *)talloc_array(mem_ctx, returned, sizeof(DRIVER_INFO_2));
> 
>         buffer->prs.data_offset=0;
> 
>@@ -225,7 +225,7 @@
>         uint32 i;
>         DRIVER_INFO_3 *inf;
> 
>-        inf=(DRIVER_INFO_3 *)talloc(mem_ctx, returned*sizeof(DRIVER_INFO_3));
>+        inf=(DRIVER_INFO_3 *)talloc_array(mem_ctx, returned, sizeof(DRIVER_INFO_3));
> 
>         buffer->prs.data_offset=0;
> 
>@@ -1415,7 +1415,7 @@
> {
> 	int i;
> 
>-	*forms = (FORM_1 *)talloc(mem_ctx, num_forms * sizeof(FORM_1));
>+	*forms = (FORM_1 *)talloc_array(mem_ctx, num_forms, sizeof(FORM_1));
> 	buffer->prs.data_offset = 0;
> 
> 	for (i = 0; i < num_forms; i++)
>diff -Ebru samba-2.2.8a.orig/source/libsmb/libsmbclient.c samba-2.2.8a/source/libsmb/libsmbclient.c
>--- samba-2.2.8a.orig/source/libsmb/libsmbclient.c	2003-02-28 16:56:19.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/libsmbclient.c	2004-12-16 14:01:46.000000000 +0100
>@@ -585,7 +585,7 @@
> 
> #endif
> 
>-	smbc_file_table = malloc(SMBC_MAX_FD * sizeof(struct smbc_file *));
>+	smbc_file_table = malloc_array(SMBC_MAX_FD, sizeof(struct smbc_file *));
> 	if (!smbc_file_table)
> 		return ENOMEM;
> 
>@@ -645,7 +645,7 @@
> 	}
> 	else {
> 	  
>-		int slot = 0;
>+		unsigned int slot = 0;
> 
> 		/* Find a free slot first */
> 
>diff -Ebru samba-2.2.8a.orig/source/libsmb/namecache.c samba-2.2.8a/source/libsmb/namecache.c
>--- samba-2.2.8a.orig/source/libsmb/namecache.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/namecache.c	2004-12-16 14:02:06.000000000 +0100
>@@ -224,8 +224,8 @@
> 
> 	if (data->count) {
> 
>-		*ip_list = (struct in_addr *)malloc(
>-			sizeof(struct in_addr) * data->count);
>+		*ip_list = (struct in_addr *)malloc_array(
>+			sizeof(struct in_addr), data->count);
> 		
> 		memcpy(*ip_list, data->ip_list, sizeof(struct in_addr) * data->count);
> 		
>diff -Ebru samba-2.2.8a.orig/source/libsmb/namequery.c samba-2.2.8a/source/libsmb/namequery.c
>--- samba-2.2.8a.orig/source/libsmb/namequery.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/namequery.c	2004-12-16 14:10:38.000000000 +0100
>@@ -54,7 +54,7 @@
> 
> 	if (*num_names == 0) return NULL;
> 
>-	ret = (struct node_status *)malloc(sizeof(struct node_status)* (*num_names));
>+	ret = (struct node_status *)malloc_array(sizeof(struct node_status), (*num_names));
> 	if (!ret) return NULL;
> 
> 	p++;
>@@ -406,7 +406,16 @@
> 				free_packet(p2);
> 				continue;
> 			}
>-
>+			if(
>+				nmb2->answers->rdlength >= INT_MAX/6 ||
>+				(*count) >= INT_MAX-(nmb2->answers->rdlength/6) ||
>+				sizeof( ip_list[0] ) >= UINT_MAX/( (*count) + nmb2->answers->rdlength/6 )
>+			)
>+			{
>+				DEBUG(0,("name_query: integer overflow detected.\n"));
>+				free_packet(p2);
>+				return NULL;
>+			}
> 			tmp_ip_list = (struct in_addr *)Realloc( ip_list, sizeof( ip_list[0] )
> 												* ( (*count) + nmb2->answers->rdlength/6 ) );
> 
>@@ -812,7 +821,7 @@
> 		int i = 0, j;
> 		while (hp->h_addr_list[i]) i++;
> 		DEBUG(10, ("%d addresses returned\n", i));
>-		*return_iplist = (struct in_addr *)malloc(i*sizeof(struct in_addr));
>+		*return_iplist = (struct in_addr *)malloc_array(i, sizeof(struct in_addr));
> 		if(*return_iplist == NULL) {
> 			DEBUG(3,("resolve_hosts: malloc fail !\n"));
> 			return False;
>@@ -920,7 +929,7 @@
>      the iplist when the PDC is down will cause two sets of timeouts. */
> 
>   if (*return_count && (nodupes_iplist =
>-			(struct in_addr *)malloc(sizeof(struct in_addr) * (*return_count)))) {
>+			(struct in_addr *)malloc_array(sizeof(struct in_addr), (*return_count)))) {
>       int nodupes_count = 0;
>  
>       /* Iterate over return_iplist looking for duplicates */
>@@ -1327,7 +1336,7 @@
> 		if (num_addresses == 0)
> 			return internal_resolve_name(group, name_type, ip_list, count);
> 
>-		return_iplist = (struct in_addr *)malloc(num_addresses * sizeof(struct in_addr));
>+		return_iplist = (struct in_addr *)malloc_array(num_addresses, sizeof(struct in_addr));
> 		if(return_iplist == NULL) {
> 			DEBUG(3,("get_dc_list: malloc fail !\n"));
> 			return False;
>@@ -1339,6 +1348,14 @@
> 			int count_more;
> 			if (resolve_name_2( name, &more_ip, &count_more, 0x20) == False)
> 				continue;
>+
>+			if(num_addresses >= INT_MAX-count_more || (num_addresses + count_more) >= INT_MAX/sizeof(struct in_addr))
>+			{
>+				DEBUG(0,("get_dc_list: integer overflow detected.\n"));
>+				SAFE_FREE(return_iplist);
>+				SAFE_FREE(more_ip);
>+				return False;
>+			}
> 			tmp = (struct in_addr *)realloc(return_iplist,(num_addresses + count_more) * sizeof(struct in_addr));
> 			if (return_iplist == NULL) {
> 				DEBUG(3, ("realloc failed with %d addresses\n", num_addresses + count_more));
>diff -Ebru samba-2.2.8a.orig/source/libsmb/nmblib.c samba-2.2.8a/source/libsmb/nmblib.c
>--- samba-2.2.8a.orig/source/libsmb/nmblib.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/libsmb/nmblib.c	2004-12-16 14:11:43.000000000 +0100
>@@ -335,7 +335,7 @@
> 				struct res_rec **recs, int count)
> {
>   int i;
>-  *recs = (struct res_rec *)malloc(sizeof(**recs)*count);
>+  *recs = (struct res_rec *)malloc_array(sizeof(**recs), count);
>   if (!*recs) return(False);
> 
>   memset((char *)*recs,'\0',sizeof(**recs)*count);
>@@ -551,7 +551,7 @@
>   if (nmb->answers)
>   {
>     if((copy_nmb->answers = (struct res_rec *)
>-                  malloc(nmb->header.ancount * sizeof(struct res_rec))) == NULL)
>+                  malloc_array(nmb->header.ancount, sizeof(struct res_rec))) == NULL)
>       goto free_and_exit;
>     memcpy((char *)copy_nmb->answers, (char *)nmb->answers, 
>            nmb->header.ancount * sizeof(struct res_rec));
>@@ -559,7 +559,7 @@
>   if (nmb->nsrecs)
>   {
>     if((copy_nmb->nsrecs = (struct res_rec *)
>-                  malloc(nmb->header.nscount * sizeof(struct res_rec))) == NULL)
>+                  malloc_array(nmb->header.nscount, sizeof(struct res_rec))) == NULL)
>       goto free_and_exit;
>     memcpy((char *)copy_nmb->nsrecs, (char *)nmb->nsrecs, 
>            nmb->header.nscount * sizeof(struct res_rec));
>@@ -567,7 +567,7 @@
>   if (nmb->additional)
>   {
>     if((copy_nmb->additional = (struct res_rec *)
>-                  malloc(nmb->header.arcount * sizeof(struct res_rec))) == NULL)
>+                  malloc_array(nmb->header.arcount, sizeof(struct res_rec))) == NULL)
>       goto free_and_exit;
>     memcpy((char *)copy_nmb->additional, (char *)nmb->additional, 
>            nmb->header.arcount * sizeof(struct res_rec));
>diff -Ebru samba-2.2.8a.orig/source/locking/brlock.c samba-2.2.8a/source/locking/brlock.c
>--- samba-2.2.8a.orig/source/locking/brlock.c	2003-02-28 16:56:19.000000000 +0100
>+++ samba-2.2.8a/source/locking/brlock.c	2004-12-16 14:51:02.000000000 +0100
>@@ -355,6 +355,11 @@
> 	}
> 
> 	/* no conflicts - add it to the list of locks */
>+	if(dbuf.dsize >= UINT_MAX-sizeof(*locks))
>+	{
>+		DEBUG(0,("brl_lock: integer overflow detected.\n"));
>+		goto fail;
>+	}
> 	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(*locks));
> 	if (!tp) {
> 		status = NT_STATUS_NO_MEMORY;
>diff -Ebru samba-2.2.8a.orig/source/locking/posix.c samba-2.2.8a/source/locking/posix.c
>--- samba-2.2.8a.orig/source/locking/posix.c	2003-02-28 16:56:19.000000000 +0100
>+++ samba-2.2.8a/source/locking/posix.c	2004-12-16 15:14:13.000000000 +0100
>@@ -370,6 +370,11 @@
> 	pl.size = size;
> 	pl.lock_type = lock_type;
> 
>+	if(dbuf.dsize >= UINT_MAX - sizeof(pl))
>+	{
>+		DEBUG(0,("add_posix_lock_entry: integer overflow detected.\n"));
>+		goto fail;
>+	}
> 	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(pl));
> 	if (!tp) {
> 		DEBUG(0,("add_posix_lock_entry: Realloc fail !\n"));
>diff -Ebru samba-2.2.8a.orig/source/msdfs/msdfs.c samba-2.2.8a/source/msdfs/msdfs.c
>--- samba-2.2.8a.orig/source/msdfs/msdfs.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/msdfs/msdfs.c	2004-12-16 15:15:02.000000000 +0100
>@@ -128,7 +128,7 @@
> 
> 	DEBUG(10,("parse_symlink: count=%d\n", count));
> 
>-	reflist = *preflist = (struct referral*) malloc(count * sizeof(struct referral));
>+	reflist = *preflist = (struct referral*) malloc_array(count, sizeof(struct referral));
> 	if(reflist == NULL) {
> 		DEBUG(0,("parse_symlink: Malloc failed!\n"));
> 		return False;
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd_browsesync.c samba-2.2.8a/source/nmbd/nmbd_browsesync.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd_browsesync.c	2002-04-30 15:27:18.000000000 +0200
>+++ samba-2.2.8a/source/nmbd/nmbd_browsesync.c	2004-12-16 15:15:57.000000000 +0100
>@@ -293,7 +293,7 @@
>   struct work_record *work;
>   struct nmb_name nmbname;
>   struct userdata_struct *userdata;
>-  int size = sizeof(struct userdata_struct) + sizeof(fstring)+1;
>+  size_t size = sizeof(struct userdata_struct) + sizeof(fstring)+1;
> 
>   if( !(work = find_workgroup_on_subnet(subrec, q_name->name)) )
>   {
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd.c samba-2.2.8a/source/nmbd/nmbd.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/nmbd/nmbd.c	2004-12-16 15:16:22.000000000 +0100
>@@ -585,7 +585,7 @@
>     namecount++;
> 
>   /* Allocate space for the netbios aliases */
>-  my_netbios_names = (char **)malloc( sizeof(char *) * (namecount+1) );
>+  my_netbios_names = (char **)malloc_array( sizeof(char *), (namecount+1) );
>   if( NULL == my_netbios_names )
>   {
>      DEBUG( 0, ( "init_structs: malloc fail.\n" ) );
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd_incomingrequests.c samba-2.2.8a/source/nmbd/nmbd_incomingrequests.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd_incomingrequests.c	2002-02-01 23:13:39.000000000 +0100
>+++ samba-2.2.8a/source/nmbd/nmbd_incomingrequests.c	2004-12-16 15:16:38.000000000 +0100
>@@ -558,7 +558,7 @@
>         prdata = rdata;
>       else
>       {
>-        if((prdata = (char *)malloc( namerec->data.num_ips * 6 )) == NULL)
>+        if((prdata = (char *)malloc_array( namerec->data.num_ips, 6 )) == NULL)
>         {
>           DEBUG(0,("process_name_query_request: malloc fail !\n"));
>           goto done;
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd_namelistdb.c samba-2.2.8a/source/nmbd/nmbd_namelistdb.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd_namelistdb.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/nmbd/nmbd_namelistdb.c	2004-12-16 15:17:30.000000000 +0100
>@@ -195,8 +195,8 @@
>   }
> 
>   memset( (char *)namerec, '\0', sizeof(*namerec) );
>-  namerec->data.ip = (struct in_addr *)malloc( sizeof(struct in_addr) 
>-                                               * num_ips );
>+  namerec->data.ip = (struct in_addr *)malloc_array( sizeof(struct in_addr), 
>+                                               num_ips );
>   if( NULL == namerec->data.ip )
>   {
>      DEBUG( 0, ( "add_name_to_subnet: malloc fail when creating ip_flgs.\n" ) );
>@@ -336,8 +336,8 @@
>   if( find_ip_in_name_record( namerec, new_ip ) )
>     return;
>   
>-  new_list = (struct in_addr *)malloc( (namerec->data.num_ips + 1)
>-                                       * sizeof(struct in_addr) );
>+  new_list = (struct in_addr *)malloc_array( (namerec->data.num_ips + 1),
>+                                       sizeof(struct in_addr) );
>   if( NULL == new_list )
>   {
>     DEBUG(0,("add_ip_to_name_record: Malloc fail !\n"));
>@@ -492,7 +492,7 @@
>     /* Create an IP list containing all our known subnets. */
> 
>     num_ips = iface_count();
>-    iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) );
>+    iplist = (struct in_addr *)malloc_array( num_ips, sizeof(struct in_addr) );
>     if( NULL == iplist )
>     {
>       DEBUG(0,("add_samba_names_to_subnet: Malloc fail !\n"));
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd_nameregister.c samba-2.2.8a/source/nmbd/nmbd_nameregister.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd_nameregister.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/nmbd/nmbd_nameregister.c	2004-12-16 15:17:43.000000000 +0100
>@@ -276,7 +276,7 @@
>   for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec) )
>     num_ips++;
> 
>-  if((ip_list = (struct in_addr *)malloc(num_ips * sizeof(struct in_addr)))==NULL)
>+  if((ip_list = (struct in_addr *)malloc_array(num_ips, sizeof(struct in_addr)))==NULL)
>   {
>     DEBUG(0,("multihomed_register_name: malloc fail !\n"));
>     return True;
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd_packets.c samba-2.2.8a/source/nmbd/nmbd_packets.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd_packets.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/nmbd/nmbd_packets.c	2004-12-16 15:19:35.000000000 +0100
>@@ -1724,7 +1724,12 @@
>     return True;
>   }
> 
>-  if((sock_array = (int *)malloc(((count*2) + 2)*sizeof(int))) == NULL)
>+  if(count >= (UINT_MAX/2)-2)
>+  {
>+    DEBUG(0,("create_listen_fdset: integer overflow detected.\n"));
>+    return True;
>+  }
>+  if((sock_array = (int *)malloc_array(((count*2) + 2), sizeof(int))) == NULL)
>   {
>     DEBUG(0,("create_listen_fdset: malloc fail for socket array.\n"));
>     return True;
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd_winsproxy.c samba-2.2.8a/source/nmbd/nmbd_winsproxy.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd_winsproxy.c	2002-02-01 23:13:43.000000000 +0100
>+++ samba-2.2.8a/source/nmbd/nmbd_winsproxy.c	2004-12-16 15:20:37.000000000 +0100
>@@ -61,7 +61,7 @@
>     iplist = &ip;
>   else
>   {
>-    if((iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) )) == NULL)
>+    if((iplist = (struct in_addr *)malloc_array( num_ips, sizeof(struct in_addr) )) == NULL)
>     {
>       DEBUG(0,("wins_proxy_name_query_request_success: malloc fail !\n"));
>       return;
>diff -Ebru samba-2.2.8a.orig/source/nmbd/nmbd_winsserver.c samba-2.2.8a/source/nmbd/nmbd_winsserver.c
>--- samba-2.2.8a.orig/source/nmbd/nmbd_winsserver.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/nmbd/nmbd_winsserver.c	2004-12-16 15:21:15.000000000 +0100
>@@ -272,7 +272,7 @@
>     }
> 
>     /* Allocate the space for the ip_list. */
>-    if((ip_list = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr))) == NULL)
>+    if((ip_list = (struct in_addr *)malloc_array( num_ips, sizeof(struct in_addr))) == NULL)
>     {
>       DEBUG(0,("initialise_wins: Malloc fail !\n"));
>       return False;
>@@ -1237,7 +1237,7 @@
>     return;
>   }
> 
>-  if((prdata = (char *)malloc( num_ips * 6 )) == NULL)
>+  if((prdata = (char *)malloc_array( num_ips, 6 )) == NULL)
>   {
>     DEBUG(0,("process_wins_dmb_query_request: Malloc fail !.\n"));
>     return;
>@@ -1309,7 +1309,7 @@
>       prdata = rdata;
>     else
>     {
>-      if((prdata = (char *)malloc( namerec->data.num_ips * 6 )) == NULL)
>+      if((prdata = (char *)malloc_array( namerec->data.num_ips, 6 )) == NULL)
>       {
>         DEBUG(0,("send_wins_name_query_response: malloc fail !\n"));
>         return;
>diff -Ebru samba-2.2.8a.orig/source/nsswitch/wb_common.c samba-2.2.8a/source/nsswitch/wb_common.c
>--- samba-2.2.8a.orig/source/nsswitch/wb_common.c	2002-06-01 00:08:36.000000000 +0200
>+++ samba-2.2.8a/source/nsswitch/wb_common.c	2004-12-16 15:25:09.000000000 +0100
>@@ -294,7 +294,8 @@
> 			sizeof(struct winbindd_response);
> 		
> 		/* Mallocate memory for extra data */
>-		
>+		if(extra_data_len <= 0)
>+			return -1;
> 		if (!(response->extra_data = malloc(extra_data_len))) {
> 			return -1;
> 		}
>diff -Ebru samba-2.2.8a.orig/source/nsswitch/winbindd_cache.c samba-2.2.8a/source/nsswitch/winbindd_cache.c
>--- samba-2.2.8a.orig/source/nsswitch/winbindd_cache.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/nsswitch/winbindd_cache.c	2004-12-16 15:27:56.000000000 +0100
>@@ -321,6 +321,11 @@
> {
> 	uint8 *p;
> 	if (centry->len - centry->ofs >= len) return;
>+	if(centry->len >= INT_MAX/2)
>+	{
>+		DEBUG(0,("centry_expand: integer overflow detected.\n"));
>+		return;
>+	}
> 	centry->len *= 2;
> 	p = realloc(centry->data, centry->len);
> 	if (!p) {
>@@ -499,7 +504,7 @@
> 	
> 	if (*num_entries == 0) goto do_cached;
> 
>-	(*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries));
>+	(*info) = talloc_array(mem_ctx, sizeof(**info), (*num_entries));
> 	if (! (*info)) smb_panic("query_user_list out of memory");
> 	for (i=0; i<(*num_entries); i++) {
> 		(*info)[i].acct_name = centry_string(centry, mem_ctx);
>@@ -585,7 +590,7 @@
> 	
> 	if (*num_entries == 0) goto do_cached;
> 
>-	(*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries));
>+	(*info) = talloc_array(mem_ctx, sizeof(**info), (*num_entries));
> 	if (! (*info)) smb_panic("enum_dom_groups out of memory");
> 	for (i=0; i<(*num_entries); i++) {
> 		fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
>@@ -794,7 +799,7 @@
> 	
> 	if (*num_groups == 0) goto do_cached;
> 
>-	(*user_gids) = talloc(mem_ctx, sizeof(**user_gids) * (*num_groups));
>+	(*user_gids) = talloc_array(mem_ctx, sizeof(**user_gids), (*num_groups));
> 	if (! (*user_gids)) smb_panic("lookup_usergroups out of memory");
> 	for (i=0; i<(*num_groups); i++) {
> 		(*user_gids)[i] = centry_uint32(centry);
>@@ -852,9 +857,9 @@
> 	
> 	if (*num_names == 0) goto do_cached;
> 
>-	(*rid_mem) = talloc(mem_ctx, sizeof(**rid_mem) * (*num_names));
>-	(*names) = talloc(mem_ctx, sizeof(**names) * (*num_names));
>-	(*name_types) = talloc(mem_ctx, sizeof(**name_types) * (*num_names));
>+	(*rid_mem) = talloc_array(mem_ctx, sizeof(**rid_mem), (*num_names));
>+	(*names) = talloc_array(mem_ctx, sizeof(**names), (*num_names));
>+	(*name_types) = talloc_array(mem_ctx, sizeof(**name_types), (*num_names));
> 
> 	if (! (*rid_mem) || ! (*names) || ! (*name_types)) {
> 		smb_panic("lookup_groupmem out of memory");
>diff -Ebru samba-2.2.8a.orig/source/nsswitch/winbindd_group.c samba-2.2.8a/source/nsswitch/winbindd_group.c
>--- samba-2.2.8a.orig/source/nsswitch/winbindd_group.c	2002-12-10 15:58:15.000000000 +0100
>+++ samba-2.2.8a/source/nsswitch/winbindd_group.c	2004-12-16 18:27:28.000000000 +0100
>@@ -431,7 +431,7 @@
> 	/* Copy entries into return buffer */
> 
> 	if (num_entries) {
>-		name_list = malloc(sizeof(struct acct_info) * num_entries);
>+		name_list = malloc_array(sizeof(struct acct_info), num_entries);
> 		memcpy(name_list, sam_grp_entries, 
> 		       num_entries * sizeof(struct acct_info));
> 	}
>@@ -477,7 +477,7 @@
> 	num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);
> 
> 	if ((state->response.extra_data = 
>-	     malloc(num_groups * sizeof(struct winbindd_gr))) == NULL)
>+	     malloc_array(num_groups, sizeof(struct winbindd_gr))) == NULL)
> 		return WINBINDD_ERROR;
> 
> 	state->response.data.num_entries = 0;
>@@ -830,7 +830,7 @@
> 	/* Copy data back to client */
> 
> 	num_gids = 0;
>-	gid_list = malloc(sizeof(gid_t) * num_groups);
>+	gid_list = malloc_array(sizeof(gid_t), num_groups);
> 
> 	if (state->response.extra_data)
> 		goto done;
>diff -Ebru samba-2.2.8a.orig/source/nsswitch/winbindd_misc.c samba-2.2.8a/source/nsswitch/winbindd_misc.c
>--- samba-2.2.8a.orig/source/nsswitch/winbindd_misc.c	2002-12-10 15:58:15.000000000 +0100
>+++ samba-2.2.8a/source/nsswitch/winbindd_misc.c	2004-12-16 15:30:13.000000000 +0100
>@@ -108,6 +108,12 @@
> 		/* Add domain to list */
> 
> 		total_entries++;
>+		if(sizeof(fstring) >= UINT_MAX/total_entries)
>+		{
>+			DEBUG(0,("winbindd_list_domains: integer overflow detected.\n"));
>+			SAFE_FREE(extra_data);
>+			return WINBINDD_ERROR;
>+		}
> 		ted = Realloc(extra_data, sizeof(fstring) * 
>                               total_entries);
> 
>diff -Ebru samba-2.2.8a.orig/source/nsswitch/winbindd_rpc.c samba-2.2.8a/source/nsswitch/winbindd_rpc.c
>--- samba-2.2.8a.orig/source/nsswitch/winbindd_rpc.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/nsswitch/winbindd_rpc.c	2004-12-16 17:49:04.000000000 +0100
>@@ -192,7 +192,16 @@
> 			talloc_destroy(mem_ctx2);
> 			break;
> 		}
>-
>+		if(
>+			(*num_entries) >= INT_MAX-count ||
>+			sizeof(**info) >= INT_MAX/(*num_entries)
>+		)
>+		{
>+			DEBUG(0,("enum_dom_groups: integer overflow detected.\n"));
>+			talloc_destroy(mem_ctx2);
>+			cli_samr_close(hnd->cli, mem_ctx, &dom_pol);
>+			return NT_STATUS_NO_MEMORY;
>+		}
> 		(*info) = talloc_realloc(mem_ctx, *info, 
> 					 sizeof(**info) * ((*num_entries) + count));
> 		if (! *info) {
>@@ -500,8 +509,8 @@
> 
> #define MAX_LOOKUP_RIDS 900
> 
>-        *names = talloc_zero(mem_ctx, *num_names * sizeof(char *));
>-        *name_types = talloc_zero(mem_ctx, *num_names * sizeof(uint32));
>+        *names = talloc_zero_array(mem_ctx, *num_names, sizeof(char *));
>+        *name_types = talloc_zero_array(mem_ctx, *num_names, sizeof(uint32));
> 
>         for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
>                 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
>diff -Ebru samba-2.2.8a.orig/source/nsswitch/winbindd_user.c samba-2.2.8a/source/nsswitch/winbindd_user.c
>--- samba-2.2.8a.orig/source/nsswitch/winbindd_user.c	2002-12-10 15:58:15.000000000 +0100
>+++ samba-2.2.8a/source/nsswitch/winbindd_user.c	2004-12-16 15:38:37.000000000 +0100
>@@ -438,7 +438,7 @@
> 	num_users = MIN(MAX_GETPWENT_USERS, state->request.data.num_entries);
> 	
> 	if ((state->response.extra_data = 
>-	     malloc(num_users * sizeof(struct winbindd_pw))) == NULL)
>+	     malloc_array(num_users, sizeof(struct winbindd_pw))) == NULL)
> 		return WINBINDD_ERROR;
> 
> 	memset(state->response.extra_data, 0, num_users * 
>@@ -601,7 +601,12 @@
> 		/* Allocate some memory for extra data */
> 
> 		total_entries += num_entries;
>-			
>+		if(sizeof(fstring) >= UINT_MAX/total_entries)
>+		{
>+			DEBUG(0,("winbindd_list_users: integer overflow detected.\n"));
>+			SAFE_FREE(extra_data);
>+			goto done;
>+		}		
> 		ted = Realloc(extra_data, sizeof(fstring) * total_entries);
> 			
> 		if (!ted) {
>diff -Ebru samba-2.2.8a.orig/source/nsswitch/winbind_nss.c samba-2.2.8a/source/nsswitch/winbind_nss.c
>--- samba-2.2.8a.orig/source/nsswitch/winbind_nss.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/nsswitch/winbind_nss.c	2004-12-16 15:40:09.000000000 +0100
>@@ -1307,7 +1307,7 @@
> 			if (gid_list[i] == group) continue;
> 
> 			/* Add to buffer */
>-
>+			// XXX thomas: realloc arg needs constraints */
> 			if (*start == *size && limit <= 0) {
> 				(*groups) = realloc(
> 					(*groups), (2 * (*size) + 1) * sizeof(**groups));
>diff -Ebru samba-2.2.8a.orig/source/pam_smbpass/support.c samba-2.2.8a/source/pam_smbpass/support.c
>--- samba-2.2.8a.orig/source/pam_smbpass/support.c	2002-04-30 15:27:31.000000000 +0200
>+++ samba-2.2.8a/source/pam_smbpass/support.c	2004-12-16 15:41:36.000000000 +0100
>@@ -238,7 +238,7 @@
>     if (x != NULL) {
>         register int i;
> 
>-        for (i = 0; x[i]; ++i); /* length of string */
>+	for (i = 0; x[i] && i < INT_MAX; ++i); /* length of string */
>         if ((new = malloc(++i)) == NULL) {
>             i = 0;
>             _log_err( LOG_CRIT, "out of memory in smbpXstrDup" );
>diff -Ebru samba-2.2.8a.orig/source/param/loadparm.c samba-2.2.8a/source/param/loadparm.c
>--- samba-2.2.8a.orig/source/param/loadparm.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/param/loadparm.c	2004-12-16 15:42:44.000000000 +0100
>@@ -1924,7 +1924,7 @@
> 		service **tsp;
> 
> #ifdef __INSURE__
>-		service **oldservices = iNumServices ? malloc(sizeof(service *) * iNumServices) : NULL;
>+		service **oldservices = iNumServices ? malloc_array(sizeof(service *), iNumServices) : NULL;
> 
> 		if (iNumServices)
> 			memcpy(oldservices, ServicePtrs, sizeof(service *) * iNumServices);
>@@ -2744,7 +2744,7 @@
> {
> 	int i;
> 	SAFE_FREE(pservice->copymap);
>-	pservice->copymap = (BOOL *)malloc(sizeof(BOOL) * NUMPARAMETERS);
>+	pservice->copymap = (BOOL *)malloc_array(sizeof(BOOL), NUMPARAMETERS);
> 	if (!pservice->copymap)
> 		DEBUG(0,
> 		      ("Couldn't allocate copymap!! (size %d)\n",
>diff -Ebru samba-2.2.8a.orig/source/passdb/pampass.c samba-2.2.8a/source/passdb/pampass.c
>--- samba-2.2.8a.orig/source/passdb/pampass.c	2002-02-01 23:13:56.000000000 +0100
>+++ samba-2.2.8a/source/passdb/pampass.c	2004-12-16 15:43:31.000000000 +0100
>@@ -126,7 +126,7 @@
> 		return PAM_CONV_ERR;
> 	}
> 
>-	reply = malloc(sizeof(struct pam_response) * num_msg);
>+	reply = malloc_array(sizeof(struct pam_response), num_msg);
> 	if (!reply)
> 		return PAM_CONV_ERR;
> 
>@@ -286,7 +286,7 @@
> 		return PAM_CONV_ERR;
> 	}
> 
>-	reply = malloc(sizeof(struct pam_response) * num_msg);
>+	reply = malloc_array(sizeof(struct pam_response), num_msg);
> 	if (!reply) {
> 		DEBUG(0,("smb_pam_passchange_conv: malloc for reply failed!\n"));
> 		free_pw_chat(pw_chat);
>diff -Ebru samba-2.2.8a.orig/source/passdb/passdb.c samba-2.2.8a/source/passdb/passdb.c
>--- samba-2.2.8a.orig/source/passdb/passdb.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/passdb/passdb.c	2004-12-16 15:44:08.000000000 +0100
>@@ -1614,7 +1614,7 @@
> 	if (sampass->nt_pw!=NULL)
> 		DEBUG(4,("pdb_set_nt_passwd: NT hash non NULL overwritting ?\n"));
> 	else
>-		sampass->nt_pw=(unsigned char *)malloc(sizeof(unsigned char)*16);
>+		sampass->nt_pw=(unsigned char *)malloc_array(sizeof(unsigned char), 16);
> 	
> 	if (sampass->nt_pw==NULL)
> 		return False;
>@@ -1645,7 +1645,7 @@
> 	if (sampass->lm_pw!=NULL)
> 		DEBUG(4,("pdb_set_lanman_passwd: LM hash non NULL overwritting ?\n"));
> 	else
>-		sampass->lm_pw=(unsigned char *)malloc(sizeof(unsigned char)*16);
>+		sampass->lm_pw=(unsigned char *)malloc_array(sizeof(unsigned char), 16);
> 	
> 	if (sampass->lm_pw==NULL)
> 		return False;
>diff -Ebru samba-2.2.8a.orig/source/passdb/pdb_ldap.c samba-2.2.8a/source/passdb/pdb_ldap.c
>--- samba-2.2.8a.orig/source/passdb/pdb_ldap.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/passdb/pdb_ldap.c	2004-12-16 15:48:15.000000000 +0100
>@@ -480,6 +480,11 @@
> 
> 	if (mods[i] == NULL)
> 	{
>+		if((i+2) >= INT_MAX/sizeof (LDAPMod *))
>+		{
>+			DEBUG(0,("make_a_mod: integer overflow detected.\n"));
>+			return;
>+		}
> 		mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *));
> 		if (mods == NULL)
> 		{
>@@ -504,6 +509,11 @@
> 		if (mods[i]->mod_values != NULL) {
> 			for (; mods[i]->mod_values[j] != NULL; j++);
> 		}
>+		if((j+2) >= INT_MAX/sizeof(char *))
>+		{
>+			DEBUG(0,("make_a_mod: integer overflow detected.\n"));
>+			return;
>+		}
> 		mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values,
> 					       (j + 2) * sizeof (char *));
> 					       
>diff -Ebru samba-2.2.8a.orig/source/passdb/pdb_nisplus.c samba-2.2.8a/source/passdb/pdb_nisplus.c
>--- samba-2.2.8a.orig/source/passdb/pdb_nisplus.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/passdb/pdb_nisplus.c	2004-12-16 15:49:06.000000000 +0100
>@@ -1244,7 +1244,7 @@
> 
>   ta_maxcol = obj->TA_data.ta_maxcol;
>   
>-  if(!(ecol = (entry_col*)malloc(ta_maxcol*sizeof(entry_col)))) {
>+  if(!(ecol = (entry_col*)malloc_array(ta_maxcol, sizeof(entry_col)))) {
>     DEBUG(0, ("memory allocation failure\n"));
>     nis_freeresult(tblresult);
>     return False;
>@@ -1326,7 +1326,7 @@
>   memmove((char *)&new_obj, obj, sizeof (new_obj));
>   ta_maxcol = obj->TA_data.ta_maxcol;
>   
>-  if(!(ecol = (entry_col*)malloc(ta_maxcol*sizeof(entry_col)))) {
>+  if(!(ecol = (entry_col*)malloc_array(ta_maxcol, sizeof(entry_col)))) {
>     DEBUG(0, ("memory allocation failure\n"));
>     nis_freeresult(result);
>     return False;
>diff -Ebru samba-2.2.8a.orig/source/popt/popt.c samba-2.2.8a/source/popt/popt.c
>--- samba-2.2.8a.orig/source/popt/popt.c	2002-04-30 17:02:33.000000000 +0200
>+++ samba-2.2.8a/source/popt/popt.c	2004-12-16 18:11:29.000000000 +0100
>@@ -65,7 +65,7 @@
>     con->execs = NULL;
>     con->numExecs = 0;
>     con->finalArgvAlloced = argc * 2;
>-    con->finalArgv = calloc( con->finalArgvAlloced, sizeof(*con->finalArgv) );
>+    con->finalArgv = calloc_array( con->finalArgvAlloced, sizeof(*con->finalArgv) );
>     con->execAbsolute = 1;
>     con->arg_strip = NULL;
> 
>@@ -158,8 +158,8 @@
>        time 'round */
>     if ((con->finalArgvCount + 1) >= (con->finalArgvAlloced)) {
> 	con->finalArgvAlloced += 10;
>-	con->finalArgv = realloc(con->finalArgv,
>-			sizeof(*con->finalArgv) * con->finalArgvAlloced);
>+	con->finalArgv = realloc_array(con->finalArgv,
>+			sizeof(*con->finalArgv), con->finalArgvAlloced);
>     }
> 
>     i = con->finalArgvCount++;
>@@ -221,7 +221,7 @@
>     int pos = 0;
>     const char * script = con->doExec->script;
> 
>-    argv = malloc(sizeof(*argv) *
>+    argv = malloc_array(sizeof(*argv),
> 			(6 + con->numLeftovers + con->finalArgvCount));
> 
>     if (!con->execAbsolute && strchr(script, '/')) return;
>@@ -677,10 +677,10 @@
> 
>     /* SunOS won't realloc(NULL, ...) */
>     if (!con->aliases)
>-	con->aliases = malloc(sizeof(newAlias) * con->numAliases);
>+	con->aliases = malloc_array(sizeof(newAlias), con->numAliases);
>     else
>-	con->aliases = realloc(con->aliases,
>-			       sizeof(newAlias) * con->numAliases);
>+	con->aliases = realloc_array(con->aliases,
>+			       sizeof(newAlias), con->numAliases);
>     alias = con->aliases + aliasNum;
> 
>     alias->longName = (newAlias.longName)
>diff -Ebru samba-2.2.8a.orig/source/popt/poptconfig.c samba-2.2.8a/source/popt/poptconfig.c
>--- samba-2.2.8a.orig/source/popt/poptconfig.c	2002-04-30 17:02:33.000000000 +0200
>+++ samba-2.2.8a/source/popt/poptconfig.c	2004-12-16 15:55:34.000000000 +0100
>@@ -40,8 +40,8 @@
> 	alias.longName = longName, alias.shortName = shortName;
> 	poptAddAlias(con, alias, 0);
>     } else if (!strcmp(entryType, "exec")) {
>-	con->execs = realloc(con->execs,
>-				sizeof(*con->execs) * (con->numExecs + 1));
>+	con->execs = realloc_array(con->execs,
>+				sizeof(*con->execs), (con->numExecs + 1));
> 	if (longName)
> 	    con->execs[con->numExecs].longName = xstrdup(longName);
> 	else
>diff -Ebru samba-2.2.8a.orig/source/popt/poptparse.c samba-2.2.8a/source/popt/poptparse.c
>--- samba-2.2.8a.orig/source/popt/poptparse.c	2002-04-30 17:02:33.000000000 +0200
>+++ samba-2.2.8a/source/popt/poptparse.c	2004-12-16 15:56:04.000000000 +0100
>@@ -40,7 +40,7 @@
>     const char * src;
>     char quote = '\0';
>     int argvAlloced = POPT_ARGV_ARRAY_GROW_DELTA;
>-    const char ** argv = malloc(sizeof(*argv) * argvAlloced);
>+    const char ** argv = malloc_array(sizeof(*argv), argvAlloced);
>     int argc = 0;
>     int buflen = strlen(s) + 1;
>     char *buf0 = calloc(buflen, 1);
>@@ -67,7 +67,7 @@
> 		buf++, argc++;
> 		if (argc == argvAlloced) {
> 		    argvAlloced += POPT_ARGV_ARRAY_GROW_DELTA;
>-		    argv = realloc(argv, sizeof(*argv) * argvAlloced);
>+		    argv = realloc_array(argv, sizeof(*argv), argvAlloced);
> 		}
> 		argv[argc] = buf;
> 	    }
>diff -Ebru samba-2.2.8a.orig/source/printing/nt_printing.c samba-2.2.8a/source/printing/nt_printing.c
>--- samba-2.2.8a.orig/source/printing/nt_printing.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/printing/nt_printing.c	2004-12-16 18:28:00.000000000 +0100
>@@ -448,7 +448,7 @@
> 		SAFE_FREE(dbuf.dptr);
> 		if (ret != dbuf.dsize) continue;
> 
>-		tl = Realloc(*list, sizeof(nt_forms_struct)*(n+1));
>+		tl = realloc_array(*list, sizeof(nt_forms_struct), (n+1));
> 		if (!tl) {
> 			DEBUG(0,("get_ntforms: Realloc fail.\n"));
> 			return 0;
>@@ -519,7 +519,7 @@
> 	}
> 
> 	if (update==False) {
>-		if((tl=Realloc(*list, (n+1)*sizeof(nt_forms_struct))) == NULL) {
>+		if((tl=realloc_array(*list, (n+1), sizeof(nt_forms_struct))) == NULL) {
> 			DEBUG(0,("add_a_form: failed to enlarge forms list!\n"));
> 			return False;
> 		}
>@@ -627,7 +627,7 @@
> 	     newkey = tdb_nextkey(tdb_drivers, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
> 		if (strncmp(kbuf.dptr, key, strlen(key)) != 0) continue;
> 		
>-		if((fl = Realloc(*list, sizeof(fstring)*(total+1))) == NULL) {
>+		if((fl = realloc_array(*list, sizeof(fstring), (total+1))) == NULL) {
> 			DEBUG(0,("get_ntdrivers: failed to enlarge list!\n"));
> 			return -1;
> 		}
>@@ -1744,7 +1744,7 @@
> 	fstrcpy(info.configfile, "");
> 	fstrcpy(info.helpfile, "");
> 
>-	if ((info.dependentfiles=(fstring *)malloc(2*sizeof(fstring))) == NULL)
>+	if ((info.dependentfiles=(fstring *)malloc_array(2, sizeof(fstring))) == NULL)
> 		return WERR_NOMEM;
> 
> 	memset(info.dependentfiles, '\0', 2*sizeof(fstring));
>@@ -1796,8 +1796,8 @@
> 	while (len < dbuf.dsize) {
> 		fstring *tddfs;
> 
>-		tddfs = (fstring *)Realloc(driver.dependentfiles,
>-							 sizeof(fstring)*(i+2));
>+		tddfs = (fstring *)realloc_array(driver.dependentfiles,
>+							 sizeof(fstring), (i+2));
> 		if (tddfs == NULL) {
> 			DEBUG(0,("get_a_printer_driver_3: failed to enlarge buffer!\n"));
> 			break;
>@@ -3598,7 +3598,7 @@
> 	/* exited because it exist */
> 	*type=param->type;		
> 	StrnCpy(value, param->value, sizeof(fstring)-1);
>-	*data=(uint8 *)malloc(param->data_len*sizeof(uint8));
>+	*data=(uint8 *)malloc_array(param->data_len, sizeof(uint8));
> 	if(*data == NULL)
> 		return False;
> 	ZERO_STRUCTP(*data);
>@@ -3638,7 +3638,7 @@
> 		/* exited because it exist */
> 		*type=param->type;	
> 		
>-		*data=(uint8 *)malloc(param->data_len*sizeof(uint8));
>+		*data=(uint8 *)malloc_array(param->data_len, sizeof(uint8));
> 		if(*data == NULL)
> 			return False;
> 		memcpy(*data, param->data, param->data_len);
>diff -Ebru samba-2.2.8a.orig/source/printing/print_cups.c samba-2.2.8a/source/printing/print_cups.c
>--- samba-2.2.8a.orig/source/printing/print_cups.c	2003-02-05 17:25:46.000000000 +0100
>+++ samba-2.2.8a/source/printing/print_cups.c	2004-12-16 16:00:36.000000000 +0100
>@@ -920,7 +920,7 @@
> 		{
> 			qalloc += 16;
> 
>-			temp = Realloc(queue, sizeof(print_queue_struct) * qalloc);
>+			temp = realloc_array(queue, sizeof(print_queue_struct), qalloc);
> 
> 			if (temp == NULL)
> 			{
>diff -Ebru samba-2.2.8a.orig/source/printing/print_generic.c samba-2.2.8a/source/printing/print_generic.c
>--- samba-2.2.8a.orig/source/printing/print_generic.c	2002-07-08 16:27:57.000000000 +0200
>+++ samba-2.2.8a/source/printing/print_generic.c	2004-12-16 16:00:49.000000000 +0100
>@@ -218,7 +218,7 @@
> 	qcount = 0;
> 	ZERO_STRUCTP(status);
> 	if (numlines)
>-		queue = (print_queue_struct *)malloc(sizeof(print_queue_struct)*(numlines+1));
>+		queue = (print_queue_struct *)malloc_array(sizeof(print_queue_struct), (numlines+1));
> 
> 	if (queue) {
> 		for (i=0; i<numlines; i++) {
>diff -Ebru samba-2.2.8a.orig/source/printing/printing.c samba-2.2.8a/source/printing/printing.c
>--- samba-2.2.8a.orig/source/printing/printing.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/printing/printing.c	2004-12-16 16:01:01.000000000 +0100
>@@ -1314,7 +1314,7 @@
> 
> 	/* Allocate the queue size. */
> 	if ((tstruct.queue = (print_queue_struct *)
>-	     malloc(sizeof(print_queue_struct)*tsc.count)) == NULL)
>+	     malloc_array(sizeof(print_queue_struct), tsc.count)) == NULL)
> 		return 0;
> 
> 	/*
>diff -Ebru samba-2.2.8a.orig/source/rpcclient/cmd_lsarpc.c samba-2.2.8a/source/rpcclient/cmd_lsarpc.c
>--- samba-2.2.8a.orig/source/rpcclient/cmd_lsarpc.c	2002-04-30 15:28:09.000000000 +0200
>+++ samba-2.2.8a/source/rpcclient/cmd_lsarpc.c	2004-12-16 16:02:25.000000000 +0100
>@@ -142,7 +142,7 @@
> 
> 	/* Convert arguments to sids */
> 
>-	sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * (argc - 1));
>+	sids = (DOM_SID *)talloc_array(mem_ctx, sizeof(DOM_SID), (argc - 1));
> 
> 	if (!sids) {
> 		printf("could not allocate memory for %d sids\n", argc - 1);
>diff -Ebru samba-2.2.8a.orig/source/rpcclient/cmd_samr.c samba-2.2.8a/source/rpcclient/cmd_samr.c
>--- samba-2.2.8a.orig/source/rpcclient/cmd_samr.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/rpcclient/cmd_samr.c	2004-12-16 16:02:50.000000000 +0100
>@@ -1045,7 +1045,7 @@
> 	/* Look up names */
> 
> 	num_names = argc - 2;
>-	names = (const char **)talloc(mem_ctx, sizeof(char *) * num_names);
>+	names = (const char **)talloc_array(mem_ctx, sizeof(char *), num_names);
> 
> 	for (i = 0; i < argc - 2; i++)
> 		names[i] = argv[i + 2];
>@@ -1106,7 +1106,7 @@
> 	/* Look up rids */
> 
> 	num_rids = argc - 1;
>-	rids = (uint32 *)talloc(mem_ctx, sizeof(uint32) * num_rids);
>+	rids = (uint32 *)talloc_array(mem_ctx, sizeof(uint32), num_rids);
> 
> 	for (i = 0; i < argc - 1; i++)
>                 sscanf(argv[i + 1], "%i", &rids[i]);
>diff -Ebru samba-2.2.8a.orig/source/rpcclient/cmd_spoolss.c samba-2.2.8a/source/rpcclient/cmd_spoolss.c
>--- samba-2.2.8a.orig/source/rpcclient/cmd_spoolss.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/rpcclient/cmd_spoolss.c	2004-12-16 16:03:05.000000000 +0100
>@@ -1031,7 +1031,7 @@
> 	/* allocate the space; add one extra slot for a terminating NULL.
> 	   Each filename is NULL terminated and the end contains a double
> 	   NULL */
>-	if ((info->dependentfiles=(uint16*)talloc(mem_ctx, (len+1)*sizeof(uint16))) == NULL)
>+	if ((info->dependentfiles=(uint16*)talloc_array(mem_ctx, (len+1), sizeof(uint16))) == NULL)
> 	{
> 		DEBUG(0,("init_drv_info_3_members: Unable to malloc memory for dependenfiles\n"));
> 		return False;
>diff -Ebru samba-2.2.8a.orig/source/rpcclient/rpcclient.c samba-2.2.8a/source/rpcclient/rpcclient.c
>--- samba-2.2.8a.orig/source/rpcclient/rpcclient.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/rpcclient/rpcclient.c	2004-12-16 16:03:39.000000000 +0100
>@@ -54,7 +54,7 @@
> 	if (!commands) 
> 		return NULL;
> 
>-	matches = (char **)malloc(sizeof(matches[0])*MAX_COMPLETIONS);
>+	matches = (char **)malloc_array(sizeof(matches[0]), MAX_COMPLETIONS);
> 	if (!matches) return NULL;
> 
> 	matches[count++] = strdup(text);
>@@ -463,7 +463,7 @@
> 
> 		/* Create argument list */
> 
>-		argv = (char **)malloc(sizeof(char *) * argc);
>+		argv = (char **)malloc_array(sizeof(char *), argc);
>                 memset(argv, 0, sizeof(char *) * argc);
> 
> 		if (!argv) {
>diff -Ebru samba-2.2.8a.orig/source/rpc_client/cli_spoolss_notify.c samba-2.2.8a/source/rpc_client/cli_spoolss_notify.c
>--- samba-2.2.8a.orig/source/rpc_client/cli_spoolss_notify.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/rpc_client/cli_spoolss_notify.c	2004-12-16 16:01:57.000000000 +0100
>@@ -328,7 +328,7 @@
> 		{
> 			DEBUG(10,("build_notify_data: %s set on [%s][%d]\n", msg_table[i].name,
> 				printer->info_2->printername, idx));
>-			if ((data=Realloc(*notify_data, (idx+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
>+			if ((data=realloc_array(*notify_data, (idx+1), sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
> 				DEBUG(0,("build_notify_data: Realloc() failed with size [%d]!\n",
> 					(idx+1)*sizeof(SPOOL_NOTIFY_INFO_DATA)));
> 				return -1;
>diff -Ebru samba-2.2.8a.orig/source/rpc_parse/parse_lsa.c samba-2.2.8a/source/rpc_parse/parse_lsa.c
>--- samba-2.2.8a.orig/source/rpc_parse/parse_lsa.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/rpc_parse/parse_lsa.c	2004-12-16 17:49:37.000000000 +0100
>@@ -686,7 +686,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		d_q->auditsettings = (uint32 *)talloc_zero(ps->mem_ctx, d_q->count2 * sizeof(uint32));
>+		d_q->auditsettings = (uint32 *)talloc_zero_array(ps->mem_ctx, d_q->count2, sizeof(uint32));
> 	}
> 
> 	if (d_q->auditsettings == NULL) {
>diff -Ebru samba-2.2.8a.orig/source/rpc_parse/parse_misc.c samba-2.2.8a/source/rpc_parse/parse_misc.c
>--- samba-2.2.8a.orig/source/rpc_parse/parse_misc.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/rpc_parse/parse_misc.c	2004-12-16 17:50:52.000000000 +0100
>@@ -950,7 +950,7 @@
> 	to->uni_str_len = i;
> 
> 	/* allocate the space and copy the string buffer */
>-	to->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), sizeof(uint16)*(to->uni_str_len));
>+	to->buffer = (uint16 *)talloc_zero_array(get_talloc_ctx(), sizeof(uint16), (to->uni_str_len));
> 	if (to->buffer == NULL)
> 		smb_panic("init_unistr2_from_unistr: malloc fail\n");
> 	memcpy(to->buffer, from->buffer, to->uni_max_len*sizeof(uint16));
>diff -Ebru samba-2.2.8a.orig/source/rpc_parse/parse_net.c samba-2.2.8a/source/rpc_parse/parse_net.c
>--- samba-2.2.8a.orig/source/rpc_parse/parse_net.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/rpc_parse/parse_net.c	2004-12-16 17:50:23.000000000 +0100
>@@ -824,7 +824,7 @@
> 			;
> 
> 		/* Now allocate space for them. */
>-		*ppsids = (DOM_SID2 *)talloc_zero(ctx, count * sizeof(DOM_SID2));
>+		*ppsids = (DOM_SID2 *)talloc_zero_array(ctx, count, sizeof(DOM_SID2));
> 		if (*ppsids == NULL)
> 			return 0;
> 
>@@ -1291,7 +1291,7 @@
> 	/* always have at least one group == the user's primary group */
> 	usr->num_groups2 = num_groups+1;
> 
>-	usr->gids = (DOM_GID *)talloc_zero(ctx,sizeof(DOM_GID) * (num_groups+1));
>+	usr->gids = (DOM_GID *)talloc_zero_array(ctx,sizeof(DOM_GID), (num_groups+1));
> 	if (usr->gids == NULL)
> 		return;
> 
>@@ -2130,7 +2130,7 @@
> 			return False;
> 		}
> 
>-                info->rids = talloc(ps->mem_ctx, sizeof(uint32) *
>+                info->rids = talloc_array(ps->mem_ctx, sizeof(uint32),
>                                     info->num_members2);
> 
>                 if (info->rids == NULL) {
>@@ -2245,7 +2245,7 @@
> 			return False;
> 		}
> 
>-                info->ptr_sids = talloc(ps->mem_ctx, sizeof(uint32) *
>+                info->ptr_sids = talloc_array(ps->mem_ctx, sizeof(uint32),
>                                         info->num_sids);
>                 
>                 if (info->ptr_sids == NULL) {
>@@ -2261,7 +2261,7 @@
>                                 return False;
> 		}
> 
>-                info->sids = talloc(ps->mem_ctx, sizeof(DOM_SID2) *
>+                info->sids = talloc_array(ps->mem_ctx, sizeof(DOM_SID2),
>                                     info->num_sids);
> 
>                 if (info->sids == NULL) {
>@@ -2403,7 +2403,7 @@
> 
>                         if (r_s->num_deltas2 > 0) {
>                                 r_s->hdr_deltas = (SAM_DELTA_HDR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas2 *
>+                                        talloc_array(ps->mem_ctx, r_s->num_deltas2,
>                                                sizeof(SAM_DELTA_HDR));
>                           
>                                 if (r_s->hdr_deltas == NULL) {
>@@ -2424,7 +2424,7 @@
> 
>                         if (r_s->num_deltas2 > 0) {
>                                 r_s->deltas = (SAM_DELTA_CTR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas2 *
>+                                        talloc_array(ps->mem_ctx, r_s->num_deltas2,
>                                                sizeof(SAM_DELTA_CTR));
> 
>                                 if (r_s->deltas == NULL) {
>@@ -2539,7 +2539,7 @@
> 		{
>                         if (r_s->num_deltas > 0) {
>                                 r_s->hdr_deltas = (SAM_DELTA_HDR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas *
>+                                        talloc_array(ps->mem_ctx, r_s->num_deltas,
>                                                sizeof(SAM_DELTA_HDR));
>                                 if (r_s->hdr_deltas == NULL) {
>                                         DEBUG(0, ("error tallocating memory "
>@@ -2557,7 +2557,7 @@
>                         
>                         if (r_s->num_deltas > 0) {
>                                 r_s->deltas = (SAM_DELTA_CTR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas *
>+                                        talloc_array(ps->mem_ctx, r_s->num_deltas,
>                                                sizeof(SAM_DELTA_CTR));
> 
>                                 if (r_s->deltas == NULL) {
>diff -Ebru samba-2.2.8a.orig/source/rpc_parse/parse_samr.c samba-2.2.8a/source/rpc_parse/parse_samr.c
>--- samba-2.2.8a.orig/source/rpc_parse/parse_samr.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/rpc_parse/parse_samr.c	2004-12-16 17:52:01.000000000 +0100
>@@ -1451,11 +1451,11 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	sam->sam=(SAM_ENTRY1 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY1));
>+	sam->sam=(SAM_ENTRY1 *)talloc_array(ctx, num_entries, sizeof(SAM_ENTRY1));
> 	if (!sam->sam)
> 		return NT_STATUS_NO_MEMORY;
> 
>-	sam->str=(SAM_STR1 *)talloc(ctx, num_entries*sizeof(SAM_STR1));
>+	sam->str=(SAM_STR1 *)talloc_array(ctx, num_entries, sizeof(SAM_STR1));
> 	if (!sam->str)
> 		return NT_STATUS_NO_MEMORY;
> 
>@@ -1554,10 +1554,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY2 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY2))))
>+	if (!(sam->sam=(SAM_ENTRY2 *)talloc_array(ctx, num_entries, sizeof(SAM_ENTRY2))))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR2 *)talloc(ctx, num_entries*sizeof(SAM_STR2))))
>+	if (!(sam->str=(SAM_STR2 *)talloc_array(ctx, num_entries, sizeof(SAM_STR2))))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -1652,10 +1652,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY3 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY3))))
>+	if (!(sam->sam=(SAM_ENTRY3 *)talloc_array(ctx, num_entries, sizeof(SAM_ENTRY3))))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR3 *)talloc(ctx, num_entries*sizeof(SAM_STR3))))
>+	if (!(sam->str=(SAM_STR3 *)talloc_array(ctx, num_entries, sizeof(SAM_STR3))))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -1747,10 +1747,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY4 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY4))))
>+	if (!(sam->sam=(SAM_ENTRY4 *)talloc_array(ctx, num_entries, sizeof(SAM_ENTRY4))))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR4 *)talloc(ctx, num_entries*sizeof(SAM_STR4))))
>+	if (!(sam->str=(SAM_STR4 *)talloc_array(ctx, num_entries, sizeof(SAM_STR4))))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -1838,10 +1838,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY5 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY5))))
>+	if (!(sam->sam=(SAM_ENTRY5 *)talloc_array(ctx, num_entries, sizeof(SAM_ENTRY5))))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR5 *)talloc(ctx, num_entries*sizeof(SAM_STR5))))
>+	if (!(sam->str=(SAM_STR5 *)talloc_array(ctx, num_entries, sizeof(SAM_STR5))))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -3918,7 +3918,7 @@
> 	q_u->flags = flags;
> 	q_u->ptr = 0;
> 	q_u->num_rids2 = num_rids;
>-	q_u->rid = (uint32 *)talloc_zero(ctx, num_rids * sizeof(q_u->rid[0]));
>+	q_u->rid = (uint32 *)talloc_zero_array(ctx, num_rids, sizeof(q_u->rid[0]));
> 	if (q_u->rid == NULL) {
> 		q_u->num_rids1 = 0;
> 		q_u->num_rids2 = 0;
>@@ -4550,10 +4550,10 @@
> 	q_u->ptr = 0;
> 	q_u->num_names2 = num_names;
> 
>-	if (!(q_u->hdr_name = (UNIHDR *)talloc_zero(ctx, num_names * sizeof(UNIHDR))))
>+	if (!(q_u->hdr_name = (UNIHDR *)talloc_zero_array(ctx, num_names, sizeof(UNIHDR))))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(q_u->uni_name = (UNISTR2 *)talloc_zero(ctx, num_names * sizeof(UNISTR2))))
>+	if (!(q_u->uni_name = (UNISTR2 *)talloc_zero_array(ctx, num_names, sizeof(UNISTR2))))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	for (i = 0; i < num_names; i++) {
>@@ -4642,9 +4642,9 @@
> 		r_u->ptr_rids = 1;
> 		r_u->num_rids2 = num_rids;
> 
>-		if (!(r_u->rids = (uint32 *)talloc_zero(ctx, sizeof(uint32)*num_rids)))
>+		if (!(r_u->rids = (uint32 *)talloc_zero_array(ctx, sizeof(uint32), num_rids)))
> 			return NT_STATUS_NO_MEMORY;
>-		if (!(r_u->types = (uint32 *)talloc_zero(ctx, sizeof(uint32)*num_rids)))
>+		if (!(r_u->types = (uint32 *)talloc_zero_array(ctx, sizeof(uint32), num_rids)))
> 			return NT_STATUS_NO_MEMORY;
> 
> 		if (!r_u->rids || !r_u->types)
>diff -Ebru samba-2.2.8a.orig/source/rpc_parse/parse_sec.c samba-2.2.8a/source/rpc_parse/parse_sec.c
>--- samba-2.2.8a.orig/source/rpc_parse/parse_sec.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/rpc_parse/parse_sec.c	2004-12-16 16:16:20.000000000 +0100
>@@ -130,7 +130,7 @@
> 	   positive number. */
> 
> 	if ((num_aces) && 
>-            ((dst->ace = (SEC_ACE *)talloc(ctx, sizeof(SEC_ACE) * num_aces)) 
>+            ((dst->ace = (SEC_ACE *)talloc_array(ctx, sizeof(SEC_ACE), num_aces)) 
>              == NULL)) {
> 		return NULL;
> 	}
>diff -Ebru samba-2.2.8a.orig/source/rpc_parse/parse_spoolss.c samba-2.2.8a/source/rpc_parse/parse_spoolss.c
>--- samba-2.2.8a.orig/source/rpc_parse/parse_spoolss.c	2003-03-14 22:34:48.000000000 +0100
>+++ samba-2.2.8a/source/rpc_parse/parse_spoolss.c	2004-12-16 18:29:08.000000000 +0100
>@@ -1930,7 +1930,7 @@
> 
> 			/* Yes this should be malloc not talloc. Don't change. */
> 
>-			chaine.buffer = malloc((q-p+1)*sizeof(uint16));
>+			chaine.buffer = malloc_array((q-p+1), sizeof(uint16));
> 			if (chaine.buffer == NULL)
> 				return False;
> 
>@@ -5009,7 +5009,7 @@
> 	while (src < ((char *)buf5->buffer) + buf5->buf_len*2) {
> 		unistr_to_dos(f, src, sizeof(f)-1);
> 		src = skip_unibuf(src, 2*buf5->buf_len - PTR_DIFF(src,buf5->buffer));
>-		tar = (fstring *)Realloc(*ar, sizeof(fstring)*(n+2));
>+		tar = (fstring *)realloc_array(*ar, sizeof(fstring), (n+2));
> 		if (!tar)
> 			return False;
> 		else
>@@ -5973,7 +5973,7 @@
> 	(*param)->data_len=len;
> 	
> 	if (len) {
>-		(*param)->data=(uint8 *)malloc(len * sizeof(uint8));
>+		(*param)->data=(uint8 *)malloc_array(len, sizeof(uint8));
> 		if((*param)->data == NULL)
> 			return False;
> 		memcpy((*param)->data, data, len);
>diff -Ebru samba-2.2.8a.orig/source/rpc_server/srv_dfs_nt.c samba-2.2.8a/source/rpc_server/srv_dfs_nt.c
>--- samba-2.2.8a.orig/source/rpc_server/srv_dfs_nt.c	2002-06-06 21:16:18.000000000 +0200
>+++ samba-2.2.8a/source/rpc_server/srv_dfs_nt.c	2004-12-16 16:20:49.000000000 +0100
>@@ -82,8 +82,8 @@
>   else
>     jn.referral_count = 1;
> 
>-  jn.referral_list = (struct referral*) talloc(p->mem_ctx, jn.referral_count 
>-					       * sizeof(struct referral));
>+  jn.referral_list = (struct referral*) talloc_array(p->mem_ctx, jn.referral_count, 
>+					       sizeof(struct referral));
> 
>   if(jn.referral_list == NULL)
>     {
>@@ -245,7 +245,7 @@
>       dfs3[i].ptr_storages = 1;
>      
>       /* also enumerate the storages */
>-      dfs3[i].storages = (DFS_STORAGE_INFO*) talloc(ctx, j[i].referral_count * 
>+      dfs3[i].storages = (DFS_STORAGE_INFO*) talloc_array(ctx, j[i].referral_count, 
> 						    sizeof(DFS_STORAGE_INFO));
>       if (!dfs3[i].storages)
>         return False;
>@@ -288,7 +288,7 @@
>     case 1:
>       {
> 	DFS_INFO_1* dfs1;
>-	dfs1 = (DFS_INFO_1*) talloc(ctx, num_jn * sizeof(DFS_INFO_1));
>+	dfs1 = (DFS_INFO_1*) talloc_array(ctx, num_jn, sizeof(DFS_INFO_1));
> 	if (!dfs1)
> 		return WERR_NOMEM;
> 	init_reply_dfs_info_1(jn, dfs1, num_jn);
>@@ -298,7 +298,7 @@
>     case 2:
>       {
> 	DFS_INFO_2* dfs2;
>-	dfs2 = (DFS_INFO_2*) talloc(ctx, num_jn * sizeof(DFS_INFO_2));
>+	dfs2 = (DFS_INFO_2*) talloc_array(ctx, num_jn, sizeof(DFS_INFO_2));
> 	if (!dfs2)
> 		return WERR_NOMEM;
> 	init_reply_dfs_info_2(jn, dfs2, num_jn);
>@@ -308,7 +308,7 @@
>     case 3:
>       {
> 	DFS_INFO_3* dfs3;
>-	dfs3 = (DFS_INFO_3*) talloc(ctx, num_jn * sizeof(DFS_INFO_3));
>+	dfs3 = (DFS_INFO_3*) talloc_array(ctx, num_jn, sizeof(DFS_INFO_3));
> 	if (!dfs3)
> 		return WERR_NOMEM;
> 	init_reply_dfs_info_3(ctx, jn, dfs3, num_jn);
>diff -Ebru samba-2.2.8a.orig/source/rpc_server/srv_lsa_nt.c samba-2.2.8a/source/rpc_server/srv_lsa_nt.c
>--- samba-2.2.8a.orig/source/rpc_server/srv_lsa_nt.c	2002-06-06 23:31:34.000000000 +0200
>+++ samba-2.2.8a/source/rpc_server/srv_lsa_nt.c	2004-12-16 17:48:28.000000000 +0100
>@@ -218,13 +218,13 @@
> 	/* Allocate memory for list of names */
> 
> 	if (num_entries > 0) {
>-		if (!(trn->name = (LSA_TRANS_NAME *)talloc(ctx, sizeof(LSA_TRANS_NAME) *
>+		if (!(trn->name = (LSA_TRANS_NAME *)talloc_array(ctx, sizeof(LSA_TRANS_NAME),
> 							  num_entries))) {
> 			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
> 			return;
> 		}
> 
>-		if (!(trn->uni_name = (UNISTR2 *)talloc(ctx, sizeof(UNISTR2) * 
>+		if (!(trn->uni_name = (UNISTR2 *)talloc_array(ctx, sizeof(UNISTR2),
> 							num_entries))) {
> 			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
> 			return;
>@@ -385,7 +385,7 @@
> 			info->id2.auditing_enabled = 1;
> 			info->id2.count1 = 7;
> 			info->id2.count2 = 7;
>-			if ((info->id2.auditsettings = (uint32 *)talloc(p->mem_ctx,7*sizeof(uint32))) == NULL)
>+			if ((info->id2.auditsettings = (uint32 *)talloc_array(p->mem_ctx, 7, sizeof(uint32))) == NULL)
> 				return NT_STATUS_NO_MEMORY;
> 			for (i = 0; i < 7; i++)
> 				info->id2.auditsettings[i] = 3;
>@@ -566,7 +566,7 @@
> 	if (enum_context >= PRIV_ALL_INDEX)
> 		return NT_STATUS_UNABLE_TO_FREE_VM;
> 
>-	entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX-enum_context));
>+	entries = (LSA_PRIV_ENTRY *)talloc_zero_array(p->mem_ctx, sizeof(LSA_PRIV_ENTRY), (PRIV_ALL_INDEX-enum_context));
> 	if (entries==NULL)
> 		return NT_STATUS_NO_MEMORY;
> 
>diff -Ebru samba-2.2.8a.orig/source/rpc_server/srv_samr_nt.c samba-2.2.8a/source/rpc_server/srv_samr_nt.c
>--- samba-2.2.8a.orig/source/rpc_server/srv_samr_nt.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/rpc_server/srv_samr_nt.c	2004-12-16 17:46:35.000000000 +0100
>@@ -175,8 +175,8 @@
> 		if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) {
> 		
> 			DEBUG(10,("load_sampwd_entries: allocating more memory\n"));
>-			pwd_array=(DISP_USER_INFO *)Realloc(info->disp_info.disp_user_info, 
>-			                  (info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(DISP_USER_INFO));
>+			pwd_array=(DISP_USER_INFO *)realloc_array(info->disp_info.disp_user_info, 
>+			                  (info->disp_info.num_user_account+MAX_SAM_ENTRIES), sizeof(DISP_USER_INFO));
> 
> 			if (pwd_array==NULL)
> 				return NT_STATUS_NO_MEMORY;
>@@ -214,7 +214,7 @@
> 	static BOOL group_map_init;
> 	extern DOM_SID global_sam_sid;
> 
>-	*ret_map = (GROUP_MAP *)malloc(sizeof(GROUP_MAP)*2);
>+	*ret_map = (GROUP_MAP *)malloc_array(sizeof(GROUP_MAP), 2);
> 	if (!ret_map)
> 		return 2;
> 	
>@@ -268,7 +268,7 @@
> 
> 	info->disp_info.num_group_account=group_entries;
> 
>-	grp_array=(DISP_GROUP_INFO *)malloc(info->disp_info.num_group_account*sizeof(DISP_GROUP_INFO));
>+	grp_array=(DISP_GROUP_INFO *)malloc_array(info->disp_info.num_group_account, sizeof(DISP_GROUP_INFO));
> 
> 	if (group_entries!=0 && grp_array==NULL) {
> 		return NT_STATUS_NO_MEMORY;
>@@ -557,9 +557,9 @@
> 	if (num_sam_entries == 0)
> 		return;
> 
>-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
>+	sam = (SAM_ENTRY *)talloc_zero_array(ctx, sizeof(SAM_ENTRY), num_sam_entries);
> 
>-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
>+	uni_name = (UNISTR2 *)talloc_zero_array(ctx, sizeof(UNISTR2), num_sam_entries);
> 
> 	if (sam == NULL || uni_name == NULL) {
> 		DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
>@@ -644,9 +644,9 @@
> 	if (num_sam_entries == 0)
> 		return;
> 
>-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
>+	sam = (SAM_ENTRY *)talloc_zero_array(ctx, sizeof(SAM_ENTRY), num_sam_entries);
> 
>-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
>+	uni_name = (UNISTR2 *)talloc_zero_array(ctx, sizeof(UNISTR2), num_sam_entries);
> 
> 	if (sam == NULL || uni_name == NULL) {
> 		DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
>@@ -996,7 +996,7 @@
> 	switch (q_u->switch_level) {
> 	case 0x1:
> 		if (max_entries) {
>-			if (!(ctr->sam.info1 = (SAM_DISPINFO_1 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_1))))
>+			if (!(ctr->sam.info1 = (SAM_DISPINFO_1 *)talloc_zero_array(p->mem_ctx,max_entries, sizeof(SAM_DISPINFO_1))))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context, info->disp_info.disp_user_info);
>@@ -1005,7 +1005,7 @@
> 		break;
> 	case 0x2:
> 		if (max_entries) {
>-			if (!(ctr->sam.info2 = (SAM_DISPINFO_2 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_2))))
>+			if (!(ctr->sam.info2 = (SAM_DISPINFO_2 *)talloc_zero_array(p->mem_ctx,max_entries, sizeof(SAM_DISPINFO_2))))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context, info->disp_info.disp_user_info);
>@@ -1014,7 +1014,7 @@
> 		break;
> 	case 0x3:
> 		if (max_entries) {
>-			if (!(ctr->sam.info3 = (SAM_DISPINFO_3 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_3))))
>+			if (!(ctr->sam.info3 = (SAM_DISPINFO_3 *)talloc_zero_array(p->mem_ctx,max_entries, sizeof(SAM_DISPINFO_3))))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_3(p->mem_ctx, ctr->sam.info3, max_entries, enum_context, info->disp_info.disp_group_info);
>@@ -1023,7 +1023,7 @@
> 		break;
> 	case 0x4:
> 		if (max_entries) {
>-			if (!(ctr->sam.info4 = (SAM_DISPINFO_4 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_4))))
>+			if (!(ctr->sam.info4 = (SAM_DISPINFO_4 *)talloc_zero_array(p->mem_ctx,max_entries, sizeof(SAM_DISPINFO_4))))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_4(p->mem_ctx, ctr->sam.info4, max_entries, enum_context, info->disp_info.disp_user_info);
>@@ -1032,7 +1032,7 @@
> 		break;
> 	case 0x5:
> 		if (max_entries) {
>-			if (!(ctr->sam.info5 = (SAM_DISPINFO_5 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_5))))
>+			if (!(ctr->sam.info5 = (SAM_DISPINFO_5 *)talloc_zero_array(p->mem_ctx,max_entries, sizeof(SAM_DISPINFO_5))))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_5(p->mem_ctx, ctr->sam.info5, max_entries, enum_context, info->disp_info.disp_group_info);
>@@ -1292,11 +1292,11 @@
> 	*pp_hdr_name = NULL;
> 
> 	if (num_names != 0) {
>-		hdr_name = (UNIHDR *)talloc_zero(ctx, sizeof(UNIHDR)*num_names);
>+		hdr_name = (UNIHDR *)talloc_zero_array(ctx, sizeof(UNIHDR), num_names);
> 		if (hdr_name == NULL)
> 			return False;
> 
>-		uni_name = (UNISTR2 *)talloc_zero(ctx,sizeof(UNISTR2)*num_names);
>+		uni_name = (UNISTR2 *)talloc_zero_array(ctx,sizeof(UNISTR2), num_names);
> 		if (uni_name == NULL)
> 			return False;
> 	}
>@@ -1342,7 +1342,7 @@
> 	}
> 
> 	if (num_rids) {
>-		if ((group_attrs = (uint32 *)talloc_zero(p->mem_ctx, num_rids * sizeof(uint32))) == NULL)
>+		if ((group_attrs = (uint32 *)talloc_zero_array(p->mem_ctx, num_rids, sizeof(uint32))) == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 	}
> 
>@@ -2078,8 +2078,8 @@
> 	if (num_sam_entries == 0)
> 		return True;
> 
>-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
>-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
>+	sam = (SAM_ENTRY *)talloc_zero_array(ctx, sizeof(SAM_ENTRY), num_sam_entries);
>+	uni_name = (UNISTR2 *)talloc_zero_array(ctx, sizeof(UNISTR2), num_sam_entries);
> 
> 	if (sam == NULL || uni_name == NULL)
> 		return False;
>@@ -2608,7 +2608,7 @@
> 	int num_rids;
> 
> 	num_rids = 1;
>-	rid=(uint32 *)talloc_zero(p->mem_ctx, num_rids*sizeof(uint32));
>+	rid=(uint32 *)talloc_zero_array(p->mem_ctx, num_rids, sizeof(uint32));
> 	if (rid == NULL)
> 		return NT_STATUS_NO_MEMORY;
> 
>diff -Ebru samba-2.2.8a.orig/source/rpc_server/srv_spoolss_nt.c samba-2.2.8a/source/rpc_server/srv_spoolss_nt.c
>--- samba-2.2.8a.orig/source/rpc_server/srv_spoolss_nt.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/rpc_server/srv_spoolss_nt.c	2004-12-16 16:39:45.000000000 +0100
>@@ -880,7 +880,7 @@
> 	
> 	len = unistrlen(devmode->devicename.buffer);
> 	if (len != -1) {
>-		d->devicename.buffer = talloc(ctx, len*2);
>+		d->devicename.buffer = talloc_array(ctx, len, 2);
> 		if (unistrcpy(d->devicename.buffer, devmode->devicename.buffer) != len)
> 			return NULL;
> 	}
>@@ -888,7 +888,7 @@
> 
> 	len = unistrlen(devmode->formname.buffer);
> 	if (len != -1) {
>-		d->devicename.buffer = talloc(ctx, len*2);
>+		d->devicename.buffer = talloc_array(ctx, len, 2);
> 		if (unistrcpy(d->formname.buffer, devmode->formname.buffer) != len)
> 			return NULL;
> 	}
>@@ -1305,7 +1305,7 @@
> 	if ((devmode->driverextra != 0) && (devmode->private != NULL)) {
> 		SAFE_FREE(nt_devmode->private);
> 		nt_devmode->driverextra=devmode->driverextra;
>-		if((nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8))) == NULL)
>+		if((nt_devmode->private=(uint8 *)malloc_array(nt_devmode->driverextra, sizeof(uint8))) == NULL)
> 			return False;
> 		memcpy(nt_devmode->private, devmode->private, nt_devmode->driverextra);
> 	}
>@@ -1521,7 +1521,7 @@
> 		
> 	if (!strcmp(value, "W3SvcInstalled")) {
> 		*type = 0x4;
>-		if((*data = (uint8 *)talloc_zero(ctx, 4*sizeof(uint8) )) == NULL)
>+		if((*data = (uint8 *)talloc_zero_array(ctx, 4, sizeof(uint8) )) == NULL)
> 			return False;
> 		*needed = 0x4;			
> 		return True;
>@@ -1574,7 +1574,7 @@
> 		fstrcpy(string, string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH));
> 		*type = 0x1;			
> 		*needed = 2*(strlen(string)+1);		
>-		if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
>+		if((*data  = (uint8 *)talloc_array(ctx, ((*needed > in_size) ? *needed:in_size), sizeof(uint8))) == NULL)
> 			return False;
> 		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
> 		
>@@ -1590,7 +1590,7 @@
> 		pstring string="Windows NT x86";
> 		*type = 0x1;			
> 		*needed = 2*(strlen(string)+1);	
>-		if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
>+		if((*data  = (uint8 *)talloc_array(ctx, ((*needed > in_size) ? *needed:in_size), sizeof(uint8))) == NULL)
> 			return False;
> 		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
> 		for (i=0; i<strlen(string); i++) {
>@@ -1640,7 +1640,7 @@
> 	DEBUG(5,("getprinterdata_printer:allocating %d\n", in_size));
> 
> 	if (in_size) {
>-		if((*data  = (uint8 *)talloc(ctx, in_size *sizeof(uint8) )) == NULL) {
>+		if((*data  = (uint8 *)talloc_array(ctx, in_size, sizeof(uint8) )) == NULL) {
> 			return False;
> 		}
> 
>@@ -1711,7 +1711,7 @@
> 		DEBUG(5, ("value not found, allocating %d\n", *out_size));
> 		/* reply this param doesn't exist */
> 		if (*out_size) {
>-			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
>+			if((*data=(uint8 *)talloc_zero_array(p->mem_ctx, *out_size, sizeof(uint8))) == NULL)
> 				return WERR_NOMEM;
> 		} else {
> 			*data = NULL;
>@@ -2704,7 +2704,7 @@
> 		if (!search_notify(type, field, &j) )
> 			continue;
> 
>-		if((tid=(SPOOL_NOTIFY_INFO_DATA *)Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
>+		if((tid=(SPOOL_NOTIFY_INFO_DATA *)realloc_array(info->data, (info->count+1), sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
> 			DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n"));
> 			return False;
> 		}
>@@ -2760,7 +2760,7 @@
> 		if (!search_notify(type, field, &j) )
> 			continue;
> 
>-		if((tid=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
>+		if((tid=realloc_array(info->data, (info->count+1), sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
> 			DEBUG(2,("construct_notify_jobs_info: failed to enlarg buffer info->data!\n"));
> 			return False;
> 		}
>@@ -3420,7 +3420,7 @@
> 			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
> 
> 			if (construct_printer_info_1(flags, &current_prt, snum)) {
>-				if((tp=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_1))) == NULL) {
>+				if((tp=realloc_array(printers, (*returned +1), sizeof(PRINTER_INFO_1))) == NULL) {
> 					DEBUG(2,("enum_all_printers_info_1: failed to enlarge printers buffer!\n"));
> 					SAFE_FREE(printers);
> 					*returned=0;
>@@ -3589,7 +3589,7 @@
> 			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
> 				
> 			if (construct_printer_info_2(&current_prt, snum)) {
>-				if((tp=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_2))) == NULL) {
>+				if((tp=realloc_array(printers, (*returned +1), sizeof(PRINTER_INFO_2))) == NULL) {
> 					DEBUG(2,("enum_all_printers_info_2: failed to enlarge printers buffer!\n"));
> 					SAFE_FREE(printers);
> 					*returned = 0;
>@@ -4116,7 +4116,7 @@
> 		if (strlen(v) == 0) break;
> 		slprintf(line, sizeof(line)-1, "\\\\%s%s", servername, v);
> 		DEBUGADD(6,("%d:%s:%d\n", i, line, strlen(line)));
>-		if((tuary=Realloc(*uni_array, (j+strlen(line)+2)*sizeof(uint16))) == NULL) {
>+		if((tuary=realloc_array(*uni_array, (j+strlen(line)+2), sizeof(uint16))) == NULL) {
> 			DEBUG(2,("init_unistr_array: Realloc error\n" ));
> 			return;
> 		} else
>@@ -5529,7 +5529,7 @@
> 	JOB_INFO_1 *info;
> 	int i;
> 	
>-	info=(JOB_INFO_1 *)malloc(*returned*sizeof(JOB_INFO_1));
>+	info=(JOB_INFO_1 *)malloc_array(*returned, sizeof(JOB_INFO_1));
> 	if (info==NULL) {
> 		SAFE_FREE(queue);
> 		*returned=0;
>@@ -5579,7 +5579,7 @@
> 	WERROR result;
> 	DEVICEMODE *devmode = NULL;
> 	
>-	info=(JOB_INFO_2 *)malloc(*returned*sizeof(JOB_INFO_2));
>+	info=(JOB_INFO_2 *)malloc_array(*returned, sizeof(JOB_INFO_2));
> 	if (info==NULL) {
> 		*returned=0;
> 		result = WERR_NOMEM;
>@@ -5771,7 +5771,7 @@
> 			return WERR_NOMEM;
> 
> 		if(ndrivers != 0) {
>-			if((tdi1=(DRIVER_INFO_1 *)Realloc(driver_info_1, (*returned+ndrivers) * sizeof(DRIVER_INFO_1))) == NULL) {
>+			if((tdi1=(DRIVER_INFO_1 *)realloc_array(driver_info_1, (*returned+ndrivers), sizeof(DRIVER_INFO_1))) == NULL) {
> 				DEBUG(0,("enumprinterdrivers_level1: failed to enlarge driver info buffer!\n"));
> 				SAFE_FREE(driver_info_1);
> 				SAFE_FREE(list);
>@@ -5852,7 +5852,7 @@
> 			return WERR_NOMEM;
> 
> 		if(ndrivers != 0) {
>-			if((tdi2=(DRIVER_INFO_2 *)Realloc(driver_info_2, (*returned+ndrivers) * sizeof(DRIVER_INFO_2))) == NULL) {
>+			if((tdi2=(DRIVER_INFO_2 *)realloc_array(driver_info_2, (*returned+ndrivers), sizeof(DRIVER_INFO_2))) == NULL) {
> 				DEBUG(0,("enumprinterdrivers_level2: failed to enlarge driver info buffer!\n"));
> 				SAFE_FREE(driver_info_2);
> 				SAFE_FREE(list);
>@@ -5934,7 +5934,7 @@
> 			return WERR_NOMEM;
> 
> 		if(ndrivers != 0) {
>-			if((tdi3=(DRIVER_INFO_3 *)Realloc(driver_info_3, (*returned+ndrivers) * sizeof(DRIVER_INFO_3))) == NULL) {
>+			if((tdi3=(DRIVER_INFO_3 *)realloc_array(driver_info_3, (*returned+ndrivers), sizeof(DRIVER_INFO_3))) == NULL) {
> 				DEBUG(0,("enumprinterdrivers_level3: failed to enlarge driver info buffer!\n"));
> 				SAFE_FREE(driver_info_3);
> 				SAFE_FREE(list);
>@@ -6087,7 +6087,7 @@
> 
> 	switch (level) {
> 	case 1:
>-		if ((forms_1=(FORM_1 *)malloc(*numofforms * sizeof(FORM_1))) == NULL) {
>+		if ((forms_1=(FORM_1 *)malloc_array(*numofforms, sizeof(FORM_1))) == NULL) {
> 			*numofforms=0;
> 			return WERR_NOMEM;
> 		}
>@@ -6293,7 +6293,7 @@
> 		close(fd);
> 
> 		if(numlines) {
>-			if((ports=(PORT_INFO_1 *)malloc( numlines * sizeof(PORT_INFO_1) )) == NULL) {
>+			if((ports=(PORT_INFO_1 *)malloc_array( numlines, sizeof(PORT_INFO_1) )) == NULL) {
> 				DEBUG(10,("Returning WERR_NOMEM [%s]\n", 
> 					  dos_errstr(WERR_NOMEM)));
> 				file_lines_free(qlines);
>@@ -6392,7 +6392,7 @@
> 		close(fd);
> 
> 		if(numlines) {
>-			if((ports=(PORT_INFO_2 *)malloc( numlines * sizeof(PORT_INFO_2) )) == NULL) {
>+			if((ports=(PORT_INFO_2 *)malloc_array( numlines, sizeof(PORT_INFO_2) )) == NULL) {
> 				file_lines_free(qlines);
> 				return WERR_NOMEM;
> 			}
>@@ -6930,7 +6930,7 @@
> 		   problems unmarshalling the response */
> 
> 		*out_max_value_len=(in_value_len/sizeof(uint16));
>-		if((*out_value=(uint16 *)talloc_zero(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL)
>+		if((*out_value=(uint16 *)talloc_zero_array(p->mem_ctx, in_value_len, sizeof(uint8))) == NULL)
> 			return WERR_NOMEM;
> 
> 		*out_value_len = (uint32)dos_PutUniCode((char *)*out_value, "", in_value_len, True);
>@@ -6938,7 +6938,7 @@
> 		/* the data is counted in bytes */
> 		*out_max_data_len = in_data_len;
> 		*out_data_len = in_data_len;
>-		if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL)
>+		if((*data_out=(uint8 *)talloc_zero_array(p->mem_ctx, in_data_len, sizeof(uint8))) == NULL)
> 			return WERR_NOMEM;
> 
> 		return WERR_NO_MORE_ITEMS;
>@@ -6956,7 +6956,7 @@
> 	 */
> 	
> 	*out_max_value_len=(in_value_len/sizeof(uint16));
>-	if((*out_value=(uint16 *)talloc_zero(p->mem_ctx,in_value_len*sizeof(uint8))) == NULL) {
>+	if((*out_value=(uint16 *)talloc_zero_array(p->mem_ctx,in_value_len, sizeof(uint8))) == NULL) {
> 		SAFE_FREE(data);
> 		return WERR_NOMEM;
> 	}
>@@ -6967,7 +6967,7 @@
> 
> 	/* the data is counted in bytes */
> 	*out_max_data_len=in_data_len;
>-	if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) {
>+	if((*data_out=(uint8 *)talloc_zero_array(p->mem_ctx, in_data_len, sizeof(uint8))) == NULL) {
> 		SAFE_FREE(data);
> 		return WERR_NOMEM;
> 	}
>@@ -7812,7 +7812,7 @@
> 		
> 		/* reply this param doesn't exist */
> 		if (*out_size) {
>-			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
>+			if((*data=(uint8 *)talloc_zero_array(p->mem_ctx, *out_size, sizeof(uint8))) == NULL)
> 				return WERR_NOMEM;
> 		} else {
> 			*data = NULL;
>@@ -7995,7 +7995,11 @@
> 		PRINTER_ENUM_VALUES	*ptr;
> 
> 		DEBUG(10,("retrieved value number [%d] [%s]\n", num_entries, value));
>-
>+		if((num_entries+1) >= UINT_MAX/sizeof(PRINTER_ENUM_VALUES))
>+		{
>+			DEBUG(0,("_spoolss_enumprinterdataex: integer overflow detected.\n"));
>+			goto done;
>+		}
> 		if ((ptr=talloc_realloc(p->mem_ctx, enum_values, (num_entries+1) * sizeof(PRINTER_ENUM_VALUES))) == NULL)
> 		{
> 			DEBUG(0,("talloc_realloc failed to allocate more memory!\n"));
>diff -Ebru samba-2.2.8a.orig/source/rpc_server/srv_srvsvc_nt.c samba-2.2.8a/source/rpc_server/srv_srvsvc_nt.c
>--- samba-2.2.8a.orig/source/rpc_server/srv_srvsvc_nt.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/rpc_server/srv_srvsvc_nt.c	2004-12-16 16:42:07.000000000 +0100
>@@ -494,7 +494,7 @@
> 		SRV_SHARE_INFO_1 *info1;
> 		int i = 0;
> 
>-		info1 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1));
>+		info1 = talloc_array(ctx, num_entries, sizeof(SRV_SHARE_INFO_1));
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>@@ -511,7 +511,7 @@
> 		SRV_SHARE_INFO_2 *info2;
> 		int i = 0;
> 
>-		info2 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_2));
>+		info2 = talloc_array(ctx, num_entries, sizeof(SRV_SHARE_INFO_2));
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>@@ -528,7 +528,7 @@
> 		SRV_SHARE_INFO_501 *info501;
> 		int i = 0;
> 	
>-		info501 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_501));
>+		info501 = talloc_array(ctx, num_entries, sizeof(SRV_SHARE_INFO_501));
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>@@ -545,7 +545,7 @@
> 		SRV_SHARE_INFO_502 *info502;
> 		int i = 0;
> 
>-		info502 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_502));
>+		info502 = talloc_array(ctx, num_entries, sizeof(SRV_SHARE_INFO_502));
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>diff -Ebru samba-2.2.8a.orig/source/rpc_server/srv_util.c samba-2.2.8a/source/rpc_server/srv_util.c
>--- samba-2.2.8a.orig/source/rpc_server/srv_util.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/rpc_server/srv_util.c	2004-12-16 16:42:23.000000000 +0100
>@@ -97,7 +97,7 @@
>        count++)
>     ;
> 
>-  gids = (DOM_GID *)talloc(ctx, sizeof(DOM_GID) * count );
>+  gids = (DOM_GID *)talloc_array(ctx, sizeof(DOM_GID), count );
>   if(!gids)
>   {
>     DEBUG(0,("make_dom_gids: talloc fail !\n"));
>diff -Ebru samba-2.2.8a.orig/source/smbd/ipc.c samba-2.2.8a/source/smbd/ipc.c
>--- samba-2.2.8a.orig/source/smbd/ipc.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/smbd/ipc.c	2004-12-16 16:45:08.000000000 +0100
>@@ -419,7 +419,7 @@
> 
> 	if (suwcnt) {
> 		int i;
>-		if((setup = (uint16 *)malloc(suwcnt*sizeof(uint16))) == NULL) {
>+		if((setup = (uint16 *)malloc_array(suwcnt, sizeof(uint16))) == NULL) {
> 			DEBUG(0,("reply_trans: setup malloc fail for %u bytes !\n", (unsigned int)(suwcnt * sizeof(uint16))));
> 			SAFE_FREE(data);
> 			SAFE_FREE(params);
>diff -Ebru samba-2.2.8a.orig/source/smbd/lanman.c samba-2.2.8a/source/smbd/lanman.c
>--- samba-2.2.8a.orig/source/smbd/lanman.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/smbd/lanman.c	2004-12-16 16:46:29.000000000 +0100
>@@ -1009,17 +1009,17 @@
>     if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i))
>       queuecnt++;
>   if (uLevel > 0) {
>-    if((queue = (print_queue_struct**)malloc(queuecnt*sizeof(print_queue_struct*))) == NULL) {
>+    if((queue = (print_queue_struct**)malloc_array(queuecnt, sizeof(print_queue_struct*))) == NULL) {
>       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
>       return False;
>     }
>     memset(queue,0,queuecnt*sizeof(print_queue_struct*));
>-    if((status = (print_status_struct*)malloc(queuecnt*sizeof(print_status_struct))) == NULL) {
>+    if((status = (print_status_struct*)malloc_array(queuecnt, sizeof(print_status_struct))) == NULL) {
>       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
>       return False;
>     }
>     memset(status,0,queuecnt*sizeof(print_status_struct));
>-    if((subcntarr = (int*)malloc(queuecnt*sizeof(int))) == NULL) {
>+    if((subcntarr = (int*)malloc_array(queuecnt, sizeof(int))) == NULL) {
>       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
>       return False;
>     }
>@@ -1136,7 +1136,7 @@
> 
>       alloced += 10;
>       ts = (struct srv_info_struct *)
>-	Realloc(*servers,sizeof(**servers)*alloced);
>+	realloc_array(*servers, sizeof(**servers), alloced);
>       if (!ts) {
>         DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
>         return(0);
>diff -Ebru samba-2.2.8a.orig/source/smbd/mangle_hash2.c samba-2.2.8a/source/smbd/mangle_hash2.c
>--- samba-2.2.8a.orig/source/smbd/mangle_hash2.c	2002-12-10 15:58:17.000000000 +0100
>+++ samba-2.2.8a/source/smbd/mangle_hash2.c	2004-12-16 16:47:38.000000000 +0100
>@@ -141,10 +141,10 @@
> {
> 	if (prefix_cache) return True;
> 
>-	prefix_cache = calloc(MANGLE_CACHE_SIZE, sizeof(char *));
>+	prefix_cache = calloc_array(MANGLE_CACHE_SIZE, sizeof(char *));
> 	if (!prefix_cache) return False;
> 
>-	prefix_cache_hashes = calloc(MANGLE_CACHE_SIZE, sizeof(u32));
>+	prefix_cache_hashes = calloc_array(MANGLE_CACHE_SIZE, sizeof(u32));
> 	if (!prefix_cache_hashes) return False;
> 
> 	return True;
>diff -Ebru samba-2.2.8a.orig/source/smbd/password.c samba-2.2.8a/source/smbd/password.c
>--- samba-2.2.8a.orig/source/smbd/password.c	2003-04-07 03:54:00.000000000 +0200
>+++ samba-2.2.8a/source/smbd/password.c	2004-12-16 17:05:46.000000000 +0100
>@@ -195,7 +195,7 @@
> 	if (sup_tok && sup_tok->num_sids)
> 		num_sids += sup_tok->num_sids;
> 
>-	if ((token->user_sids = (DOM_SID *)malloc( num_sids*sizeof(DOM_SID))) == NULL) {
>+	if ((token->user_sids = (DOM_SID *)malloc_array( num_sids, sizeof(DOM_SID))) == NULL) {
> 		SAFE_FREE(token);
> 		return NULL;
> 	}
>@@ -1652,7 +1652,7 @@
> 		}
>  
> 		ptok->num_sids = (size_t)info3.num_groups2 + info3.num_other_sids;
>-		if ((ptok->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptok->num_sids )) == NULL) {
>+		if ((ptok->user_sids = (DOM_SID *)malloc_array( sizeof(DOM_SID), ptok->num_sids )) == NULL) {
> 			DEBUG(0, ("domain_client_validate: Out of memory allocating group SIDS\n"));
> 			SAFE_FREE(ptok);
> 			release_server_mutex();
>diff -Ebru samba-2.2.8a.orig/source/smbd/posix_acls.c samba-2.2.8a/source/smbd/posix_acls.c
>--- samba-2.2.8a.orig/source/smbd/posix_acls.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/smbd/posix_acls.c	2004-12-16 17:07:11.000000000 +0100
>@@ -2387,7 +2387,7 @@
> 		num_dir_acls = count_canon_ace_list(dir_ace);
> 
> 		/* Allocate the ace list. */
>-		if ((nt_ace_list = (SEC_ACE *)malloc((num_acls + num_profile_acls + num_dir_acls)* sizeof(SEC_ACE))) == NULL) {
>+		if ((nt_ace_list = (SEC_ACE *)malloc_array((num_acls + num_profile_acls + num_dir_acls), sizeof(SEC_ACE))) == NULL) {
> 			DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
> 			goto done;
> 		}
>diff -Ebru samba-2.2.8a.orig/source/smbd/sec_ctx.c samba-2.2.8a/source/smbd/sec_ctx.c
>--- samba-2.2.8a.orig/source/smbd/sec_ctx.c	2002-07-17 15:47:51.000000000 +0200
>+++ samba-2.2.8a/source/smbd/sec_ctx.c	2004-12-16 17:10:23.000000000 +0100
>@@ -155,7 +155,7 @@
> 		goto fail;
> 	}
> 
>-	if((groups = (gid_t *)malloc(sizeof(gid_t)*(ngroups+1))) == NULL) {
>+	if((groups = (gid_t *)malloc_array(sizeof(gid_t), (ngroups+1))) == NULL) {
> 		DEBUG(0,("setup_groups malloc fail !\n"));
> 		goto fail;
> 	}
>@@ -301,7 +301,7 @@
> 	ctx_p->ngroups = sys_getgroups(0, NULL);
> 
> 	if (ctx_p->ngroups != 0) {
>-		if (!(ctx_p->groups = malloc(ctx_p->ngroups * sizeof(gid_t)))) {
>+		if (!(ctx_p->groups = malloc_array(ctx_p->ngroups, sizeof(gid_t)))) {
> 			DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
> 			delete_nt_token(&ctx_p->token);
> 			return False;
>diff -Ebru samba-2.2.8a.orig/source/smbd/uid.c samba-2.2.8a/source/smbd/uid.c
>--- samba-2.2.8a.orig/source/smbd/uid.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/smbd/uid.c	2004-12-16 17:15:59.000000000 +0100
>@@ -395,7 +395,7 @@
> 
> 	total_groups = current_n_groups + ptok->num_sids;
>  
>-	final_groups = (gid_t *)malloc(total_groups * sizeof(gid_t));
>+	final_groups = (gid_t *)malloc_array(total_groups, sizeof(gid_t));
> 	if (!final_groups) {
> 		DEBUG(0,("add_supplementary_nt_login_groups: Failed to malloc new groups.\n"));
> 		delete_nt_token(&new_tok);
>diff -Ebru samba-2.2.8a.orig/source/smbwrapper/smbw_dir.c samba-2.2.8a/source/smbwrapper/smbw_dir.c
>--- samba-2.2.8a.orig/source/smbwrapper/smbw_dir.c	2002-02-01 23:15:01.000000000 +0100
>+++ samba-2.2.8a/source/smbwrapper/smbw_dir.c	2004-12-16 17:19:10.000000000 +0100
>@@ -80,8 +80,8 @@
> 	DEBUG(5,("%s\n", finfo->name));
> 
> 	if (cur_dir->malloced == cur_dir->count) {
>-		cur_dir->list = (struct file_info *)Realloc(cur_dir->list, 
>-							    sizeof(cur_dir->list[0])*
>+		cur_dir->list = (struct file_info *)realloc_array(cur_dir->list, 
>+							    sizeof(cur_dir->list[0]),
> 							    (cur_dir->count+100));
> 		if (!cur_dir->list) {
> 			/* oops */
>diff -Ebru samba-2.2.8a.orig/source/tdb/tdb.c samba-2.2.8a/source/tdb/tdb.c
>--- samba-2.2.8a.orig/source/tdb/tdb.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/tdb/tdb.c	2004-12-16 20:09:55.996398067 +0100
>@@ -1749,6 +1749,14 @@
> 	tdb->map_size = st.st_size;
> 	tdb->device = st.st_dev;
> 	tdb->inode = st.st_ino;
>+	if(tdb->header.hash_size == INT_MAX || tdb->header.hash_size >= INT_MAX/sizeof(tdb->locked[0]))
>+	{
>+		TDB_LOG((tdb, 2, "tdb_open_ex: "
>+			"integer overflow detected for %s\n",
>+			name));
>+		errno = ENOMEM;
>+		goto fail;
>+	}
> 	tdb->locked = calloc(tdb->header.hash_size+1, sizeof(tdb->locked[0]));
> 	if (!tdb->locked) {
> 		TDB_LOG((tdb, 2, "tdb_open_ex: "
>diff -Ebru samba-2.2.8a.orig/source/tests/getgroups.c samba-2.2.8a/source/tests/getgroups.c
>--- samba-2.2.8a.orig/source/tests/getgroups.c	1999-12-13 14:27:53.000000000 +0100
>+++ samba-2.2.8a/source/tests/getgroups.c	2004-12-16 17:21:54.000000000 +0100
>@@ -32,7 +32,7 @@
> 	if (ngroups <= 0)
> 		ngroups = 32;
> 
>-	igroups = (int *)malloc(sizeof(int)*ngroups);
>+	igroups = (int *)malloc_array(sizeof(int), ngroups);
> 
> 	for (i=0;i<ngroups;i++)
> 		igroups[i] = 0x42424242;
>diff -Ebru samba-2.2.8a.orig/source/utils/locktest2.c samba-2.2.8a/source/utils/locktest2.c
>--- samba-2.2.8a.orig/source/utils/locktest2.c	2002-04-30 15:28:37.000000000 +0200
>+++ samba-2.2.8a/source/utils/locktest2.c	2004-12-16 17:22:26.000000000 +0100
>@@ -432,7 +432,7 @@
> 	ZERO_STRUCT(fnum);
> 	ZERO_STRUCT(cli);
> 
>-	recorded = (struct record *)malloc(sizeof(*recorded) * numops);
>+	recorded = (struct record *)malloc_array(sizeof(*recorded), numops);
> 
> 	for (n=0; n<numops; n++) {
> 		recorded[n].conn = random() % NCONNECTIONS;
>diff -Ebru samba-2.2.8a.orig/source/utils/locktest.c samba-2.2.8a/source/utils/locktest.c
>--- samba-2.2.8a.orig/source/utils/locktest.c	2002-04-30 15:28:37.000000000 +0200
>+++ samba-2.2.8a/source/utils/locktest.c	2004-12-16 17:24:40.000000000 +0100
>@@ -376,7 +376,7 @@
> 	ZERO_STRUCT(fnum);
> 	ZERO_STRUCT(cli);
> 
>-	recorded = (struct record *)malloc(sizeof(*recorded) * numops);
>+	recorded = (struct record *)malloc_array(sizeof(*recorded), numops);
> 
> 	for (n=0; n<numops; n++) {
> #if PRESETS
>diff -Ebru samba-2.2.8a.orig/source/utils/make_smbcodepage.c samba-2.2.8a/source/utils/make_smbcodepage.c
>--- samba-2.2.8a.orig/source/utils/make_smbcodepage.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/utils/make_smbcodepage.c	2004-12-16 18:25:12.000000000 +0100
>@@ -67,10 +67,16 @@
>   pstring linebuf;
>   char *p = *buf;
>   int num_lines = 0;
>-  char *newbuf = (char *)malloc( *size + 1);
>+  char *newbuf;
>   char *newbuf_p = NULL;
> 
>-  if(newbuf == NULL)
>+  if(*size == UINT_MAX)
>+  {
>+    fprintf(stderr, "%s: size %lu is too big (integer overflow).\n", prog_name, *size);
>+    exit(1);
>+  }
>+
>+  if((newbuf = (char *)malloc( *size + 1)) == NULL)
>   {
>     fprintf(stderr, "%s: malloc fail for size %d.\n", prog_name, *size + 1);
>     exit(1);
>diff -Ebru samba-2.2.8a.orig/source/utils/make_unicodemap.c samba-2.2.8a/source/utils/make_unicodemap.c
>--- samba-2.2.8a.orig/source/utils/make_unicodemap.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/utils/make_unicodemap.c	2004-12-16 18:26:25.000000000 +0100
>@@ -66,10 +66,18 @@
>   pstring linebuf;
>   char *p = *buf;
>   size_t num_lines = 0;
>-  char *newbuf = (char *)malloc( *size + 1);
>+  char *newbuf;
>   char *newbuf_p = NULL;
> 
>-  if(newbuf == NULL) {
>+
>+  if(*size == UINT_MAX)
>+  {
>+    fprintf(stderr, "%s: size %lu is too big (integer overflow).\n", prog_name, *size);
>+    exit(1);
>+  }
>+
>+  if((newbuf = (char *)malloc( *size + 1)) == NULL)
>+  {
>     fprintf(stderr, "%s: malloc fail for size %u.\n", prog_name, (unsigned int)(*size + 1));
>     exit(1);
>   }
>diff -Ebru samba-2.2.8a.orig/source/utils/nsstest.c samba-2.2.8a/source/utils/nsstest.c
>--- samba-2.2.8a.orig/source/utils/nsstest.c	2002-02-01 23:22:26.000000000 +0100
>+++ samba-2.2.8a/source/utils/nsstest.c	2004-12-16 17:25:44.000000000 +0100
>@@ -242,7 +242,7 @@
> 	gid_t *groups = NULL;
> 	int i;
> 
>-	groups = (gid_t *)malloc(size * sizeof(gid_t));
>+	groups = (gid_t *)malloc_array(size, sizeof(gid_t));
> 	groups[0] = gid;
> 
> 	nss_initgroups(name, gid, &groups, &start, &size);
>diff -Ebru samba-2.2.8a.orig/source/utils/smbcacls.c samba-2.2.8a/source/utils/smbcacls.c
>--- samba-2.2.8a.orig/source/utils/smbcacls.c	2004-12-15 11:42:50.000000000 +0100
>+++ samba-2.2.8a/source/utils/smbcacls.c	2004-12-16 17:26:17.000000000 +0100
>@@ -349,7 +349,7 @@
> 		return True;
> 	}
> 
>-	aces = calloc(1+(*the_acl)->num_aces,sizeof(SEC_ACE));
>+	aces = calloc_array(1+(*the_acl)->num_aces,sizeof(SEC_ACE));
> 	memcpy(aces, (*the_acl)->ace, (*the_acl)->num_aces * sizeof(SEC_ACE));
> 	memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
> 	new = make_sec_acl(ctx,(*the_acl)->revision,1+(*the_acl)->num_aces, aces);
>diff -Ebru samba-2.2.8a.orig/source/web/cgi.c samba-2.2.8a/source/web/cgi.c
>--- samba-2.2.8a.orig/source/web/cgi.c	2003-03-14 22:34:49.000000000 +0100
>+++ samba-2.2.8a/source/web/cgi.c	2004-12-16 17:29:37.000000000 +0100
>@@ -94,8 +94,20 @@
> 	
> 		if (i == len) {
> 			char *ret2;
>-			if (len == 0) len = 1024;
>-			else len *= 2;
>+			if (len == 0)
>+			{
>+				len = 1024;
>+			}
>+			else
>+			{
>+				if(len >= INT_MAX/2)
>+				{
>+					if(ret)
>+						free(ret);
>+					return NULL;
>+				}
>+				len *= 2;
>+			}
> 			ret2 = (char *)Realloc(ret, len);
> 			if (!ret2) return ret;
> 			ret = ret2;
>Nur in samba-2.2.8a/: source.bak.

Actions: View | Diff

Attachments on bug 64119: 26942 | 27037 | 27038 | 27039 | 27040 | 27041 | 27150 | 27305