Attachment 27305 Details for Bug 64119

[patch] samba-2.2.12-CAN-2004-1154.patch

samba-2.2.12-CAN-2004-1154.patch (text/plain), 291.87 KB, created by Marcus Meissner on 2004-12-24 18:21:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2004-12-24 18:21:23 UTC

Size: 291.87 KB

patch

obsolete

>diff -r -u samba-2.2.12-pre-CAN-2004-1154/examples/VFS/block/block.c samba-2.2.12-backport/examples/VFS/block/block.c
>--- samba-2.2.12-pre-CAN-2004-1154/examples/VFS/block/block.c	2004-08-12 14:24:58.000000000 -0400
>+++ samba-2.2.12-backport/examples/VFS/block/block.c	2004-12-17 21:20:49.000000000 -0500
>@@ -209,7 +209,7 @@
> 	
> 	if(pblock_mountp == NULL)
> 	{
>-		pblock_mountp = calloc(1, sizeof(block_dir));
>+		pblock_mountp = SMB_CALLOC_ARRAY( block_dir, 1 );
> 		if( pblock_mountp == NULL)
> 		{
> 			return FALSE;
>@@ -219,7 +219,7 @@
> 		
> 	}else
> 	{
>-		tmp_pblock->next = calloc(1, sizeof(block_dir));
>+		tmp_pblock->next = SMB_CALLOC_ARRAY( block_dir, 1 );
> 		if(tmp_pblock->next == NULL)
> 		{
> 			return FALSE;
>@@ -231,7 +231,7 @@
> 	
> 
> 	tmp_pblock->st_dev = stat_buf.st_dev;
>-	tmp_pblock->dir_name = strdup(dir);
>+	tmp_pblock->dir_name = SMB_STRDUP(dir);
> 	
> 
>       return TRUE;
>@@ -251,7 +251,7 @@
> 
> 	if(pblock_dir == NULL)
> 	{
>-		pblock_dir = calloc(1, sizeof(block_dir));
>+		pblock_dir = SMB_CALLOC_ARRAY( block_dir, 1 );
> 		if( pblock_dir == NULL)
> 		{
> 			return FALSE;
>@@ -261,7 +261,7 @@
> 		
> 	}else
> 	{
>-		tmp_pblock->next = calloc(1, sizeof(block_dir));
>+		tmp_pblock->next = SMB_CALLOC_ARRAY( block_dir, 1 );
> 		if(tmp_pblock->next == NULL)
> 		{
> 			return FALSE;
>@@ -272,7 +272,7 @@
> 	}
> 	
> 
>-	tmp_pblock->dir_name = strdup(dir);
>+	tmp_pblock->dir_name = SMB_STRDUP(dir);
> 	tmp_pblock->str_len = strlen(dir);
> 	
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/examples/VFS/recycle/recycle.c samba-2.2.12-backport/examples/VFS/recycle/recycle.c
>--- samba-2.2.12-pre-CAN-2004-1154/examples/VFS/recycle/recycle.c	2004-08-12 14:24:58.000000000 -0400
>+++ samba-2.2.12-backport/examples/VFS/recycle/recycle.c	2004-12-17 21:22:56.000000000 -0500
>@@ -151,7 +151,7 @@
> static BOOL do_parameter(char *pszParmName, char *pszParmValue)
> {
> 	if (StrCaseCmp("name",pszParmName)==0) {
>-		current->recycle_bin = (char *)talloc(current->ctx,sizeof(pstring));
>+		current->recycle_bin = (char *)TALLOC(current->ctx,sizeof(pstring));
> 		if (current->recycle_bin == NULL)
> 			return False;
> 		current->recycle_bin = safe_strcpy(current->recycle_bin,pszParmValue,sizeof(pstring));
>@@ -236,7 +236,7 @@
> 		DEBUG(10,("Using configuration file %s\n",conf_file));
> 	}
> 	
>-	current = talloc(ctx,sizeof(recycle_bin_struct));
>+	current = TALLOC_P(ctx,recycle_bin_struct);
> 	if ( current == NULL) {
> 		DEBUG(0, ("Failed to allocate memory in VFS module recycle_bin\n"));
> 		return -1;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/aparser/parser.c samba-2.2.12-backport/source/aparser/parser.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/aparser/parser.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/aparser/parser.c	2004-12-17 15:00:43.000000000 -0500
>@@ -1,4 +1,5 @@
> #include "parser.h"
>+#include <limits.h>
> 
> /*******************************************************************
>  Attempt, if needed, to grow a data buffer.
>@@ -44,6 +45,16 @@
> 		 * If the current buffer size is bigger than the space needed, just 
> 		 * double it, else add extra_space.
> 		 */
>+		if(ps->buffer_size >= INT_MAX/2)
>+		{
>+			DEBUG(0,("io_grow: integer overflow detected.\n"));
>+			return False;
>+		}
>+		if(ps->buffer_size >= INT_MAX - extra_space)
>+		{
>+			DEBUG(0,("io_grow: integer overflow detected.\n"));
>+			return False;
>+		}
> 		new_size = MAX(ps->buffer_size*2, ps->buffer_size + extra_space);		
> 
> 		if ((new_data = Realloc(ps->data_p, new_size)) == NULL) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/client/client.c samba-2.2.12-backport/source/client/client.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/client/client.c	2004-08-12 14:24:36.000000000 -0400
>+++ samba-2.2.12-backport/source/client/client.c	2004-12-17 15:00:43.000000000 -0500
>@@ -380,7 +380,7 @@
> {
> 	reset_do_list_queue();
> 	do_list_queue_size = 1024;
>-	do_list_queue = malloc(do_list_queue_size);
>+	do_list_queue = SMB_MALLOC(do_list_queue_size);
> 	if (do_list_queue == 0) { 
> 		DEBUG(0,("malloc fail for size %d\n",
> 			 (int)do_list_queue_size));
>@@ -421,10 +421,16 @@
> 	long new_end = do_list_queue_end + ((long)strlen(entry)) + 1;
> 	while (new_end > do_list_queue_size)
> 	{
>+		if(do_list_queue_size >= INT_MAX/2)
>+		{
>+			DEBUG(0,("add_to_do_list_queue: integer overflow detected.\n"));
>+			reset_do_list_queue();
>+			return;
>+		}
> 		do_list_queue_size *= 2;
> 		DEBUG(4,("enlarging do_list_queue to %d\n",
> 			 (int)do_list_queue_size));
>-		dlq = Realloc(do_list_queue, do_list_queue_size);
>+		dlq = SMB_REALLOC(do_list_queue, do_list_queue_size);
> 		if (!dlq) {
> 			DEBUG(0,("failure enlarging do_list_queue to %d bytes\n",
> 				(int)do_list_queue_size));
>@@ -683,7 +689,7 @@
> 	DEBUG(2,("getting file %s of size %.0f as %s ", 
> 		 rname, (double)size, lname));
> 
>-	if(!(data = (char *)malloc(read_size))) { 
>+	if(!(data = (char *)SMB_MALLOC(read_size))) { 
> 		DEBUG(0,("malloc fail for size %d\n", read_size));
> 		cli_close(cli, fnum);
> 		return;
>@@ -1049,7 +1055,7 @@
> 	DEBUG(1,("putting file %s as %s ",lname,
> 		 rname));
>   
>-	buf = (char *)malloc(maxwrite);
>+	buf = (char *)SMB_MALLOC(maxwrite);
> 	if (!buf) {
> 		DEBUG(0, ("ERROR: Not enough memory!\n"));
> 		return;
>@@ -1249,7 +1255,7 @@
> 					return -1;
> 				}
> 			}
>-			entry = (struct file_list *) malloc(sizeof (struct file_list));
>+			entry = SMB_MALLOC_P(struct file_list);
> 			if (!entry) {
> 				DEBUG(0,("Out of memory in file_find\n"));
> 				closedir(dir);
>@@ -2045,15 +2051,15 @@
> 	/* for words not at the start of the line fallback to filename completion */
> 	if (start) return NULL;
> 
>-	matches = (char **)malloc(sizeof(matches[0])*MAX_COMPLETIONS);
>+	matches = SMB_MALLOC_ARRAY( char *, MAX_COMPLETIONS );
> 	if (!matches) return NULL;
> 
>-	matches[count++] = strdup(text);
>+	matches[count++] = SMB_STRDUP(text);
> 	if (!matches[0]) return NULL;
> 
> 	for (i=0;commands[i].fn && count < MAX_COMPLETIONS-1;i++) {
> 		if (strncmp(text, commands[i].name, strlen(text)) == 0) {
>-			matches[count] = strdup(commands[i].name);
>+			matches[count] = SMB_STRDUP(commands[i].name);
> 			if (!matches[count]) return NULL;
> 			count++;
> 		}
>@@ -2061,7 +2067,7 @@
> 
> 	if (count == 2) {
> 		SAFE_FREE(matches[0]);
>-		matches[0] = strdup(matches[1]);
>+		matches[0] = SMB_STRDUP(matches[1]);
> 	}
> 	matches[count] = NULL;
> 	return matches;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/client/clitar.c samba-2.2.12-backport/source/client/clitar.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/client/clitar.c	2004-08-12 14:24:36.000000000 -0400
>+++ samba-2.2.12-backport/source/client/clitar.c	2004-12-17 17:11:19.000000000 -0500
>@@ -109,7 +109,7 @@
> 
> char tar_type='\0';
> static char **cliplist=NULL;
>-static int clipn=0;
>+static unsigned clipn=0;
> static BOOL must_free_cliplist = False;
> 
> extern file_info def_finfo;
>@@ -149,11 +149,11 @@
> /*******************************************************************
> Create  a string of size size+1 (for the null)
> *******************************************************************/
>-static char *string_create_s(int size)
>+static char *string_create_s(size_t size)
> {
>   char *tmp;
> 
>-  tmp = (char *)malloc(size+1);
>+  tmp = (char *)SMB_MALLOC(size+1);
> 
>   if (tmp == NULL) {
> 
>@@ -183,7 +183,12 @@
>   if (l >= NAMSIZ - 1) {
> 	  /* write a GNU tar style long header */
> 	  char *b;
>-	  b = (char *)malloc(l+TBLOCK+100);
>+
>+	  if(l >= (INT_MAX - TBLOCK - 100)) {
>+		  DEBUG(0,("writetarheader: integer overflow detected.\n"));
>+	          exit(1);
>+	  }
>+	  b = (char *)SMB_MALLOC(l+TBLOCK+100);
> 	  if (!b) {
> 		  DEBUG(0,("out of memory\n"));
> 		  exit(1);
>@@ -384,8 +389,12 @@
> {
>   /* initialize tar buffer */
>   tbufsiz=blocksize*TBLOCK;
>-  tarbuf=malloc(tbufsiz);      /* FIXME: We might not get the buffer */
>+  tarbuf=SMB_MALLOC(tbufsiz);      /* FIXME: We might not get the buffer */
> 
>+  if(tarbuf == NULL) {
>+    DEBUG(0,("initarbuf: out of memory.\n"));
>+    exit(1);
>+  }
>   /* reset tar buffer pointer and tar file counter and total dumped */
>   tp=0; ntarf=0; ttarf=0;
> }
>@@ -1124,11 +1133,17 @@
> */
> static char * get_longfilename(file_info2 finfo)
> {
>-  int namesize = strlen(finfo.name) + strlen(cur_dir) + 2;
>-  char *longname = malloc(namesize);
>+  size_t namesize;
>+  char *longname;
>   SMB_BIG_INT offset = 0, left = finfo.size;
>   BOOL first = True;
> 
>+  if(strlen(finfo.name) >= (UINT_MAX - strlen(cur_dir) - 2)) {
>+    DEBUG(0,("get_longfilename: integer overflow detected.\n"));
>+    return NULL;
>+  }
>+  namesize = strlen(finfo.name) + strlen(cur_dir) + 2;
>+  longname = SMB_MALLOC(namesize);
>   DEBUG(5, ("Restoring a long file name: %s\n", finfo.name));
>   DEBUG(5, ("Len = %.0f\n", (double)finfo.size));
> 
>@@ -1576,7 +1591,7 @@
>   FILE *inclusion = NULL;
>   char buf[MAXPATHLEN + 1];
>   char *inclusion_buffer = NULL;
>-  int inclusion_buffer_size = 0;
>+  size_t inclusion_buffer_size = 0;
>   int inclusion_buffer_sofar = 0;
>   char *p;
>   char *tmpstr;
>@@ -1596,7 +1611,7 @@
>   while ((! error) && (fgets(buf, sizeof(buf)-1, inclusion))) {
>     if (inclusion_buffer == NULL) {
>       inclusion_buffer_size = 1024;
>-      if ((inclusion_buffer = malloc(inclusion_buffer_size)) == NULL) {
>+      if ((inclusion_buffer = SMB_MALLOC(inclusion_buffer_size)) == NULL) {
> 	DEBUG(0,("failure allocating buffer to read inclusion file\n"));
> 	error = 1;
> 	break;
>@@ -1609,8 +1624,13 @@
>     
>     if ((strlen(buf) + 1 + inclusion_buffer_sofar) >= inclusion_buffer_size) {
>       char *ib;
>+
>+      if(inclusion_buffer_size >= INT_MAX/2) {
>+	DEBUG(0,("read_inclusion_file: integer overflow detected.\n"));
>+	return 0;
>+      }
>       inclusion_buffer_size *= 2;
>-      ib = Realloc(inclusion_buffer,inclusion_buffer_size);
>+      ib = SMB_REALLOC(inclusion_buffer,inclusion_buffer_size);
>       if (! ib) {
>         DEBUG(0,("failure enlarging inclusion buffer to %d bytes\n", inclusion_buffer_size));
>         error = 1;
>@@ -1621,13 +1641,17 @@
>     
>     safe_strcpy(inclusion_buffer + inclusion_buffer_sofar, buf, inclusion_buffer_size - inclusion_buffer_sofar);
>     inclusion_buffer_sofar += strlen(buf) + 1;
>+    if(clipn >= (INT_MAX-1)) {
>+      DEBUG(0,("read_inclusion_file: integer overflow detected.\n"));
>+      abort();
>+    }
>     clipn++;
>   }
>   fclose(inclusion);
> 
>   if (! error) {
>     /* Allocate an array of clipn + 1 char*'s for cliplist */
>-    cliplist = malloc((clipn + 1) * sizeof(char *));
>+    cliplist = SMB_MALLOC_ARRAY( char *, clipn + 1 );
>     if (cliplist == NULL) {
>       DEBUG(0,("failure allocating memory for cliplist\n"));
>       error = 1;
>@@ -1638,7 +1662,7 @@
> 	/* set current item to NULL so array will be null-terminated even if
> 	 * malloc fails below. */
> 	cliplist[i] = NULL;
>-	if ((tmpstr = (char *)malloc(strlen(p)+1)) == NULL) {
>+	if ((tmpstr = (char *)SMB_MALLOC(strlen(p)+1)) == NULL) {
> 	  DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", i));
> 	  error = 1;
> 	} else {
>@@ -1797,13 +1821,13 @@
>   } else if (Optind+1<argc && !tar_re_search) { /* For backwards compatibility */
>     char *tmpstr;
>     char **tmplist;
>-    int clipcount;
>+    unsigned int clipcount;
> 
>     cliplist=argv+Optind+1;
>     clipn=argc-Optind-1;
>     clipcount = clipn;
> 
>-    if ((tmplist=malloc(clipn*sizeof(char *))) == NULL) {
>+    if ((tmplist=SMB_MALLOC_ARRAY( char *, clipn )) == NULL) {
>       DEBUG(0, ("Could not allocate space to process cliplist, count = %i\n", 
>                clipn)
>            );
>@@ -1814,7 +1838,7 @@
> 
>       DEBUG(5, ("Processing an item, %s\n", cliplist[clipcount]));
> 
>-      if ((tmpstr = (char *)malloc(strlen(cliplist[clipcount])+1)) == NULL) {
>+      if ((tmpstr = (char *)SMB_MALLOC(strlen(cliplist[clipcount])+1)) == NULL) {
>         DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n",
>                  clipcount)
>              );
>@@ -1834,10 +1858,10 @@
> #ifdef HAVE_REGEX_H
>     int errcode;
> 
>-    if ((preg = (regex_t *)malloc(65536)) == NULL) {
>+    if ((preg = (regex_t *)SMB_MALLOC(65536)) == NULL) {
> 
>       DEBUG(0, ("Could not allocate buffer for regular expression search\n"));
>-      return;
>+      return 0;
> 
>     }
> 
>@@ -1848,7 +1872,7 @@
>       errlen = regerror(errcode, preg, errstr, sizeof(errstr) - 1);
>       
>       DEBUG(0, ("Could not compile pattern buffer for re search: %s\n%s\n", argv[Optind + 1], errstr));
>-      return;
>+      return 0;
> 
>     }
> #endif
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/client/smbmnt.c samba-2.2.12-backport/source/client/smbmnt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/client/smbmnt.c	2004-08-12 14:24:36.000000000 -0400
>+++ samba-2.2.12-backport/source/client/smbmnt.c	2004-12-16 11:52:16.000000000 -0500
>@@ -104,7 +104,7 @@
> 		fprintf(stderr,"Failed to find real path for mount point\n");
> 		exit(1);
> 	}
>-	return strdup(path);
>+	return SMB_STRDUP(path);
> }
> 
> /* Check whether user is allowed to mount on the specified mount point. If it's
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/client/smbumount.c samba-2.2.12-backport/source/client/smbumount.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/client/smbumount.c	2004-08-12 14:24:36.000000000 -0400
>+++ samba-2.2.12-backport/source/client/smbumount.c	2004-12-16 11:52:16.000000000 -0500
>@@ -134,7 +134,7 @@
> 				npath = resolved_path;
> 			else while(*(--npath) != '/');
> 			m = strlen(path);
>-			if((buf = malloc(m + n + 1)) == NULL)
>+			if((buf = SMB_MALLOC(m + n + 1)) == NULL)
> 			{
> 				fprintf(stderr,"Not enough memory.\n");
> 				return NULL;
>@@ -163,7 +163,7 @@
> static char *
> canonicalize (char *path)
> {
>-	char *npath,*canonical = malloc (PATH_MAX + 1);
>+	char *npath,*canonical = SMB_MALLOC (PATH_MAX + 1);
> 	int i;
> 
> 	if (!canonical) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/groupdb/aliasdb.c samba-2.2.12-backport/source/groupdb/aliasdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/groupdb/aliasdb.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/groupdb/aliasdb.c	2004-12-16 15:50:23.000000000 -0500
>@@ -143,7 +143,7 @@
> 	if (alss == NULL || num_alss == NULL || als == NULL)
> 		return False;
> 
>-	talss = (LOCAL_GRP *)Realloc((*alss), ((*num_alss)+1) * sizeof(LOCAL_GRP));
>+	talss = SMB_REALLOC_ARRAY( *alss, LOCAL_GRP, (*num_alss)+1 );
>     if (talss == NULL) {
> 		if (*alss)
> 			free(*alss);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/groupdb/aliasfile.c samba-2.2.12-backport/source/groupdb/aliasfile.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/groupdb/aliasfile.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/groupdb/aliasfile.c	2004-12-16 15:50:23.000000000 -0500
>@@ -129,7 +129,7 @@
> 		uint8 type;
> 
> 		if (lookup_sid(name, &sid, &type)) {
>-			mbrs = Realloc((*members), ((*num_mem)+1) * sizeof(LOCAL_GRP_MEMBER));
>+			mbrs = SMB_REALLOC_ARRAY( *members, LOCAL_GRP_MEMBER, (*num_mem)+1 );
> 			(*num_mem)++;
> 		} else {
> 			DEBUG(0,("alias database: could not resolve alias named %s\n", name));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/groupdb/groupdb.c samba-2.2.12-backport/source/groupdb/groupdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/groupdb/groupdb.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/groupdb/groupdb.c	2004-12-16 15:50:23.000000000 -0500
>@@ -141,7 +141,7 @@
> 	if (grps == NULL || num_grps == NULL || grp == NULL)
> 		return False;
> 
>-	tgrps = (DOMAIN_GRP *)Realloc((*grps), ((*num_grps)+1) * sizeof(DOMAIN_GRP));
>+	tgrps = SMB_REALLOC_ARRAY(*grps, DOMAIN_GRP, (*num_grps)+1 );
> 	if (tgrps == NULL) {
> 		if (*grps)
> 			free(*grps);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/groupdb/groupfile.c samba-2.2.12-backport/source/groupdb/groupfile.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/groupdb/groupfile.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/groupdb/groupfile.c	2004-12-16 15:50:23.000000000 -0500
>@@ -129,7 +129,7 @@
> 	{
> 		DOMAIN_GRP_MEMBER *mbrs;
> 
>-		mbrs = (DOMAIN_GRP_MEMBER *)Realloc((*members), ((*num_mem)+1) * sizeof(DOMAIN_GRP_MEMBER));
>+		mbrs = SMB_REALLOC_ARRAY( *members, DOMAIN_GRP_MEMBER, (*num_mem)+1 );
> 		if (mbrs == NULL) {
> 			if (*members)
> 				free(*members);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/include/proto.h samba-2.2.12-backport/source/include/proto.h
>--- samba-2.2.12-pre-CAN-2004-1154/source/include/proto.h	2004-08-12 14:25:49.000000000 -0400
>+++ samba-2.2.12-backport/source/include/proto.h	2004-12-22 15:07:34.000000000 -0500
>@@ -1068,19 +1068,33 @@
> /* The following definitions come from lib/talloc.c  */
> 
> TALLOC_CTX *talloc_init(void);
>-void *talloc(TALLOC_CTX *t, size_t size);
>-void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size);
> void talloc_destroy_pool(TALLOC_CTX *t);
> void talloc_destroy(TALLOC_CTX *t);
> size_t talloc_pool_size(TALLOC_CTX *t);
> const char * talloc_pool_name(TALLOC_CTX const *t);
>-void *talloc_zero(TALLOC_CTX *t, size_t size);
>-void *talloc_memdup(TALLOC_CTX *t, const void *p, size_t size);
> char *talloc_strdup(TALLOC_CTX *t, const char *p);
> char *talloc_describe_all(TALLOC_CTX *rt);
> void talloc_get_allocation(TALLOC_CTX *t,
> 			   size_t *total_bytes,
> 			   int *n_chunks);
>+#define PARANOID_MALLOC_CHECKER 1
>+#if defined(PARANOID_MALLOC_CHECKER)
>+extern void *talloc_(TALLOC_CTX *t, size_t size);
>+extern void *talloc_realloc_ ( TALLOC_CTX *, void *, size_t );
>+extern void *talloc_array_ ( TALLOC_CTX *, size_t, unsigned int );
>+extern void *talloc_zero_(TALLOC_CTX *t, size_t size);
>+extern void *talloc_zero_array_(TALLOC_CTX *t, size_t size, unsigned int);
>+extern void *talloc_realloc_array_ ( TALLOC_CTX *, void *, size_t, unsigned int );
>+extern void *talloc_memdup_(TALLOC_CTX *t, const void *p, size_t size);
>+#else
>+extern void *talloc(TALLOC_CTX *t, size_t size);
>+extern void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size);
>+extern void *talloc_zero(TALLOC_CTX *t, size_t size);
>+extern void *talloc_zero_array ( TALLOC_CTX *, void *, size_t, unsigned int );
>+extern void *talloc_array ( TALLOC_CTX *, void *, size_t, unsigned int );
>+extern void *talloc_realloc_array(TALLOC_CTX *t, void *ptr, size_t size, unsigned int);
>+extern void *talloc_memdup(TALLOC_CTX *t, const void *p, size_t size);
>+#endif
> 
> /* The following definitions come from lib/time.c  */
> 
>@@ -1151,7 +1165,6 @@
> void msleep(unsigned int t);
> void become_daemon(void);
> BOOL yesno(char *p);
>-void *Realloc(void *p,size_t size);
> void safe_free(void *p);
> BOOL get_myname(char *my_name);
> int interpret_protocol(char *str,int def);
>@@ -1189,9 +1202,9 @@
> int set_maxfiles(int requested_max);
> BOOL reg_split_key(const char *full_keyname, uint32 *reg_type, char *key_name);
> int smb_mkstemp(char *template);
>-void *smb_xmalloc(size_t size);
> void *smb_xmemdup(const void *p, size_t size);
> char *smb_xstrdup(const char *s);
>+extern char *smb_xstrndup(const char *s, size_t );
> int smb_xvasprintf(char **ptr, const char *format, va_list ap);
> void *memdup(void *p, size_t size);
> char *myhostname(void);
>@@ -1206,6 +1219,15 @@
> void data_blob_free(DATA_BLOB *d);
> void data_blob_clear(DATA_BLOB *d);
> int _Insure_trap_error(int a1, int a2, int a3, int a4, int a5, int a6);
>+#if defined(PARANOID_MALLOC_CHECKER)
>+extern void *malloc_ ( size_t );
>+#endif
>+extern void *smb_malloc(void *p,size_t size);
>+extern void *malloc_array ( size_t, unsigned int );
>+extern void *calloc_array ( size_t, size_t );
>+extern void *realloc_array ( void *, size_t, unsigned int );
>+extern void *smb_xmalloc_array ( size_t, unsigned int );
>+extern void *smb_realloc(void *p,size_t size);
> 
> /* The following definitions come from lib/util_file.c  */
> 
>@@ -2908,7 +2930,6 @@
> BOOL prs_read(prs_struct *ps, int fd, size_t len, int timeout);
> void prs_mem_free(prs_struct *ps);
> void prs_mem_clear(prs_struct *ps);
>-char *prs_alloc_mem(prs_struct *ps, size_t size);
> TALLOC_CTX *prs_get_mem_context(prs_struct *ps);
> void prs_give_memory(prs_struct *ps, char *buf, uint32 size, BOOL is_dynamic);
> char *prs_take_memory(prs_struct *ps, uint32 *psize);
>@@ -2955,6 +2976,7 @@
> int tdb_prs_store(TDB_CONTEXT *tdb, char *keystr, prs_struct *ps);
> int tdb_prs_fetch(TDB_CONTEXT *tdb, char *keystr, prs_struct *ps, TALLOC_CTX *mem_ctx);
> BOOL prs_hash1(prs_struct *ps, uint32 offset, uint8 sess_key[16]);
>+extern char *prs_alloc_mem_(prs_struct *ps, size_t size, size_t count );
> 
> /* The following definitions come from rpc_parse/parse_reg.c  */
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/include/smb_macros.h samba-2.2.12-backport/source/include/smb_macros.h
>--- samba-2.2.12-pre-CAN-2004-1154/source/include/smb_macros.h	2004-08-12 14:24:30.000000000 -0400
>+++ samba-2.2.12-backport/source/include/smb_macros.h	2004-12-22 16:02:49.000000000 -0500
>@@ -284,4 +284,92 @@
> 
> #define vfs_chdir(conn,fname) ((conn)->vfs_ops.chdir((conn),dos_to_unix_static((fname))))
> 
>+/*****************************************************************************
>+ Safe allocation macros.
>+*****************************************************************************/
>+
>+#define SMB_MALLOC_ARRAY(type,count) (type *)malloc_array(sizeof(type),(count))
>+#define SMB_REALLOC(p,s) smb_realloc((p),(s))
>+#define SMB_REALLOC_ARRAY(p,type,count) (type *)realloc_array((p),sizeof(type),(count))
>+#define SMB_CALLOC_ARRAY(type,count) (type *)calloc_array(sizeof(type),(count))
>+#define SMB_XMALLOC_P(type) (type *)smb_xmalloc_array(sizeof(type),1)
>+#define SMB_XMALLOC_ARRAY(type,count) (type *)smb_xmalloc_array(sizeof(type),(count))
>+
>+/* limiting size of ipc replies */
>+#define SMB_REALLOC_LIMIT(ptr,size) SMB_REALLOC(ptr,MAX((size),4*1024))
>+
>+#define PARANOID_MALLOC_CHECKER 1
>+
>+#if defined(PARANOID_MALLOC_CHECKER)
>+
>+#define TALLOC(ctx, size) talloc_((ctx),(size))
>+#define TALLOC_P(ctx, type) (type *)talloc_((ctx),sizeof(type))
>+#define TALLOC_ARRAY(ctx, type, count) (type *)talloc_array_((ctx),sizeof(type),(count))
>+#define TALLOC_MEMDUP(ctx, ptr, size) talloc_memdup_((ctx),(ptr),(size))
>+#define TALLOC_ZERO(ctx, size) talloc_zero_((ctx),(size))
>+#define TALLOC_ZERO_P(ctx, type) (type *)talloc_zero_((ctx),sizeof(type))
>+#define TALLOC_ZERO_ARRAY(ctx, type, count) (type *)talloc_zero_array_((ctx),sizeof(type),(count))
>+#define TALLOC_REALLOC(ctx, ptr, count) talloc_realloc_((ctx),(ptr),(count))
>+#define TALLOC_REALLOC_ARRAY(ctx, ptr, type, count) (type *)talloc_realloc_array_((ctx),(ptr),sizeof(type),(count))
>+
>+#define PRS_ALLOC_MEM(ps, type, count) (type *)talloc_zero_array_((ps)->mem_ctx,sizeof(type),(count))
>+
>+/* Get medieval on our ass about malloc.... */
>+
>+/* Restrictions on malloc/realloc/calloc. */
>+#ifdef malloc
>+#undef malloc
>+#endif
>+#define malloc(s) __ERROR_DONT_USE_MALLOC_DIRECTLY
>+
>+#ifdef realloc
>+#undef realloc
>+#endif
>+#define realloc(p,s) __ERROR_DONT_USE_REALLOC_DIRECTLY
>+
>+#ifdef calloc
>+#undef calloc
>+#endif
>+#define calloc(n,s) __ERROR_DONT_USE_CALLOC_DIRECTLY
>+
>+#ifdef strndup
>+#undef strndup
>+#endif
>+#define strndup(s,n) __ERROR_DONT_USE_STRNDUP_DIRECTLY
>+
>+#ifdef strdup
>+#undef strdup
>+#endif
>+#define strdup(s) __ERROR_DONT_USE_STRDUP_DIRECTLY
>+
>+#define SMB_MALLOC(s) malloc_(s)
>+#define SMB_MALLOC_P(type) (type *)malloc_(sizeof(type))
>+
>+#define SMB_STRDUP(s) smb_xstrdup(s)
>+#define SMB_STRNDUP(s,n) smb_xstrndup(s,n)
>+
>+#else /* PARANOID_MEMORY_CHECKER disabled */
>+
>+#define TALLOC(ctx, size) talloc((ctx),(size))
>+#define TALLOC_P(ctx, type) (type *)talloc((ctx),sizeof(type))
>+#define TALLOC_ARRAY(ctx, type, count) (type *)talloc_array((ctx),sizeof(type),(count))
>+#define TALLOC_MEMDUP(ctx, ptr, size) talloc_memdup((ctx),(ptr),(size))
>+#define TALLOC_ZERO(ctx, size) talloc_zero((ctx),(size))
>+#define TALLOC_ZERO_P(ctx, type) (type *)talloc_zero((ctx),sizeof(type))
>+#define TALLOC_ZERO_ARRAY(ctx, type, count) (type *)talloc_zero_array((ctx),sizeof(type),(count))
>+#define TALLOC_REALLOC(ctx, ptr, count) talloc_realloc((ctx),(ptr),(count))
>+#define TALLOC_REALLOC_ARRAY(ctx, ptr, type, count) (type *)talloc_realloc_array((ctx),(ptr),sizeof(type),(count))
>+
>+#define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem((ps),sizeof(type),(count))
>+
>+/* Regular malloc code. */
>+
>+#define SMB_MALLOC(s) malloc(s)
>+#define SMB_MALLOC_P(type) (type *)malloc(sizeof(type))
>+
>+#define SMB_STRDUP(s) strdup(s)
>+#define SMB_STRNDUP(s,n) strndup(s,n)
>+
>+#endif /* not PARANOID_MEMORY_CHECKER */
>+
> #endif /* _SMB_MACROS_H */
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/access.c samba-2.2.12-backport/source/lib/access.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/access.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/access.c	2004-12-15 23:26:44.000000000 -0500
>@@ -81,7 +81,7 @@
> 			DEBUG(0,("Unable to get default yp domain.\n"));
> 			return False;
> 		}
>-		if (!(hostname = strdup(s))) {
>+		if (!(hostname = SMB_STRDUP(s))) {
> 			DEBUG(1,("out of memory for strdup!\n"));
> 			return False;
> 		}
>@@ -167,7 +167,7 @@
>      */
> 
>     /* jkf -- can get called recursively with NULL list */
>-    listcopy = (list == 0) ? (char *)0 : strdup(list);
>+    listcopy = (list == 0) ? (char *)0 : SMB_STRDUP(list);
> 
>     /*
>      * Process tokens one at a time. We have exhausted all possible matches
>@@ -259,7 +259,7 @@
> 	char		*listcopy,
> 			*tok;
> 			
>-	listcopy = strdup(list);
>+	listcopy = SMB_STRDUP(list);
> 
> 	for (tok = strtok(listcopy, sep); tok ; tok = strtok(NULL, sep)) 
> 	{
>@@ -304,9 +304,9 @@
> 		deny_list ? deny_list : "NULL"));
> 
> 	if (deny_list) 
>-		deny = strdup(deny_list);
>+		deny = SMB_STRDUP(deny_list);
> 	if (allow_list) 
>-		allow = strdup(allow_list);
>+		allow = SMB_STRDUP(allow_list);
> 
> 	if ((!deny || *deny==0) && (!allow || *allow==0))
> 		ret = True;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/bitmap.c samba-2.2.12-backport/source/lib/bitmap.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/bitmap.c	2004-12-16 11:53:56.000000000 -0500
>+++ samba-2.2.12-backport/source/lib/bitmap.c	2004-12-16 00:30:13.000000000 -0500
>@@ -32,18 +32,18 @@
> {
> 	struct bitmap *bm;
> 
>-	bm = (struct bitmap *)malloc(sizeof(*bm));
>+	bm = SMB_MALLOC_P(struct bitmap);
> 
> 	if (!bm) return NULL;
> 	
> 	bm->n = n;
>-	bm->b = (uint32 *)malloc(sizeof(bm->b[0])*(n+31)/32);
>+	bm->b = SMB_MALLOC_ARRAY( uint32, (n+31)/32 );
> 	if (!bm->b) {
> 		SAFE_FREE(bm);
> 		return NULL;
> 	}
> 
>-	memset(bm->b, 0, sizeof(bm->b[0])*(n+31)/32);
>+	memset(bm->b, 0, sizeof(uint32)*((n+31)/32));
> 
> 	return bm;
> }
>@@ -70,7 +70,7 @@
>         int count = MIN(dst->n, src->n);
> 
>         SMB_ASSERT(dst->b != src->b);
>-	memcpy(dst->b, src->b, sizeof(dst->b[0])*(count+31)/32);
>+	memcpy(dst->b, src->b, sizeof(uint32)*((count+31)/32));
> 
>         return count;
> }
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/charset.c samba-2.2.12-backport/source/lib/charset.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/charset.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/charset.c	2004-12-15 23:26:44.000000000 -0500
>@@ -287,7 +287,7 @@
>   }
> 
>   /* Allocate space for the code page file and read it all in. */
>-  if((cp_p = (codepage_p)malloc( size  + 4 )) == NULL)
>+  if((cp_p = (codepage_p)SMB_MALLOC( size  + 4 )) == NULL)
>   {
>     DEBUG(0,("load_client_codepage: malloc fail.\n"));
>     goto clean_and_exit;
>@@ -378,7 +378,7 @@
> ********************************************************************/
> void add_char_string(const char *s)
> {
>-  char *extra_chars = (char *)strdup(s);
>+  char *extra_chars = SMB_STRDUP(s);
>   char *t;
>   if (!extra_chars) return;
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/hash.c samba-2.2.12-backport/source/lib/hash.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/hash.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/hash.c	2004-12-16 11:23:49.000000000 -0500
>@@ -67,7 +67,7 @@
> 
> 	DEBUG(5, ("Hash size = %d.\n", table->size));
> 
>-	if(!(table->buckets = (ubi_dlList *) malloc(sizeof(ubi_dlList) * table->size))) {
>+	if(!(table->buckets = SMB_MALLOC_ARRAY( ubi_dlList, table->size ))) {
> 		DEBUG(0,("hash_table_init: malloc fail !\n"));
> 		return False;
> 	}
>@@ -207,7 +207,7 @@
> 	 */
> 
> 	string_length = strlen(key);
>-	if(!(hash_elem = (hash_element *) malloc(sizeof(hash_element) + string_length))) {
>+	if(!(hash_elem = (hash_element *) SMB_MALLOC(sizeof(hash_element) + string_length))) {
> 		DEBUG(0,("hash_insert: malloc fail !\n"));
> 		return (hash_element *)NULL;
> 	}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/interface.c samba-2.2.12-backport/source/lib/interface.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/interface.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/interface.c	2004-12-15 23:26:44.000000000 -0500
>@@ -67,7 +67,7 @@
> 		return;
> 	}
> 
>-	iface = (struct interface *)malloc(sizeof(*iface));
>+	iface = SMB_MALLOC_P(struct interface);
> 	if (!iface) return;
> 	
> 	ZERO_STRUCTPN(iface);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/messages.c samba-2.2.12-backport/source/lib/messages.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/messages.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/messages.c	2004-12-17 15:00:43.000000000 -0500
>@@ -183,7 +183,7 @@
> 
> 	if (!dbuf.dptr) {
> 		/* its a new record */
>-		p = (void *)malloc(len + sizeof(rec));
>+		p = (void *)SMB_MALLOC(len + sizeof(rec));
> 		if (!p) goto failed;
> 
> 		memcpy(p, &rec, sizeof(rec));
>@@ -221,7 +221,11 @@
> 	}
> 
> 	/* we're adding to an existing entry */
>-	p = (void *)malloc(dbuf.dsize + len + sizeof(rec));
>+	if(dbuf.dsize >= (INT_MAX-len) || (dbuf.dsize+len) > (INT_MAX-sizeof(rec))) {
>+		DEBUG(0,("message_send_pid: integer overflow detected.\n"));
>+		goto failed;
>+	}
>+	p = (void *)SMB_MALLOC(dbuf.dsize + len + sizeof(rec));
> 	if (!p) goto failed;
> 
> 	memcpy(p, dbuf.dptr, dbuf.dsize);
>@@ -270,7 +274,7 @@
> 	}
> 
> 	if (rec.len > 0) {
>-		(*buf) = (void *)malloc(rec.len);
>+		(*buf) = (void *)SMB_MALLOC(rec.len);
> 		if (!(*buf)) goto failed;
> 
> 		memcpy(*buf, dbuf.dptr+sizeof(rec), rec.len);
>@@ -350,7 +354,7 @@
> {
> 	struct dispatch_fns *dfn;
> 
>-	dfn = (struct dispatch_fns *)malloc(sizeof(*dfn));
>+	dfn = SMB_MALLOC_P(struct dispatch_fns);
> 
> 	if (dfn != NULL) {
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/ms_fnmatch.c samba-2.2.12-backport/source/lib/ms_fnmatch.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/ms_fnmatch.c	2004-12-16 11:53:56.000000000 -0500
>+++ samba-2.2.12-backport/source/lib/ms_fnmatch.c	2004-12-16 00:30:57.000000000 -0500
>@@ -220,7 +220,7 @@
> 	}
> 
> 	if (count != 0) {
>-		max_n = calloc(sizeof(struct max_n), count);
>+		max_n = SMB_CALLOC_ARRAY( struct max_n, count );
> 		if (!max_n) {
> 		return -1;
> 		}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/sysacls.c samba-2.2.12-backport/source/lib/sysacls.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/sysacls.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/sysacls.c	2004-12-16 15:50:23.000000000 -0500
>@@ -697,7 +697,7 @@
> 
> 			maxlen += nbytes + 20 * (acl_d->count - i);
> 
>-			if ((text = Realloc(oldtext, maxlen)) == NULL) {
>+			if ((text = SMB_REALLOC(oldtext, maxlen)) == NULL) {
> 				SAFE_FREE(oldtext);
> 				errno = ENOMEM;
> 				return NULL;
>@@ -1334,7 +1334,7 @@
> 
> 			maxlen += nbytes + 20 * (acl_d->count - i);
> 
>-			if ((text = Realloc(oldtext, maxlen)) == NULL) {
>+			if ((text = SMB_REALLOC(oldtext, maxlen)) == NULL) {
> 				SAFE_FREE(oldtext);
> 				errno = ENOMEM;
> 				return NULL;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/system.c samba-2.2.12-backport/source/lib/system.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/system.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/system.c	2004-12-16 00:26:16.000000000 -0500
>@@ -674,7 +674,7 @@
> 	if (setlen == 0)
> 		setlen = groups_max();
> 
>-	if((group_list = (GID_T *)malloc(setlen * sizeof(GID_T))) == NULL) {
>+	if((group_list = SMB_MALLOC_ARRAY( GID_T, setlen )) == NULL) {
> 		DEBUG(0,("sys_getgroups: Malloc fail.\n"));
> 		return -1;
> 	}
>@@ -723,7 +723,7 @@
> 	 * GID_T array of size setlen.
> 	 */
> 
>-	if((group_list = (GID_T *)malloc(setlen * sizeof(GID_T))) == NULL) {
>+	if((group_list = SMB_MALLOC_ARRAY( GID_T, setlen )) == NULL) {
> 		DEBUG(0,("sys_setgroups: Malloc fail.\n"));
> 		return -1;    
> 	}
>@@ -1071,7 +1071,7 @@
> 	for( argcl = 1; ptr; ptr = strtok(NULL, " \t"))
> 		argcl++;
> 
>-	if((argl = (char **)malloc((argcl + 1) * sizeof(char *))) == NULL)
>+	if((argl = SMB_MALLOC_ARRAY(char *, argcl + 1 )) == NULL)
> 		return NULL;
> 
> 	/*
>@@ -1153,7 +1153,7 @@
> 		goto err_exit;
> 	}
> 
>-	if((entry = (popen_list *)malloc(sizeof(popen_list))) == NULL)
>+	if((entry = SMB_MALLOC_P(popen_list)) == NULL)
> 		goto err_exit;
> 
> 	ZERO_STRUCTP(entry);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/talloc.c samba-2.2.12-backport/source/lib/talloc.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/talloc.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/talloc.c	2004-12-16 14:44:33.000000000 -0500
>@@ -54,6 +54,9 @@
> 
> #include "includes.h"
> 
>+/* Max allowable allococation - 256mb - 0x10000000 */
>+#define MAX_TALLOC_SIZE (1024*1024*256)
>+
> struct talloc_chunk {
> 	struct talloc_chunk *next;
> 	size_t size;
>@@ -121,7 +124,7 @@
> {
> 	TALLOC_CTX *t;
> 
>-	t = (TALLOC_CTX *)malloc(sizeof(TALLOC_CTX));
>+	t = (TALLOC_CTX *)SMB_MALLOC(sizeof(TALLOC_CTX));
> 	if (t) {
> 		t->list = NULL;
> 		t->total_alloc_size = 0;
>@@ -155,16 +158,20 @@
> 
> 
> /** Allocate a bit of memory from the specified pool **/
>+#if defined(PARANOID_MALLOC_CHECKER)
>+void *talloc_(TALLOC_CTX *t, size_t size)
>+#else
> void *talloc(TALLOC_CTX *t, size_t size)
>+#endif
> {
> 	void *p;
> 	struct talloc_chunk *tc;
> 
> 	if (!t || size == 0) return NULL;
> 
>-	p = malloc(size);
>+	p = SMB_MALLOC(size);
> 	if (p) {
>-		tc = malloc(sizeof(*tc));
>+		tc = SMB_MALLOC(sizeof(*tc));
> 		if (tc) {
> 			tc->ptr = p;
> 			tc->size = size;
>@@ -179,8 +186,26 @@
> 	return p;
> }
> 
>+
>+/** Allocate an array of count elements of size x */
>+#if defined(PARANOID_MALLOC_CHECKER)
>+void *talloc_array_(TALLOC_CTX *ctx, size_t el_size, unsigned int count)
>+#else
>+void *talloc_array(TALLOC_CTX *ctx, size_t el_size, unsigned int count)
>+#endif
>+{
>+        if (count >= MAX_TALLOC_SIZE/el_size) {
>+                return NULL;
>+        }
>+       return TALLOC(ctx, el_size * count);
>+}
>+
> /** A talloc version of realloc */
>+#if defined(PARANOID_MALLOC_CHECKER)
>+void *talloc_realloc_(TALLOC_CTX *t, void *ptr, size_t size)
>+#else
> void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size)
>+#endif
> {
> 	struct talloc_chunk *tc;
> 	void *new_ptr;
>@@ -191,11 +216,11 @@
> 
> 	/* realloc(NULL) is equavalent to malloc() */
> 	if (ptr == NULL)
>-		return talloc(t, size);
>+		return TALLOC(t, size);
> 
> 	for (tc=t->list; tc; tc=tc->next) {
> 		if (tc->ptr == ptr) {
>-			new_ptr = Realloc(ptr, size);
>+			new_ptr = SMB_REALLOC(ptr, size);
> 			if (new_ptr) {
> 				t->total_alloc_size += (size - tc->size);
> 				tc->size = size;
>@@ -207,6 +232,19 @@
> 	return NULL;
> }
> 
>+/** Re-allocate an array of count elements of size x */
>+#if defined(PARANOID_MALLOC_CHECKER)
>+void *talloc_realloc_array_(TALLOC_CTX *ctx, void *ptr, size_t el_size, unsigned int count)
>+#else
>+void *talloc_realloc_array(TALLOC_CTX *ctx, void *ptr, size_t el_size, unsigned int count)
>+#endif
>+{
>+        if (count >= MAX_TALLOC_SIZE/el_size) {
>+                return NULL;
>+        }
>+       return TALLOC_REALLOC(ctx, ptr, el_size * count);
>+}
>+
> /** Destroy all the memory allocated inside @p t, but not @p t
>  * itself. */
> void talloc_destroy_pool(TALLOC_CTX *t)
>@@ -257,9 +295,13 @@
> 
> 
> /** talloc and zero memory. */
>+#if defined(PARANOID_MALLOC_CHECKER)
>+void *talloc_zero_(TALLOC_CTX *t, size_t size)
>+#else
> void *talloc_zero(TALLOC_CTX *t, size_t size)
>+#endif
> {
>-	void *p = talloc(t, size);
>+	void *p = TALLOC(t, size);
> 
> 	if (p)
> 		memset(p, '\0', size);
>@@ -267,10 +309,32 @@
> 	return p;
> }
> 
>+#if defined(PARANOID_MALLOC_CHECKER)
>+void *talloc_zero_array_(TALLOC_CTX *t, size_t el_size, unsigned int count)
>+#else
>+void *talloc_zero_array(TALLOC_CTX *t, size_t el_size, unsigned int count)
>+#endif
>+{
>+#if defined(PARANOID_MALLOC_CHECKER)
>+       void *p = talloc_array_(t, el_size, count);
>+#else
>+       void *p = talloc_array(t, el_size, count);
>+#endif
>+
>+       if (p)
>+               memset(p, '\0', el_size*count);
>+
>+       return p;
>+}
>+
> /** memdup with a talloc. */
>+#if defined(PARANOID_MALLOC_CHECKER)
>+void *talloc_memdup_(TALLOC_CTX *t, const void *p, size_t size)
>+#else
> void *talloc_memdup(TALLOC_CTX *t, const void *p, size_t size)
>+#endif
> {
>-	void *newp = talloc(t,size);
>+	void *newp = TALLOC(t,size);
> 
> 	if (newp)
> 		memcpy(newp, p, size);
>@@ -282,7 +346,7 @@
> char *talloc_strdup(TALLOC_CTX *t, const char *p)
> {
> 	if (p)
>-		return talloc_memdup(t, p, strlen(p) + 1);
>+		return TALLOC_MEMDUP(t, p, strlen(p) + 1);
> 	else
> 		return NULL;
> }
>@@ -312,7 +376,7 @@
> 	VA_COPY(ap2, ap);  /* for systems were va_list is a struct */
> 	len = vsnprintf(NULL, 0, fmt, ap2);
> 
>-	ret = talloc(t, len+1);
>+	ret = TALLOC(t, len+1);
> 	if (ret) {
> 		VA_COPY(ap2, ap);
> 		vsnprintf(ret, len+1, fmt, ap2);
>@@ -355,7 +419,7 @@
> 	s_len = strlen(s);
> 	len = vsnprintf(NULL, 0, fmt, ap2);
> 
>-	s = talloc_realloc(t, s, s_len + len+1);
>+	s = TALLOC_REALLOC(t, s, s_len + len+1);
> 	if (!s) return NULL;
> 
> 	VA_COPY(ap2, ap);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/time.c samba-2.2.12-backport/source/lib/time.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/time.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/time.c	2004-12-16 15:50:23.000000000 -0500
>@@ -182,8 +182,7 @@
>     time_t low,high;
> 
>     zone = TimeZone(t);
>-    tdt = (struct dst_table *)Realloc(dst_table,
>-					      sizeof(dst_table[0])*(i+1));
>+    tdt = SMB_REALLOC_ARRAY( dst_table, struct dst_table, i+1 );
>     if (!tdt) {
>       DEBUG(0,("TimeZoneFaster: out of memory!\n"));
>       SAFE_FREE(dst_table);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/username.c samba-2.2.12-backport/source/lib/username.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/username.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/username.c	2004-12-16 00:26:16.000000000 -0500
>@@ -336,7 +336,7 @@
>  		return False;
>  	}
>  
>- 	if ((groups = (gid_t *)malloc(sizeof(gid_t) * num_groups )) == NULL) {
>+ 	if ((groups = SMB_MALLOC_ARRAY( gid_t, num_groups )) == NULL) {
>  		DEBUG(0,("user_in_winbind_group_list: malloc fail.\n"));
>  		goto err;
>  	}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/util.c samba-2.2.12-backport/source/lib/util.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/util.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/util.c	2004-12-17 15:00:43.000000000 -0500
>@@ -23,6 +23,9 @@
> 
> #include "includes.h"
> 
>+/* Max allowable allococation - 256mb - 0x10000000 */
>+#define MAX_ALLOC_SIZE (1024*1024*256)
>+
> #if (defined(HAVE_NETGROUP) && defined (WITH_AUTOMOUNT))
> #ifdef WITH_NISPLUS_HOME
> #ifdef BROKEN_NISPLUS_INCLUDE_FILES
>@@ -159,7 +162,7 @@
> 	while ((p = Atoic(p, &val, ":,")) != NULL && (*p) != ':') {
> 		uint32 *tn;
> 
>-		tn = Realloc((*num), ((*count)+1) * sizeof(uint32));
>+		tn = SMB_REALLOC_ARRAY( *num, uint32, (*count)+1 );
> 		if (tn == NULL)
> 		{
> 			SAFE_FREE(*num);
>@@ -210,18 +213,19 @@
> 
> BOOL directory_exist(char *dname,SMB_STRUCT_STAT *st)
> {
>-  SMB_STRUCT_STAT st2;
>-  BOOL ret;
>+	SMB_STRUCT_STAT st2;
>+	BOOL ret;
> 
>-  if (!st) st = &st2;
>+	if (!st)
>+	    st = &st2;
> 
>-  if (sys_stat(dname,st) != 0) 
>-    return(False);
>+	if (sys_stat(dname,st) != 0) 
>+	    return(False);
> 
>-  ret = S_ISDIR(st->st_mode);
>-  if(!ret)
>-    errno = ENOTDIR;
>-  return ret;
>+	ret = S_ISDIR(st->st_mode);
>+	if(!ret)
>+	    errno = ENOTDIR;
>+	return ret;
> }
> 
> /*******************************************************************
>@@ -525,7 +529,7 @@
> 	size_t num_to_read_thistime;
> 	size_t num_written = 0;
> 
>-	if ((buf = malloc(TRANSFER_BUF_SIZE)) == NULL)
>+	if ((buf = SMB_MALLOC(TRANSFER_BUF_SIZE)) == NULL)
> 		return -1;
> 
> 	while (total < n) {
>@@ -650,11 +654,83 @@
> 	return(False);
> }
> 
>+#if defined(PARANOID_MALLOC_CHECKER)
>+
>+/****************************************************************************
>+ Internal malloc wrapper. Externally visible.
>+****************************************************************************/
>+
>+void *malloc_(size_t size)
>+{
>+	if ( size > MAX_ALLOC_SIZE )
>+		return NULL;
>+#undef malloc
>+       return malloc(size);
>+#define malloc(s) __ERROR_DONT_USE_MALLOC_DIRECTLY
>+}
>+
>+/****************************************************************************
>+ Internal calloc wrapper. Not externally visible.
>+****************************************************************************/
>+
>+static void *calloc_(size_t count, size_t size)
>+{
>+#undef calloc
>+       return calloc(count, size);
>+#define calloc(n,s) __ERROR_DONT_USE_CALLOC_DIRECTLY
>+}
>+
>+/****************************************************************************
>+ Internal realloc wrapper. Not externally visible.
>+****************************************************************************/
>+
>+static void *realloc_(void *ptr, size_t size)
>+{
>+#undef realloc
>+       return realloc(ptr, size);
>+#define realloc(p,s) __ERROR_DONT_USE_RELLOC_DIRECTLY
>+}
>+
>+#endif /* PARANOID_MALLOC_CHECKER */
>+
>+/****************************************************************************
>+ Type-safe malloc.
>+****************************************************************************/
>+
>+void *malloc_array(size_t el_size, unsigned int count)
>+{
>+       if (count >= MAX_ALLOC_SIZE/el_size) {
>+	       return NULL;
>+       }
>+
>+#if defined(PARANOID_MALLOC_CHECKER)
>+       return malloc_(el_size*count);
>+#else
>+       return malloc(el_size*count);
>+#endif
>+}
>+
>+/****************************************************************************
>+ Type-safe calloc.
>+****************************************************************************/
>+
>+void *calloc_array(size_t size, size_t nmemb)
>+{
>+       if (nmemb >= MAX_ALLOC_SIZE/size) {
>+	       return NULL;
>+       }
>+#if defined(PARANOID_MALLOC_CHECKER)
>+       return calloc_(nmemb, size);
>+#else
>+       return calloc(nmemb, size);
>+#endif
>+}
>+
> /****************************************************************************
>  Expand a pointer to be a particular size.
> ****************************************************************************/
> 
>-void *Realloc(void *p,size_t size)
>+void *smb_realloc(void *p,size_t size)
> {
> 	void *ret=NULL;
> 
>@@ -663,11 +739,22 @@
> 		DEBUG(5,("Realloc asked for 0 bytes\n"));
> 		return NULL;
> 	}
>-
>+	if ( size >= MAX_ALLOC_SIZE ) {
>+		SAFE_FREE(p);
>+		DEBUG(5,("Realloc overflow\n"));
>+		return NULL;
>+	}
>+#if defined(PARANOID_MALLOC_CHECKER)
>+       if (!p)
>+	       ret = (void *)malloc_(size);
>+       else
>+	       ret = (void *)realloc_(p,size);
>+#else
> 	if (!p)
> 		ret = (void *)malloc(size);
> 	else
> 		ret = (void *)realloc(p,size);
>+#endif
> 
> 	if (!ret)
> 		DEBUG(0,("Memory allocation error: failed to expand to %d bytes\n",(int)size));
>@@ -676,6 +763,18 @@
> }
> 
> /****************************************************************************
>+ Type-safe realloc.
>++****************************************************************************/
>+
>+void *realloc_array(void *p,size_t el_size, unsigned int count)
>+{
>+       if (count >= MAX_ALLOC_SIZE/el_size) {
>+	    return NULL;
>+	}
>+       return SMB_REALLOC(p,el_size*count);
>+}
>+									      
>+/****************************************************************************
>  Free memory, checks for NULL.
> use directly SAFE_FREE()
> exist only because we need to pass a function pointer somewhere --SSS
>@@ -886,22 +985,22 @@
>     {
>        if (result->status != NIS_SUCCESS)
>       {
>-        DEBUG(3, ("NIS+ query failed: %s\n", nis_sperrno(result->status)));
>-        fstrcpy(last_key, ""); pstrcpy(last_value, "");
>+	DEBUG(3, ("NIS+ query failed: %s\n", nis_sperrno(result->status)));
>+	fstrcpy(last_key, ""); pstrcpy(last_value, "");
>       }
>       else
>       {
>-        object = result->objects.objects_val;
>-        if (object->zo_data.zo_type == ENTRY_OBJ)
>-        {
>-           entry = &object->zo_data.objdata_u.en_data;
>-           DEBUG(5, ("NIS+ entry type: %s\n", entry->en_type));
>-           DEBUG(3, ("NIS+ result: %s\n", entry->en_cols.en_cols_val[1].ec_value.ec_value_val));
>+	object = result->objects.objects_val;
>+	if (object->zo_data.zo_type == ENTRY_OBJ)
>+	{
>+	   entry = &object->zo_data.objdata_u.en_data;
>+	   DEBUG(5, ("NIS+ entry type: %s\n", entry->en_type));
>+	   DEBUG(3, ("NIS+ result: %s\n", entry->en_cols.en_cols_val[1].ec_value.ec_value_val));
>  
>-           pstrcpy(last_value, entry->en_cols.en_cols_val[1].ec_value.ec_value_val);
>-           pstring_sub(last_value, "&", user_name);
>-           fstrcpy(last_key, user_name);
>-        }
>+	   pstrcpy(last_value, entry->en_cols.en_cols_val[1].ec_value.ec_value_val);
>+	   pstring_sub(last_value, "&", user_name);
>+	   fstrcpy(last_key, user_name);
>+	}
>       }
>     }
>     nis_freeresult(result);
>@@ -918,7 +1017,7 @@
>   static fstring last_key = "";
>   static pstring last_value = "";
> 
>-  int nis_error;        /* returned by yp all functions */
>+  int nis_error;	/* returned by yp all functions */
>   char *nis_result;     /* yp_match inits this */
>   int nis_result_len;  /* and set this */
>   char *nis_domain;     /* yp_get_default_domain inits this */
>@@ -939,15 +1038,15 @@
>   } else {
> 
>     if ((nis_error = yp_match(nis_domain, nis_map,
>-                              user_name, strlen(user_name),
>-                              &nis_result, &nis_result_len)) == 0) {
>+			      user_name, strlen(user_name),
>+			      &nis_result, &nis_result_len)) == 0) {
>        if (!nis_error && nis_result_len >= sizeof(pstring)) {
>-               nis_result_len = sizeof(pstring)-1;
>+	       nis_result_len = sizeof(pstring)-1;
>        }
>        fstrcpy(last_key, user_name);
>        strncpy(last_value, nis_result, nis_result_len);
>        last_value[nis_result_len] = '\0';
>-        strip_mount_options(&last_value);
>+	strip_mount_options(&last_value);
> 
>     } else if(nis_error == YPERR_KEY) {
> 
>@@ -955,11 +1054,11 @@
>        use default information for server, and home directory */
>        last_value[0] = 0;
>        DEBUG(3, ("YP Key not found:  while looking up \"%s\" in map \"%s\"\n", 
>-                user_name, nis_map));
>+		user_name, nis_map));
>        DEBUG(3, ("using defaults for server and home directory\n"));
>     } else {
>        DEBUG(3, ("YP Error: \"%s\" while looking up \"%s\" in map \"%s\"\n", 
>-               yperr_string(nis_error), user_name, nis_map));
>+	       yperr_string(nis_error), user_name, nis_map));
>     }
>   }
> 
>@@ -981,7 +1080,7 @@
>   nmask = ntohl(mask.s_addr);
>   net1  = ntohl(ip1.s_addr);
>   net2  = ntohl(ip2.s_addr);
>-            
>+	    
>   return((net1 & nmask) == (net2 & nmask));
> }
> 
>@@ -1162,18 +1261,18 @@
>     {
>       if (mask_match(last_component, namelist->name, case_sensitive))
>       {
>-         DEBUG(8,("is_in_path: mask match succeeded\n"));
>-         return True;
>+	 DEBUG(8,("is_in_path: mask match succeeded\n"));
>+	 return True;
>       }
>     }
>     else
>     {
>       if((case_sensitive && (strcmp(last_component, namelist->name) == 0))||
>        (!case_sensitive && (StrCaseCmp(last_component, namelist->name) == 0)))
>-        {
>-         DEBUG(8,("is_in_path: match succeeded\n"));
>-         return True;
>-        }
>+	{
>+	 DEBUG(8,("is_in_path: match succeeded\n"));
>+	 return True;
>+	}
>     }
>   }
>   DEBUG(8,("is_in_path: match not found\n"));
>@@ -1213,17 +1312,17 @@
>   while(*nameptr) 
>     {
>       if ( *nameptr == '/' ) 
>-        {
>-          /* cope with multiple (useless) /s) */
>-          nameptr++;
>-          continue;
>-        }
>+	{
>+	  /* cope with multiple (useless) /s) */
>+	  nameptr++;
>+	  continue;
>+	}
>       /* find the next / */
>       name_end = strchr(nameptr, '/');
> 
>       /* oops - the last check for a / didn't find one. */
>       if (name_end == NULL)
>-        break;
>+	break;
> 
>       /* next segment please */
>       nameptr = name_end + 1;
>@@ -1233,39 +1332,38 @@
>   if(num_entries == 0)
>     return;
> 
>-  if(( (*ppname_array) = (name_compare_entry *)malloc( 
>-           (num_entries + 1) * sizeof(name_compare_entry))) == NULL)
>-        {
>+  if(( (*ppname_array) = SMB_MALLOC_ARRAY( name_compare_entry, num_entries + 1)) == NULL)
>+	{
>     DEBUG(0,("set_namearray: malloc fail\n"));
>     return;
>-        }
>+	}
> 
>   /* Now copy out the names */
>   nameptr = namelist;
>   i = 0;
>   while(*nameptr)
>-             {
>+	     {
>       if ( *nameptr == '/' ) 
>       {
>-          /* cope with multiple (useless) /s) */
>-          nameptr++;
>-          continue;
>+	  /* cope with multiple (useless) /s) */
>+	  nameptr++;
>+	  continue;
>       }
>       /* find the next / */
>       if ((name_end = strchr(nameptr, '/')) != NULL) 
>       {
>-          *name_end = 0;
>-         }
>+	  *name_end = 0;
>+	 }
> 
>       /* oops - the last check for a / didn't find one. */
>       if(name_end == NULL) 
>-        break;
>+	break;
> 
>       (*ppname_array)[i].is_wild = ms_has_wild(nameptr);
>-      if(((*ppname_array)[i].name = strdup(nameptr)) == NULL)
>+      if(((*ppname_array)[i].name = SMB_STRDUP(nameptr)) == NULL)
>       {
>-        DEBUG(0,("set_namearray: malloc fail (1)\n"));
>-        return;
>+	DEBUG(0,("set_namearray: malloc fail (1)\n"));
>+	return;
>       }
> 
>       /* next segment please */
>@@ -1322,9 +1420,9 @@
>   if (op == SMB_F_GETLK)
>   {
>     if ((ret != -1) &&
>-        (lock.l_type != F_UNLCK) && 
>-        (lock.l_pid != 0) && 
>-        (lock.l_pid != sys_getpid()))
>+	(lock.l_type != F_UNLCK) && 
>+	(lock.l_pid != 0) && 
>+	(lock.l_pid != sys_getpid()))
>     {
>       DEBUG(3,("fcntl_lock: fd %d is locked by pid %d\n",fd,(int)lock.l_pid));
>       return(True);
>@@ -1338,7 +1436,7 @@
>   if (ret == -1)
>   {
>     DEBUG(3,("fcntl_lock: lock failed at offset %.0f count %.0f op %d type %d (%s)\n",
>-          (double)offset,(double)count,op,type,strerror(errno)));
>+	  (double)offset,(double)count,op,type,strerror(errno)));
>     return(False);
>   }
> 
>@@ -1577,7 +1675,7 @@
>  * Provide a checksum on a string
>  *
>  *  Input:  s - the null-terminated character string for which the checksum
>- *              will be calculated.
>+ *	      will be calculated.
>  *
>  *  Output: The checksum value calculated for s.
>  *
>@@ -1757,13 +1855,19 @@
>  malloc that aborts with smb_panic on fail or zero size.
>  *****************************************************************/  
> 
>-void *smb_xmalloc(size_t size)
>+void *smb_xmalloc_array(size_t size, unsigned int count)
> {
> 	void *p;
> 	if (size == 0)
>-		smb_panic("smb_xmalloc: called with zero size.\n");
>-	if ((p = malloc(size)) == NULL)
>-		smb_panic("smb_xmalloc: malloc fail.\n");
>+	       smb_panic("smb_xmalloc_array: called with zero size.\n");
>+	if (count >= MAX_ALLOC_SIZE/size) {
>+		smb_panic("smb_xmalloc: alloc size too large.\n");
>+	}
>+	if ((p = SMB_MALLOC(size*count)) == NULL) {
>+	       DEBUG(0, ("smb_xmalloc_array failed to allocate %lu * %lu bytes\n",
>+		       (unsigned long)size, (unsigned long)count));
>+	       smb_panic("smb_xmalloc_array: malloc fail.\n");
>+	}
> 	return p;
> }
> 
>@@ -1773,7 +1877,7 @@
> void *smb_xmemdup(const void *p, size_t size)
> {
> 	void *p2;
>-	p2 = smb_xmalloc(size);
>+	p2 = SMB_XMALLOC_ARRAY(unsigned char, size);
> 	memcpy(p2, p, size);
> 	return p2;
> }
>@@ -1783,12 +1887,38 @@
> **/
> char *smb_xstrdup(const char *s)
> {
>+#if defined(PARANOID_MALLOC_CHECKER) && defined(strdup)
>+#undef strdup
>+#endif
> 	char *s1 = strdup(s);
>+#if defined(PARANOID_MALLOC_CHECKER)
>+#define strdup(s) __ERROR_DONT_USE_STRDUP_DIRECTLY
>+#endif
> 	if (!s1)
> 		smb_panic("smb_xstrdup: malloc fail\n");
> 	return s1;
> }
> 
>+/**
>+ strndup that aborts on malloc fail.
>+ **/
>+
>+char *smb_xstrndup(const char *s, size_t n)
>+{
>+#if defined(PARANOID_MALLOC_CHECKER)
>+#ifdef strndup
>+#undef strndup
>+#endif
>+#endif
>+	char *s1 = strndup(s, n);
>+#if defined(PARANOID_MALLOC_CHECKER)
>+#define strndup(s,n) __ERROR_DONT_USE_STRNDUP_DIRECTLY
>+#endif
>+	if (!s1)
>+		smb_panic("smb_xstrndup: malloc fail\n");
>+	return s1;
>+}
>+
> /*
>   vasprintf that aborts on malloc fail
> */
>@@ -1813,7 +1943,7 @@
> {
> 	void *p2;
> 	if (size == 0) return NULL;
>-	p2 = malloc(size);
>+	p2 = SMB_MALLOC(size);
> 	if (!p2) return NULL;
> 	memcpy(p2, p, size);
> 	return p2;
>@@ -2095,7 +2225,7 @@
> 	if (p) {
> 		ret.data = smb_xmemdup(p, length);
> 	} else {
>-		ret.data = smb_xmalloc(length);
>+		ret.data = SMB_XMALLOC_ARRAY(char, length);
> 	}
> 	ret.length = length;
> 	ret.free = free_data_blob;
>@@ -2115,7 +2245,7 @@
> 		return ret;
> 	}
> 
>-	ret.data = talloc_memdup(mem_ctx, p, length);
>+	ret.data = TALLOC_MEMDUP(mem_ctx, p, length);
> 	if (ret.data == NULL)
> 		smb_panic("data_blob_talloc: talloc_memdup failed.\n");
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/util_file.c samba-2.2.12-backport/source/lib/util_file.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/util_file.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/util_file.c	2004-12-17 15:00:43.000000000 -0500
>@@ -288,7 +288,7 @@
>       char *t;
> 
>       maxlen = MIN(maxlen,8);
>-      t = (char *)Realloc(s,maxlen);
>+      t = (char *)SMB_REALLOC(s,maxlen);
>       if (!t) {
>         DEBUG(0,("fgets_slash: failed to expand buffer!\n"));
>         SAFE_FREE(s);
>@@ -337,7 +337,7 @@
>         char *t;
> 
>         maxlen *= 2;
>-        t = (char *)Realloc(s,maxlen);
>+        t = (char *)SMB_REALLOC(s,maxlen);
>         if (!t) {
>           DEBUG(0,("fgets_slash: failed to expand buffer!\n"));
>           SAFE_FREE(s);
>@@ -367,7 +367,13 @@
> 	total = 0;
> 
> 	while ((n = read(fd, buf, sizeof(buf))) > 0) {
>-		tp = Realloc(p, total + n + 1);
>+		if(total >= INT_MAX-n) {
>+			DEBUG(0,("file_pload: integer overflow detected.\n"));
>+			close(fd);
>+			SAFE_FREE(p);
>+			return NULL;
>+		}
>+		tp = SMB_REALLOC(p, total + n + 1);
> 		if (!tp) {
> 			DEBUG(0,("file_pload: failed to exand buffer!\n"));
> 			close(fd);
>@@ -398,7 +404,9 @@
> 
> 	if (sys_fstat(fd, &sbuf) != 0) return NULL;
> 
>-	p = (char *)malloc(sbuf.st_size+1);
>+	if(sbuf.st_size >= INT_MAX)
>+		return NULL;
>+	p = (char *)SMB_MALLOC(sbuf.st_size+1);
> 	if (!p) return NULL;
> 
> 	if (read(fd, p, sbuf.st_size) != sbuf.st_size) {
>@@ -447,7 +455,7 @@
> 		if (s[0] == '\n') i++;
> 	}
> 
>-	ret = (char **)malloc(sizeof(ret[0])*(i+2));
>+	ret = SMB_MALLOC_ARRAY( char *, i+2 );
> 	if (!ret) {
> 		SAFE_FREE(p);
> 		return NULL;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/util_getent.c samba-2.2.12-backport/source/lib/util_getent.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/util_getent.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/util_getent.c	2004-12-16 11:23:49.000000000 -0500
>@@ -55,7 +55,7 @@
> 	struct sys_grent *gent;
> 	struct group *grp;
> 	
>-	gent = (struct sys_grent *) malloc(sizeof(struct sys_grent));
>+	gent = SMB_MALLOC_P(struct sys_grent);
> 	if (gent == NULL) {
> 		DEBUG (0, ("Out of memory in getgrent_list!\n"));
> 		return NULL;
>@@ -75,11 +75,11 @@
> 		int i,num;
> 		
> 		if (grp->gr_name) {
>-			if ((gent->gr_name = strdup(grp->gr_name)) == NULL)
>+			if ((gent->gr_name = SMB_STRDUP(grp->gr_name)) == NULL)
> 				goto err;
> 		}
> 		if (grp->gr_passwd) {
>-			if ((gent->gr_passwd = strdup(grp->gr_passwd)) == NULL)
>+			if ((gent->gr_passwd = SMB_STRDUP(grp->gr_passwd)) == NULL)
> 				goto err;
> 		}
> 		gent->gr_gid = grp->gr_gid;
>@@ -89,20 +89,20 @@
> 			;
> 		
> 		/* alloc space for gr_mem string pointers */
>-		if ((gent->gr_mem = (char **) malloc((num+1) * sizeof(char *))) == NULL)
>+		if ((gent->gr_mem = SMB_MALLOC_ARRAY( char *, num+1 )) == NULL)
> 			goto err;
> 
> 		memset(gent->gr_mem, '\0', (num+1) * sizeof(char *));
> 
> 		for (i=0; i < num; i++) {
>-			if ((gent->gr_mem[i] = strdup(grp->gr_mem[i])) == NULL)
>+			if ((gent->gr_mem[i] = SMB_STRDUP(grp->gr_mem[i])) == NULL)
> 				goto err;
> 		}
> 		gent->gr_mem[num] = NULL;
> 		
> 		grp = getgrent();
> 		if (grp) {
>-			gent->next = (struct sys_grent *) malloc(sizeof(struct sys_grent));
>+			gent->next = SMB_MALLOC_P(struct sys_grent);
> 			if (gent->next == NULL)
> 				goto err;
> 			gent = gent->next;
>@@ -156,7 +156,7 @@
> 	struct sys_pwent *pent;
> 	struct passwd *pwd;
> 	
>-	pent = (struct sys_pwent *) malloc(sizeof(struct sys_pwent));
>+	pent = SMB_MALLOC_P(struct sys_pwent);
> 	if (pent == NULL) {
> 		DEBUG (0, ("Out of memory in getpwent_list!\n"));
> 		return NULL;
>@@ -168,31 +168,31 @@
> 	while (pwd != NULL) {
> 		memset(pent, '\0', sizeof(struct sys_pwent));
> 		if (pwd->pw_name) {
>-			if ((pent->pw_name = strdup(pwd->pw_name)) == NULL)
>+			if ((pent->pw_name = SMB_STRDUP(pwd->pw_name)) == NULL)
> 				goto err;
> 		}
> 		if (pwd->pw_passwd) {
>-			if ((pent->pw_passwd = strdup(pwd->pw_passwd)) == NULL)
>+			if ((pent->pw_passwd = SMB_STRDUP(pwd->pw_passwd)) == NULL)
> 				goto err;
> 		}
> 		pent->pw_uid = pwd->pw_uid;
> 		pent->pw_gid = pwd->pw_gid;
> 		if (pwd->pw_gecos) {
>-			if ((pent->pw_name = strdup(pwd->pw_gecos)) == NULL)
>+			if ((pent->pw_name = SMB_STRDUP(pwd->pw_gecos)) == NULL)
> 				goto err;
> 		}
> 		if (pwd->pw_dir) {
>-			if ((pent->pw_name = strdup(pwd->pw_dir)) == NULL)
>+			if ((pent->pw_name = SMB_STRDUP(pwd->pw_dir)) == NULL)
> 				goto err;
> 		}
> 		if (pwd->pw_shell) {
>-			if ((pent->pw_name = strdup(pwd->pw_shell)) == NULL)
>+			if ((pent->pw_name = SMB_STRDUP(pwd->pw_shell)) == NULL)
> 				goto err;
> 		}
> 
> 		pwd = getpwent();
> 		if (pwd) {
>-			pent->next = (struct sys_pwent *) malloc(sizeof(struct sys_pwent));
>+			pent->next = SMB_MALLOC_P(struct sys_pwent);
> 			if (pent->next == NULL)
> 				goto err;
> 			pent = pent->next;
>@@ -245,12 +245,12 @@
> 		;
> 
> 	for (i = 0; i < num_users; i++) {
>-		struct sys_userlist *entry = (struct sys_userlist *)malloc(sizeof(*entry));
>+		struct sys_userlist *entry = SMB_MALLOC_P(struct sys_userlist);
> 		if (entry == NULL) {
> 			free_userlist(list_head);
> 			return NULL;
> 		}
>-		entry->unix_name = strdup(grp->gr_mem[i]);
>+		entry->unix_name = SMB_STRDUP(grp->gr_mem[i]);
> 		if (entry->unix_name == NULL) {
> 			SAFE_FREE(entry);
> 			free_userlist(list_head);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/util_seaccess.c samba-2.2.12-backport/source/lib/util_seaccess.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/util_seaccess.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/util_seaccess.c	2004-12-16 16:50:41.000000000 -0500
>@@ -352,7 +352,7 @@
> 
> 	the_acl = parent_ctr->dacl;
> 
>-	if (!(new_ace_list = talloc(ctx, sizeof(SEC_ACE) * the_acl->num_aces))) 
>+	if (!(new_ace_list = TALLOC(ctx, sizeof(SEC_ACE) * the_acl->num_aces))) 
> 		return NULL;
> 
> 	for (i = 0; the_acl && i < the_acl->num_aces; i++) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/util_sid.c samba-2.2.12-backport/source/lib/util_sid.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/util_sid.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/util_sid.c	2004-12-17 15:00:43.000000000 -0500
>@@ -394,7 +394,7 @@
> 
>   memset((char *)sidout, '\0', sizeof(DOM_SID));
> 
>-  p = q = strdup(sidstr + 2);
>+  p = q = SMB_STRDUP(sidstr + 2);
>   if (p == NULL) {
>     DEBUG(0, ("string_to_sid: out of memory!\n"));
>     return False;
>@@ -511,7 +511,7 @@
>   if(!src)
>     return NULL;
> 
>-  if((dst = malloc(sizeof(DOM_SID))) != NULL) {
>+  if((dst = SMB_MALLOC_P(DOM_SID)) != NULL) {
> 	memset(dst, '\0', sizeof(DOM_SID));
> 	sid_copy( dst, src);
>   }
>@@ -715,8 +715,8 @@
> char *sid_binstring(DOM_SID *sid)
> {
> 	char *buf, *s;
>-	int len = sid_size(sid);
>-	buf = malloc(len);
>+	size_t len = sid_size(sid);
>+	buf = SMB_MALLOC(len);
> 	if (!buf) return NULL;
> 	sid_linearize(buf, len, sid);
> 	s = binary_string(buf, len);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/util_str.c samba-2.2.12-backport/source/lib/util_str.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/util_str.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/util_str.c	2004-12-17 15:00:43.000000000 -0500
>@@ -103,7 +103,7 @@
>   *ctok=ictok;
>   s=last_ptr;
> 
>-  if (!(ret=iret=malloc(ictok*sizeof(char *)))) return NULL;
>+  if (!(ret=iret=SMB_MALLOC_ARRAY( char *, ictok ))) return NULL;
>   
>   while(ictok--) {    
>     *iret++=s;
>@@ -977,7 +977,7 @@
> 	if (buflen >= (2*maxlength))
> 		buflen = 2*(maxlength - 1);
> 
>-	str_ucs = (smb_ucs2_t*)malloc(buflen);
>+	str_ucs = (smb_ucs2_t*)SMB_MALLOC(buflen);
> 	if(!str_ucs) {
> 		*dest=0;
> 		return dest;
>@@ -990,7 +990,7 @@
> 
> 	/* Get UCS2 version of other_safe_chars string*/
> 	buflen=2*strlen(other_safe_chars)+2;
>-	other_ucs = (smb_ucs2_t*)malloc(buflen);
>+	other_ucs = (smb_ucs2_t*)SMB_MALLOC(buflen);
> 	if(!other_ucs) {
> 		*dest=0;
> 		SAFE_FREE(str_ucs);
>@@ -1144,7 +1144,7 @@
>   if (l == 0)
>     {
>       if (!null_string) {
>-        if((null_string = (char *)malloc(1)) == NULL) {
>+        if((null_string = (char *)SMB_MALLOC(1)) == NULL) {
>           DEBUG(0,("string_init: malloc fail for null_string.\n"));
>           return False;
>         }
>@@ -1154,7 +1154,7 @@
>     }
>   else
>     {
>-      (*dest) = (char *)malloc(l+1);
>+      (*dest) = (char *)SMB_MALLOC(l+1);
>       if ((*dest) == NULL) {
> 	      DEBUG(0,("Out of memory in string_init\n"));
> 	      return False;
>@@ -1360,7 +1360,10 @@
> 	char *s;
> 	int i, j;
> 	const char *hex = "0123456789ABCDEF";
>-	s = malloc(len * 3 + 1);
>+
>+	if(len <= 0 || len >= (INT_MAX/3)-1)
>+	    return NULL;
>+	s = SMB_MALLOC(len * 3 + 1);
> 	if (!s) return NULL;
> 	for (j=i=0;i<len;i++) {
> 		s[j] = '\\';
>@@ -1396,7 +1399,7 @@
> 	char *ret;
> 
> 	n = strnlen(s, n);
>-	ret = malloc(n+1);
>+	ret = SMB_MALLOC(n+1);
> 	if (!ret)
> 		return NULL;
> 	memcpy(ret, s, n);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/util_unistr.c samba-2.2.12-backport/source/lib/util_unistr.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/util_unistr.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/util_unistr.c	2004-12-17 15:00:43.000000000 -0500
>@@ -569,7 +569,7 @@
> 
>   free_maps(pp_cp_to_ucs2, pp_ucs2_to_cp);
> 
>-  if ((*pp_ucs2_to_cp = (uint16 *)malloc(2*65536)) == NULL) {
>+  if ((*pp_ucs2_to_cp = SMB_MALLOC_ARRAY( uint16, 65536 )) == NULL) {
>     DEBUG(0,("default_unicode_map: malloc fail for ucs2_to_cp size %u.\n", 2*65536));
>     abort();
>   }
>@@ -673,12 +673,12 @@
> 
>   free_maps(pp_cp_to_ucs2, pp_ucs2_to_cp);
> 
>-  if ((cp_to_ucs2 = (smb_ucs2_t *)malloc(cp_to_ucs2_size)) == NULL) {
>+  if ((cp_to_ucs2 = (smb_ucs2_t *)SMB_MALLOC(cp_to_ucs2_size)) == NULL) {
>     DEBUG(0,("load_unicode_map: malloc fail for cp_to_ucs2 size %u.\n", cp_to_ucs2_size ));
>     goto clean_and_exit;
>   }
> 
>-  if ((ucs2_to_cp = (uint16 *)malloc(ucs2_to_cp_size)) == NULL) {
>+  if ((ucs2_to_cp = (uint16 *)SMB_MALLOC(ucs2_to_cp_size)) == NULL) {
>     DEBUG(0,("load_unicode_map: malloc fail for ucs2_to_cp size %u.\n", ucs2_to_cp_size ));
>     goto clean_and_exit;
>   }
>@@ -1150,12 +1150,16 @@
> 
> smb_ucs2_t *strdup_w(const smb_ucs2_t *s)
> {
>-	size_t newlen = (strlen_w(s)+1)*sizeof(smb_ucs2_t);
>-	smb_ucs2_t *newstr = (smb_ucs2_t *)malloc(newlen);
>-    if (newstr == NULL)
>-        return NULL;
>-    safe_strcpy_w(newstr, s, newlen);
>-    return newstr;
>+	size_t newlen;
>+	smb_ucs2_t *newstr;
>+
>+	newstr = SMB_MALLOC_ARRAY(smb_ucs2_t, strlen_w(s)+1 );
>+
>+	if (newstr == NULL)
>+	    return NULL;
>+	newlen = (strlen_w(s)+1)*sizeof(smb_ucs2_t);
>+	safe_strcpy_w(newstr, s, newlen);
>+	return newstr;
> }
> 
> /*******************************************************************
>@@ -1382,7 +1386,7 @@
> 	*ctok = ictok;
> 	s = last_ptr;
> 
>-	if (!(ret=iret=malloc(ictok*sizeof(smb_ucs2_t *))))
>+	if (!(ret=iret=SMB_MALLOC_ARRAY( smb_ucs2_t *, ictok )))
> 		return NULL;
>   
> 	while(ictok--) {
>@@ -1855,7 +1859,7 @@
> 	size_t l;
> 
> 	if (!null_string) {
>-		if((null_string = (smb_ucs2_t *)malloc(sizeof(smb_ucs2_t))) == NULL) {
>+		if((null_string = SMB_MALLOC_P(smb_ucs2_t)) == NULL) {
> 			DEBUG(0,("string_init_w: malloc fail for null_string.\n"));
> 		return False;
> 		}
>@@ -1870,7 +1874,7 @@
> 	if (l == 0)
> 		*dest = null_string;
> 	else {
>-		(*dest) = (smb_ucs2_t *)malloc(sizeof(smb_ucs2_t)*(l+1));
>+		(*dest) = SMB_MALLOC_ARRAY( smb_ucs2_t, l+1 );
> 		if ((*dest) == NULL) {
> 			DEBUG(0,("Out of memory in string_init_w\n"));
> 			return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/lib/wins_srv.c samba-2.2.12-backport/source/lib/wins_srv.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/lib/wins_srv.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/lib/wins_srv.c	2004-12-15 23:48:20.000000000 -0500
>@@ -139,7 +139,7 @@
>   DEBUG( 4, ("wins_srv_load_list(): Building WINS server list:\n") );
>   while( next_token( &p, wins_id_bufr, LIST_SEP, sizeof( wins_id_bufr ) ) )
>     {
>-    entry = (list_entry *)malloc( sizeof( list_entry ) );
>+    entry = SMB_MALLOC_P(list_entry);
>     if( NULL == entry )
>       {
>       DEBUG( 0, ("wins_srv_load_list(): malloc(list_entry) failed.\n") );
>@@ -147,7 +147,7 @@
>     else
>       {
>       entry->mourning = 0;
>-      if( NULL == (entry->server = strdup( wins_id_bufr )) )
>+      if( NULL == (entry->server = SMB_STRDUP( wins_id_bufr )) )
>         {
>         SAFE_FREE( entry );
>         DEBUG( 0, ("wins_srv_load_list(): strdup(\"%s\") failed.\n", wins_id_bufr) );
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/cli_lsarpc.c samba-2.2.12-backport/source/libsmb/cli_lsarpc.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/cli_lsarpc.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/cli_lsarpc.c	2004-12-16 14:43:02.000000000 -0500
>@@ -282,22 +282,19 @@
> 		goto done;
> 	}
> 
>-	if (!((*domains) = (char **)talloc(mem_ctx, sizeof(char *) *
>-					   num_sids))) {
>+	if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*names) = (char **)talloc(mem_ctx, sizeof(char *) *
>-					 num_sids))) {
>+	if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*types) = (uint32 *)talloc(mem_ctx, sizeof(uint32) *
>-					  num_sids))) {
>+	if (!((*types) = TALLOC_ARRAY(mem_ctx, uint32, num_sids))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
>@@ -400,15 +397,13 @@
> 		goto done;
> 	}
> 
>-	if (!((*sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) *
>-					 num_names)))) {
>+	if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*types = (uint32 *)talloc(mem_ctx, sizeof(uint32) *
>-					 num_names)))) {
>+	if (!((*types = TALLOC_ARRAY(mem_ctx, uint32, num_names)))) {
> 		DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
>@@ -589,8 +584,7 @@
> 
> 		/* Allocate memory for trusted domain names and sids */
> 
>-		*domain_names = (char **)talloc(mem_ctx, sizeof(char *) *
>-						r.num_domains);
>+		*domain_names = TALLOC_ARRAY(mem_ctx, char *, r.num_domains);
> 
> 		if (!*domain_names) {
> 			DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
>@@ -598,8 +592,7 @@
> 			goto done;
> 		}
> 
>-		*domain_sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) *
>-						 r.num_domains);
>+		*domain_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.num_domains);
> 		if (!domain_sids) {
> 			DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
> 			result = NT_STATUS_UNSUCCESSFUL;
>@@ -674,19 +667,19 @@
> 	*enum_context = r.enum_context;
> 	*count = r.count;
> 
>-	if (!((*privs_name = (char **)talloc(mem_ctx, sizeof(char *) * r.count)))) {
>+	if (!((*privs_name = TALLOC_ARRAY(mem_ctx, char *, r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*privs_high = (uint32 *)talloc(mem_ctx, sizeof(uint32) * r.count)))) {
>+	if (!((*privs_high = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
> 
>-	if (!((*privs_low = (uint32 *)talloc(mem_ctx, sizeof(uint32) * r.count)))) {
>+	if (!((*privs_low = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
>@@ -810,7 +803,7 @@
> 
> 	/* Return output parameters */
> 
>-	*sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * r.sids.num_entries);
>+	*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.sids.num_entries);
> 	if (!*sids) {
> 		DEBUG(0, ("(cli_lsa_enum_sids): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
>@@ -935,7 +928,7 @@
> 	if (r.count == 0)
> 		goto done;
> 
>-	if (!((*set = (LUID_ATTR *)talloc(mem_ctx, sizeof(LUID_ATTR) * r.count)))) {
>+	if (!((*set = TALLOC_ARRAY(mem_ctx, LUID_ATTR, r.count)))) {
> 		DEBUG(0, ("(cli_lsa_enum_privsaccount): out of memory\n"));
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/cli_samr.c samba-2.2.12-backport/source/libsmb/cli_samr.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/cli_samr.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/cli_samr.c	2004-12-15 14:43:16.000000000 -0500
>@@ -551,8 +551,7 @@
> 
> 	*num_dom_groups = r.num_entries2;
> 
>-	if (!((*dom_groups) = (struct acct_info *)
>-	      talloc(mem_ctx, sizeof(struct acct_info) * *num_dom_groups))) {
>+	if (!((*dom_groups) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_dom_groups))) {
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
>@@ -629,8 +628,7 @@
> 
> 	*num_dom_groups = r.num_entries2;
> 
>-	if (!((*dom_groups) = (struct acct_info *)
>-	      talloc(mem_ctx, sizeof(struct acct_info) * *num_dom_groups))) {
>+	if (!((*dom_groups) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_dom_groups))) {
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
>@@ -703,7 +701,7 @@
> 
> 	*num_mem = r.num_sids;
> 
>-	if (!(*sids = talloc(mem_ctx, sizeof(DOM_SID) * *num_mem))) {
>+	if (!(*sids = TALLOC_ARRAY(mem_ctx,DOM_SID, *num_mem))) {
> 		result = NT_STATUS_UNSUCCESSFUL;
> 		goto done;
> 	}
>@@ -972,8 +970,8 @@
> 	}
> 
> 	*num_names = r.num_names1;
>-	*names = talloc(mem_ctx, sizeof(char *) * r.num_names1);
>-	*name_types = talloc(mem_ctx, sizeof(uint32) * r.num_names1);
>+	*names = TALLOC_ARRAY(mem_ctx, char *, r.num_names1);
>+	*name_types = TALLOC_ARRAY(mem_ctx, uint32, r.num_names1);
> 
> 	for (i = 0; i < r.num_names1; i++) {
> 		fstring tmp;
>@@ -1040,8 +1038,8 @@
> 	}
> 
> 	*num_rids = r.num_rids1;
>-	*rids = talloc(mem_ctx, sizeof(uint32) * r.num_rids1);
>-	*rid_types = talloc(mem_ctx, sizeof(uint32) * r.num_rids1);
>+	*rids = TALLOC_ARRAY(mem_ctx, uint32, r.num_rids1);
>+	*rid_types = TALLOC_ARRAY(mem_ctx, uint32, r.num_rids1);
> 
> 	for (i = 0; i < r.num_rids1; i++) {
> 		(*rids)[i] = r.rids[i];
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/cli_spoolss.c samba-2.2.12-backport/source/libsmb/cli_spoolss.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/cli_spoolss.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/cli_spoolss.c	2004-12-15 14:43:16.000000000 -0500
>@@ -70,7 +70,7 @@
>         uint32 i;
>         PRINTER_INFO_0  *inf;
> 
>-        inf=(PRINTER_INFO_0 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_0));
>+        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_0, returned);
> 
>         buffer->prs.data_offset=0;
> 
>@@ -89,7 +89,7 @@
>         uint32 i;
>         PRINTER_INFO_1  *inf;
> 
>-        inf=(PRINTER_INFO_1 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_1));
>+        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_1, returned);
> 
>         buffer->prs.data_offset=0;
> 
>@@ -108,7 +108,7 @@
>         uint32 i;
>         PRINTER_INFO_2  *inf;
> 
>-        inf=(PRINTER_INFO_2 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_2));
>+        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_2, returned);
> 
>         buffer->prs.data_offset=0;
> 
>@@ -129,7 +129,7 @@
>         uint32 i;
>         PRINTER_INFO_3  *inf;
> 
>-        inf=(PRINTER_INFO_3 *)talloc(mem_ctx, returned*sizeof(PRINTER_INFO_3));
>+        inf=TALLOC_ARRAY(mem_ctx, PRINTER_INFO_3, returned);
> 
>         buffer->prs.data_offset=0;
> 
>@@ -149,7 +149,7 @@
>         uint32 i;
>         PORT_INFO_1 *inf;
> 
>-        inf=(PORT_INFO_1*)talloc(mem_ctx, returned*sizeof(PORT_INFO_1));
>+        inf=TALLOC_ARRAY(mem_ctx, PORT_INFO_1, returned);
> 
>         prs_set_offset(&buffer->prs, 0);
> 
>@@ -168,7 +168,7 @@
>         uint32 i;
>         PORT_INFO_2 *inf;
> 
>-        inf=(PORT_INFO_2*)talloc(mem_ctx, returned*sizeof(PORT_INFO_2));
>+        inf=TALLOC_ARRAY(mem_ctx, PORT_INFO_2, returned);
> 
>         prs_set_offset(&buffer->prs, 0);
> 
>@@ -187,7 +187,7 @@
>         uint32 i;
>         DRIVER_INFO_1 *inf;
> 
>-        inf=(DRIVER_INFO_1 *)talloc(mem_ctx, returned*sizeof(DRIVER_INFO_1));
>+        inf=TALLOC_ARRAY(mem_ctx, DRIVER_INFO_1, returned);
> 
>         buffer->prs.data_offset=0;
> 
>@@ -206,7 +206,7 @@
>         uint32 i;
>         DRIVER_INFO_2 *inf;
> 
>-        inf=(DRIVER_INFO_2 *)talloc(mem_ctx, returned*sizeof(DRIVER_INFO_2));
>+        inf=TALLOC_ARRAY(mem_ctx, DRIVER_INFO_2, returned);
> 
>         buffer->prs.data_offset=0;
> 
>@@ -225,7 +225,7 @@
>         uint32 i;
>         DRIVER_INFO_3 *inf;
> 
>-        inf=(DRIVER_INFO_3 *)talloc(mem_ctx, returned*sizeof(DRIVER_INFO_3));
>+        inf=TALLOC_ARRAY(mem_ctx, DRIVER_INFO_3, returned);
> 
>         buffer->prs.data_offset=0;
> 
>@@ -244,7 +244,7 @@
> {
> 	DRIVER_DIRECTORY_1 *inf;
>  
>-        inf=(DRIVER_DIRECTORY_1 *)talloc(mem_ctx, sizeof(DRIVER_DIRECTORY_1));
>+        inf=TALLOC_P(mem_ctx, DRIVER_DIRECTORY_1);
> 
>         prs_set_offset(&buffer->prs, 0);
> 
>@@ -1415,7 +1415,7 @@
> {
> 	int i;
> 
>-	*forms = (FORM_1 *)talloc(mem_ctx, num_forms * sizeof(FORM_1));
>+	*forms = TALLOC_ARRAY(mem_ctx, FORM_1, num_forms);
> 	buffer->prs.data_offset = 0;
> 
> 	for (i = 0; i < num_forms; i++)
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clientgen.c samba-2.2.12-backport/source/libsmb/clientgen.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clientgen.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/clientgen.c	2004-12-15 17:19:48.000000000 -0500
>@@ -174,7 +174,7 @@
> 	}
> 
> 	if (!cli) {
>-		cli = (struct cli_state *)malloc(sizeof(*cli));
>+		cli = SMB_MALLOC_P(struct cli_state);
> 		if (!cli)
> 			return NULL;
> 		ZERO_STRUCTP(cli);
>@@ -196,8 +196,8 @@
> 	cli->timeout = 20000; /* Timeout is in milliseconds. */
> 	cli->bufsize = CLI_BUFFER_SIZE+4;
> 	cli->max_xmit = cli->bufsize;
>-	cli->outbuf = (char *)malloc(cli->bufsize);
>-	cli->inbuf = (char *)malloc(cli->bufsize);
>+	cli->outbuf = (char *)SMB_MALLOC(cli->bufsize);
>+	cli->inbuf = (char *)SMB_MALLOC(cli->bufsize);
> 	cli->oplock_handler = cli_oplock_ack;
> 	/* Set the CLI_FORCE_DOSERR environment variable to test
> 	   client routines using DOS errors instead of STATUS32
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clifile.c samba-2.2.12-backport/source/libsmb/clifile.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clifile.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/clifile.c	2004-12-15 17:20:08.000000000 -0500
>@@ -1045,7 +1045,7 @@
> 		pstring path2;
> 		clistr_pull(cli, path2, p, 
> 			    sizeof(path2), len, STR_ASCII);
>-		*tmp_path = strdup(path2);
>+		*tmp_path = SMB_STRDUP(path2);
> 	}
> 
> 	return SVAL(cli->inbuf,smb_vwv0);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clilist.c samba-2.2.12-backport/source/libsmb/clilist.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clilist.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/clilist.c	2004-12-17 15:00:43.000000000 -0500
>@@ -263,7 +263,11 @@
> 		}
>  
> 		/* and add them to the dirlist pool */
>-		tdl = Realloc(dirlist,dirlist_len + data_len);
>+		if(dirlist_len >= UINT_MAX - data_len) {
>+			DEBUG(0,("cli_list_new: integer overflow detected.\n"));
>+			break;
>+		}
>+		tdl = SMB_REALLOC(dirlist,dirlist_len + data_len);
> 
> 		if (!tdl) {
> 			DEBUG(0,("cli_list_new: Failed to expand dirlist\n"));
>@@ -391,7 +395,7 @@
> 
> 		first = False;
> 
>-		tdl = Realloc(dirlist,(num_received + received)*DIR_STRUCT_SIZE);
>+		tdl = SMB_REALLOC(dirlist,(num_received + received)*DIR_STRUCT_SIZE);
> 
> 		if (!tdl) {
> 			DEBUG(0,("cli_list_old: failed to expand dirlist"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clireadwrite.c samba-2.2.12-backport/source/libsmb/clireadwrite.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clireadwrite.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/clireadwrite.c	2004-12-15 17:23:16.000000000 -0500
>@@ -241,8 +241,8 @@
> 	BOOL bigoffset = False;
> 
> 	if (size > cli->bufsize) {
>-		cli->outbuf = realloc(cli->outbuf, size + 1024);
>-		cli->inbuf = realloc(cli->inbuf, size + 1024);
>+		cli->outbuf = SMB_REALLOC(cli->outbuf, size + 1024);
>+		cli->inbuf = SMB_REALLOC(cli->inbuf, size + 1024);
> 		if (cli->outbuf == NULL || cli->inbuf == NULL)
> 			return False;
> 		cli->bufsize = size + 1024;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clitrans.c samba-2.2.12-backport/source/libsmb/clitrans.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/clitrans.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/clitrans.c	2004-12-16 15:50:23.000000000 -0500
>@@ -181,7 +181,7 @@
> 
> 	/* allocate it */
> 	if (total_data!=0) {
>-		tdata = Realloc(*data,total_data);
>+		tdata = SMB_REALLOC(*data,total_data);
> 		if (!tdata) {
> 			DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
> 			return False;
>@@ -191,7 +191,7 @@
> 	}
> 
> 	if (total_param!=0) {
>-		tparam = Realloc(*param,total_param);
>+		tparam = SMB_REALLOC(*param,total_param);
> 		if (!tparam) {
> 			DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
> 			return False;
>@@ -446,7 +446,7 @@
> 
> 	/* allocate it */
> 	if (total_data) {
>-		tdata = Realloc(*data,total_data);
>+		tdata = SMB_REALLOC(*data,total_data);
> 		if (!tdata) {
> 			DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
> 			return False;
>@@ -456,7 +456,7 @@
> 	}
> 
> 	if (total_param) {
>-		tparam = Realloc(*param,total_param);
>+		tparam = SMB_REALLOC(*param,total_param);
> 		if (!tparam) {
> 			DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
> 			return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/libsmbclient.c samba-2.2.12-backport/source/libsmb/libsmbclient.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/libsmbclient.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/libsmbclient.c	2004-12-16 14:43:27.000000000 -0500
>@@ -378,7 +378,7 @@
>   
> 	DEBUG(4,(" tconx ok\n"));
>   
>-	srv = (struct smbc_server *)malloc(sizeof(*srv));
>+	srv = SMB_MALLOC_P(struct smbc_server);
> 	if (!srv) {
> 		errno = ENOMEM;
> 		goto failed;
>@@ -390,25 +390,25 @@
> 
> 	srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share));
> 
>-	srv->server_name = strdup(server);
>+	srv->server_name = SMB_STRDUP(server);
> 	if (!srv->server_name) {
> 		errno = ENOMEM;
> 		goto failed;
> 	}
> 
>-	srv->share_name = strdup(share);
>+	srv->share_name = SMB_STRDUP(share);
> 	if (!srv->share_name) {
> 		errno = ENOMEM;
> 		goto failed;
> 	}
> 
>-	srv->workgroup = strdup(workgroup);
>+	srv->workgroup = SMB_STRDUP(workgroup);
> 	if (!srv->workgroup) {
> 		errno = ENOMEM;
> 		goto failed;
> 	}
> 
>-	srv->username = strdup(username);
>+	srv->username = SMB_STRDUP(username);
> 	if (!srv->username) {
> 		errno = ENOMEM;
> 		goto failed;
>@@ -535,7 +535,7 @@
> 
> 	user = getenv("USER");
> 	/* walk around as "guest" if no username can be found */
>-	if (!user) user = strdup("guest");
>+	if (!user) user = SMB_STRDUP("guest");
> 	pstrcpy(smbc_user, user); /* Save for use elsewhere */
> 	
> 	/*
>@@ -585,7 +585,7 @@
> 
> #endif
> 
>-	smbc_file_table = malloc(SMBC_MAX_FD * sizeof(struct smbc_file *));
>+	smbc_file_table = SMB_MALLOC_ARRAY( struct smbc_file *, SMBC_MAX_FD );
> 	if (!smbc_file_table)
> 		return ENOMEM;
> 
>@@ -659,7 +659,7 @@
> 
> 		}
> 
>-		smbc_file_table[slot] = malloc(sizeof(struct smbc_file));
>+		smbc_file_table[slot] = SMB_MALLOC_P(struct smbc_file);
> 
> 		if (!smbc_file_table[slot]) {
> 
>@@ -682,7 +682,7 @@
> 
> 		smbc_file_table[slot]->cli_fd  = fd;
> 		smbc_file_table[slot]->smbc_fd = slot + smbc_start_fd;
>-		smbc_file_table[slot]->fname   = strdup(fname);
>+		smbc_file_table[slot]->fname   = SMB_STRDUP(fname);
> 		smbc_file_table[slot]->srv     = srv;
> 		smbc_file_table[slot]->offset  = 0;
> 		smbc_file_table[slot]->file    = True;
>@@ -1419,7 +1419,7 @@
> 	size = sizeof(struct smbc_dirent) + (name?strlen(name):0) +
> 		(comment?strlen(comment):0) + 1; 
>     
>-	dirent = malloc(size);
>+	dirent = SMB_MALLOC(size);
> 
> 	if (!dirent) {
> 
>@@ -1430,7 +1430,7 @@
> 
> 	if (dir->dir_list == NULL) {
> 
>-		dir->dir_list = malloc(sizeof(struct smbc_dir_list));
>+		dir->dir_list = SMB_MALLOC_P(struct smbc_dir_list);
> 		if (!dir->dir_list) {
> 
> 			SAFE_FREE(dirent);
>@@ -1444,7 +1444,7 @@
> 	}
> 	else {
> 
>-		dir->dir_end->next = malloc(sizeof(struct smbc_dir_list));
>+		dir->dir_end->next = SMB_MALLOC_P(struct smbc_dir_list);
> 		
> 		if (!dir->dir_end->next) {
> 			
>@@ -1581,7 +1581,7 @@
>       
> 	}
> 
>-	smbc_file_table[slot] = malloc(sizeof(struct smbc_file));
>+	smbc_file_table[slot] = SMB_MALLOC_P(struct smbc_file);
> 
> 	if (!smbc_file_table[slot]) {
> 
>@@ -1592,7 +1592,7 @@
> 
> 	smbc_file_table[slot]->cli_fd   = 0;
> 	smbc_file_table[slot]->smbc_fd  = slot + smbc_start_fd;
>-	smbc_file_table[slot]->fname    = strdup(fname);
>+	smbc_file_table[slot]->fname    = SMB_STRDUP(fname);
> 	smbc_file_table[slot]->srv      = NULL;
> 	smbc_file_table[slot]->offset   = 0;
> 	smbc_file_table[slot]->file     = False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/namecache.c samba-2.2.12-backport/source/libsmb/namecache.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/namecache.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/namecache.c	2004-12-15 22:57:40.000000000 -0500
>@@ -98,7 +98,7 @@
> 	if (num_names > 0)
> 		size += sizeof(struct in_addr) * (num_names-1);
> 
>-	value = (struct nc_value *)malloc(size);
>+	value = (struct nc_value *)SMB_MALLOC(size);
> 
> 	memset(value, 0, size);
> 
>@@ -224,8 +224,7 @@
> 
> 	if (data->count) {
> 
>-		*ip_list = (struct in_addr *)malloc(
>-			sizeof(struct in_addr) * data->count);
>+		*ip_list = SMB_MALLOC_ARRAY(struct in_addr, data->count);
> 		
> 		memcpy(*ip_list, data->ip_list, sizeof(struct in_addr) * data->count);
> 		
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/namequery.c samba-2.2.12-backport/source/libsmb/namequery.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/namequery.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/namequery.c	2004-12-17 15:00:43.000000000 -0500
>@@ -54,7 +54,7 @@
> 
> 	if (*num_names == 0) return NULL;
> 
>-	ret = (struct node_status *)malloc(sizeof(struct node_status)* (*num_names));
>+	ret = SMB_MALLOC_ARRAY(struct node_status, *num_names);
> 	if (!ret) return NULL;
> 
> 	p++;
>@@ -238,7 +238,7 @@
> 
>   /* Now, create the additional stuff for a registration request */
> 
>-  if ((nmb->additional = (struct res_rec *)malloc(sizeof(struct res_rec))) == NULL) {
>+  if ((nmb->additional = SMB_MALLOC_P(struct res_rec)) == NULL) {
> 
>     DEBUG(0, ("name_register: malloc fail for additional record.\n"));
>     return False;
>@@ -407,8 +407,17 @@
> 				continue;
> 			}
> 
>-			tmp_ip_list = (struct in_addr *)Realloc( ip_list, sizeof( ip_list[0] )
>-												* ( (*count) + nmb2->answers->rdlength/6 ) );
>+			if(
>+			   nmb2->answers->rdlength >= INT_MAX/6 ||
>+			   (*count) >= INT_MAX-(nmb2->answers->rdlength/6) ||
>+			   sizeof( ip_list[0] ) >= UINT_MAX/( (*count) + nmb2->answers->rdlength/6 )
>+			   )
>+			{
>+				DEBUG(0,("name_query: integer overflow detected.\n"));
>+				free_packet(p2);
>+				return NULL;
>+			}
>+			tmp_ip_list = SMB_REALLOC_ARRAY( ip_list, struct in_addr, (*count) + nmb2->answers->rdlength/6 );
> 
> 			if (!tmp_ip_list) {
> 				DEBUG(0,("name_query: Realloc failed.\n"));
>@@ -775,7 +784,7 @@
>                 ((name_type2 == -1) || (name_type == name_type2))
>                ) {
> 				endlmhosts(fp);
>-				*return_iplist = (struct in_addr *)malloc(sizeof(struct in_addr));
>+				*return_iplist = SMB_MALLOC_P(struct in_addr);
> 				if(*return_iplist == NULL) {
> 					DEBUG(3,("resolve_lmhosts: malloc fail !\n"));
> 					return False;
>@@ -812,7 +821,7 @@
> 		int i = 0, j;
> 		while (hp->h_addr_list[i]) i++;
> 		DEBUG(10, ("%d addresses returned\n", i));
>-		*return_iplist = (struct in_addr *)malloc(i*sizeof(struct in_addr));
>+		*return_iplist = SMB_MALLOC_ARRAY(struct in_addr, i);
> 		if(*return_iplist == NULL) {
> 			DEBUG(3,("resolve_hosts: malloc fail !\n"));
> 			return False;
>@@ -849,7 +858,7 @@
>   *return_count = 0;
> 
>   if (allzeros || allones || is_address) {
>-	*return_iplist = (struct in_addr *)malloc(sizeof(struct in_addr));
>+	*return_iplist = SMB_MALLOC_P(struct in_addr);
> 	if(*return_iplist == NULL) {
> 		DEBUG(3,("internal_resolve_name: malloc fail !\n"));
> 		return False;
>@@ -919,8 +928,7 @@
>      controllers including the PDC in iplist[1..n].  Iterating over
>      the iplist when the PDC is down will cause two sets of timeouts. */
> 
>-  if (*return_count && (nodupes_iplist =
>-			(struct in_addr *)malloc(sizeof(struct in_addr) * (*return_count)))) {
>+  if (*return_count && (nodupes_iplist = SMB_MALLOC_ARRAY(struct in_addr, *return_count))) {
>       int nodupes_count = 0;
>  
>       /* Iterate over return_iplist looking for duplicates */
>@@ -1327,7 +1335,7 @@
> 		if (num_addresses == 0)
> 			return internal_resolve_name(group, name_type, ip_list, count);
> 
>-		return_iplist = (struct in_addr *)malloc(num_addresses * sizeof(struct in_addr));
>+		return_iplist = SMB_MALLOC_ARRAY(struct in_addr, num_addresses);
> 		if(return_iplist == NULL) {
> 			DEBUG(3,("get_dc_list: malloc fail !\n"));
> 			return False;
>@@ -1339,7 +1347,7 @@
> 			int count_more;
> 			if (resolve_name_2( name, &more_ip, &count_more, 0x20) == False)
> 				continue;
>-			tmp = (struct in_addr *)realloc(return_iplist,(num_addresses + count_more) * sizeof(struct in_addr));
>+			tmp = SMB_REALLOC_ARRAY(return_iplist, struct in_addr, num_addresses + count_more);
> 			if (return_iplist == NULL) {
> 				DEBUG(3, ("realloc failed with %d addresses\n", num_addresses + count_more));
> 				SAFE_FREE(return_iplist);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/libsmb/nmblib.c samba-2.2.12-backport/source/libsmb/nmblib.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/libsmb/nmblib.c	2004-08-12 14:24:25.000000000 -0400
>+++ samba-2.2.12-backport/source/libsmb/nmblib.c	2004-12-16 00:22:15.000000000 -0500
>@@ -335,7 +335,7 @@
> 				struct res_rec **recs, int count)
> {
>   int i;
>-  *recs = (struct res_rec *)malloc(sizeof(**recs)*count);
>+  *recs = SMB_MALLOC_ARRAY(struct res_rec, count);
>   if (!*recs) return(False);
> 
>   memset((char *)*recs,'\0',sizeof(**recs)*count);
>@@ -525,7 +525,7 @@
>   struct nmb_packet *copy_nmb;
>   struct packet_struct *pkt_copy;
> 
>-  if(( pkt_copy = (struct packet_struct *)malloc(sizeof(*packet))) == NULL)
>+  if(( pkt_copy = SMB_MALLOC_P(struct packet_struct)) == NULL)
>   {
>     DEBUG(0,("copy_nmb_packet: malloc fail.\n"));
>     return NULL;
>@@ -550,24 +550,21 @@
> 
>   if (nmb->answers)
>   {
>-    if((copy_nmb->answers = (struct res_rec *)
>-                  malloc(nmb->header.ancount * sizeof(struct res_rec))) == NULL)
>+    if((copy_nmb->answers = SMB_MALLOC_ARRAY(struct res_rec, nmb->header.ancount)) == NULL)
>       goto free_and_exit;
>     memcpy((char *)copy_nmb->answers, (char *)nmb->answers, 
>            nmb->header.ancount * sizeof(struct res_rec));
>   }
>   if (nmb->nsrecs)
>   {
>-    if((copy_nmb->nsrecs = (struct res_rec *)
>-                  malloc(nmb->header.nscount * sizeof(struct res_rec))) == NULL)
>+    if((copy_nmb->nsrecs = SMB_MALLOC_ARRAY(struct res_rec, nmb->header.nscount)) == NULL)
>       goto free_and_exit;
>     memcpy((char *)copy_nmb->nsrecs, (char *)nmb->nsrecs, 
>            nmb->header.nscount * sizeof(struct res_rec));
>   }
>   if (nmb->additional)
>   {
>-    if((copy_nmb->additional = (struct res_rec *)
>-                  malloc(nmb->header.arcount * sizeof(struct res_rec))) == NULL)
>+    if((copy_nmb->additional = SMB_MALLOC_ARRAY(struct res_rec, nmb->header.arcount)) == NULL)
>       goto free_and_exit;
>     memcpy((char *)copy_nmb->additional, (char *)nmb->additional, 
>            nmb->header.arcount * sizeof(struct res_rec));
>@@ -593,7 +590,7 @@
> { 
>   struct packet_struct *pkt_copy;
> 
>-  if(( pkt_copy = (struct packet_struct *)malloc(sizeof(*packet))) == NULL)
>+  if(( pkt_copy = SMB_MALLOC_P(struct packet_struct)) == NULL)
>   {
>     DEBUG(0,("copy_dgram_packet: malloc fail.\n"));
>     return NULL;
>@@ -667,7 +664,7 @@
> 	struct packet_struct *p;
> 	BOOL ok=False;
> 
>-	p = (struct packet_struct *)malloc(sizeof(*p));
>+	p = SMB_MALLOC_P(struct packet_struct);
> 	if (!p) return(NULL);
> 
> 	p->next = NULL;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/locking/brlock.c samba-2.2.12-backport/source/locking/brlock.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/locking/brlock.c	2004-08-12 14:24:31.000000000 -0400
>+++ samba-2.2.12-backport/source/locking/brlock.c	2004-12-16 15:50:23.000000000 -0500
>@@ -355,7 +355,7 @@
> 	}
> 
> 	/* no conflicts - add it to the list of locks */
>-	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(*locks));
>+	tp = SMB_REALLOC(dbuf.dptr, dbuf.dsize + sizeof(*locks));
> 	if (!tp) {
> 		status = NT_STATUS_NO_MEMORY;
> 		goto fail;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/locking/locking.c samba-2.2.12-backport/source/locking/locking.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/locking/locking.c	2004-08-12 14:24:31.000000000 -0400
>+++ samba-2.2.12-backport/source/locking/locking.c	2004-12-15 23:15:42.000000000 -0500
>@@ -683,7 +683,7 @@
> 		pstrcat(fname, fsp->fsp_name);
> 
> 		size = sizeof(*data) + sizeof(share_mode_entry) + strlen(fname) + 1;
>-		p = (char *)malloc(size);
>+		p = (char *)SMB_MALLOC(size);
> 		if (!p)
> 			return False;
> 		data = (struct locking_data *)p;
>@@ -715,7 +715,7 @@
> 		fsp->fsp_name, data->u.num_share_mode_entries ));
> 
> 	size = dbuf.dsize + sizeof(share_mode_entry);
>-	p = malloc(size);
>+	p = SMB_MALLOC(size);
> 	if (!p)
> 		return False;
> 	memcpy(p, dbuf.dptr, sizeof(*data));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/locking/posix.c samba-2.2.12-backport/source/locking/posix.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/locking/posix.c	2004-08-12 14:24:31.000000000 -0400
>+++ samba-2.2.12-backport/source/locking/posix.c	2004-12-16 15:50:23.000000000 -0500
>@@ -103,7 +103,7 @@
> 
> 	dbuf = tdb_fetch(posix_pending_close_tdb, kbuf);
> 
>-	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(int));
>+	tp = SMB_REALLOC(dbuf.dptr, dbuf.dsize + sizeof(int));
> 	if (!tp) {
> 		DEBUG(0,("add_fd_to_close_entry: Realloc fail !\n"));
> 		SAFE_FREE(dbuf.dptr);
>@@ -370,7 +370,7 @@
> 	pl.size = size;
> 	pl.lock_type = lock_type;
> 
>-	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(pl));
>+	tp = SMB_REALLOC(dbuf.dptr, dbuf.dsize + sizeof(pl));
> 	if (!tp) {
> 		DEBUG(0,("add_posix_lock_entry: Realloc fail !\n"));
> 		goto fail;
>@@ -896,8 +896,7 @@
>         | l_curr|         | l_new   |
>         +-------+         +---------+
> **********************************************/
>-				struct lock_list *l_new = (struct lock_list *)talloc(ctx,
>-													sizeof(struct lock_list));
>+				struct lock_list *l_new = TALLOC_P(ctx,struct lock_list);
> 
> 				if(l_new == NULL) {
> 					DEBUG(0,("posix_lock_list: talloc fail.\n"));
>@@ -1002,7 +1001,7 @@
> 		return True; /* Not a fatal error. */
> 	}
> 
>-	if ((ll = (struct lock_list *)talloc(l_ctx, sizeof(struct lock_list))) == NULL) {
>+	if ((ll = TALLOC_P(l_ctx, struct lock_list)) == NULL) {
> 		DEBUG(0,("set_posix_lock: unable to talloc unlock list.\n"));
> 		talloc_destroy(l_ctx);
> 		return True; /* Not a fatal error. */
>@@ -1148,7 +1147,7 @@
> 		return True; /* Not a fatal error. */
> 	}
> 
>-	if ((ul = (struct lock_list *)talloc(ul_ctx, sizeof(struct lock_list))) == NULL) {
>+	if ((ul = TALLOC_P(ul_ctx, struct lock_list)) == NULL) {
> 		DEBUG(0,("release_posix_lock: unable to talloc unlock list.\n"));
> 		talloc_destroy(ul_ctx);
> 		return True; /* Not a fatal error. */
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/msdfs/msdfs.c samba-2.2.12-backport/source/msdfs/msdfs.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/msdfs/msdfs.c	2004-08-12 14:24:35.000000000 -0400
>+++ samba-2.2.12-backport/source/msdfs/msdfs.c	2004-12-16 15:50:23.000000000 -0500
>@@ -457,7 +457,7 @@
> 	/* add the unexplained 0x16 bytes */
> 	reply_size += 0x16;
> 
>-	pdata = Realloc(pdata,reply_size);
>+	pdata = SMB_REALLOC(pdata,reply_size);
> 	if(pdata == NULL) {
> 		DEBUG(0,("malloc failed for Realloc!\n"));
> 		return -1;
>@@ -536,7 +536,7 @@
> 		reply_size += (strlen(junction->referral_list[i].alternate_path)+1)*2;
> 	}
> 
>-	pdata = Realloc(pdata,reply_size);
>+	pdata = SMB_REALLOC(pdata,reply_size);
> 	if(pdata == NULL) {
> 		DEBUG(0,("version3 referral setup: malloc failed for Realloc!\n"));
> 		return -1;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd.c samba-2.2.12-backport/source/nmbd/nmbd.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd.c	2004-12-16 11:23:49.000000000 -0500
>@@ -585,7 +585,7 @@
>     namecount++;
> 
>   /* Allocate space for the netbios aliases */
>-  my_netbios_names = (char **)malloc( sizeof(char *) * (namecount+1) );
>+  my_netbios_names = SMB_MALLOC_ARRAY( char *, namecount+1 );
>   if( NULL == my_netbios_names )
>   {
>      DEBUG( 0, ( "init_structs: malloc fail.\n" ) );
>@@ -609,7 +609,7 @@
>         nodup=0;
>     }
>     if (nodup)
>-      my_netbios_names[namecount++] = strdup( nbname );
>+      my_netbios_names[namecount++] = SMB_STRDUP( nbname );
>   }
>   
>   /* Check the strdups succeeded. */
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_become_lmb.c samba-2.2.12-backport/source/nmbd/nmbd_become_lmb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_become_lmb.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_become_lmb.c	2004-12-15 23:48:20.000000000 -0500
>@@ -212,7 +212,7 @@
>     struct userdata_struct *userdata;
>     int size = sizeof(struct userdata_struct) + sizeof(BOOL);
> 
>-    if((userdata = (struct userdata_struct *)malloc(size)) == NULL)
>+    if((userdata = (struct userdata_struct *)SMB_MALLOC(size)) == NULL)
>     {
>       DEBUG(0,("release_1d_name: malloc fail.\n"));
>       return;
>@@ -557,7 +557,7 @@
>   subrec->work_changed = True;
> 
>   /* Setup the userdata_struct. */
>-  if((userdata = (struct userdata_struct *)malloc(size)) == NULL)
>+  if((userdata = (struct userdata_struct *)SMB_MALLOC(size)) == NULL)
>   {
>     DEBUG(0,("become_local_master_browser: malloc fail.\n"));
>     return;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_browserdb.c samba-2.2.12-backport/source/nmbd/nmbd_browserdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_browserdb.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_browserdb.c	2004-12-15 23:48:20.000000000 -0500
>@@ -89,7 +89,7 @@
>   struct browse_cache_record *browc;
>   time_t now = time( NULL );
> 
>-  browc = (struct browse_cache_record *)malloc( sizeof( *browc ) );
>+  browc = SMB_MALLOC_P( struct browse_cache_record );
> 
>   if( NULL == browc )
>     {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_browsesync.c samba-2.2.12-backport/source/nmbd/nmbd_browsesync.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_browsesync.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_browsesync.c	2004-12-15 23:48:20.000000000 -0500
>@@ -329,7 +329,7 @@
> 
>   /* Setup the userdata_struct - this is copied so we can use
>      a stack variable for this. */
>-  if((userdata = (struct userdata_struct *)malloc(size)) == NULL)
>+  if((userdata = (struct userdata_struct *)SMB_MALLOC(size)) == NULL)
>   {
>     DEBUG(0, ("find_domain_master_name_query_success: malloc fail.\n"));
>     return;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_incomingrequests.c samba-2.2.12-backport/source/nmbd/nmbd_incomingrequests.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_incomingrequests.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_incomingrequests.c	2004-12-15 23:48:20.000000000 -0500
>@@ -558,7 +558,7 @@
>         prdata = rdata;
>       else
>       {
>-        if((prdata = (char *)malloc( namerec->data.num_ips * 6 )) == NULL)
>+        if((prdata = (char *)SMB_MALLOC( namerec->data.num_ips * 6 )) == NULL)
>         {
>           DEBUG(0,("process_name_query_request: malloc fail !\n"));
>           goto done;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_namelistdb.c samba-2.2.12-backport/source/nmbd/nmbd_namelistdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_namelistdb.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_namelistdb.c	2004-12-16 11:23:49.000000000 -0500
>@@ -187,7 +187,7 @@
>   struct name_record *namerec;
>   time_t time_now = time(NULL);
> 
>-  namerec = (struct name_record *)malloc( sizeof(*namerec) );
>+  namerec = SMB_MALLOC_P( struct name_record );
>   if( NULL == namerec )
>   {
>     DEBUG( 0, ( "add_name_to_subnet: malloc fail.\n" ) );
>@@ -195,8 +195,7 @@
>   }
> 
>   memset( (char *)namerec, '\0', sizeof(*namerec) );
>-  namerec->data.ip = (struct in_addr *)malloc( sizeof(struct in_addr) 
>-                                               * num_ips );
>+  namerec->data.ip = SMB_MALLOC_ARRAY( struct in_addr, num_ips );
>   if( NULL == namerec->data.ip )
>   {
>      DEBUG( 0, ( "add_name_to_subnet: malloc fail when creating ip_flgs.\n" ) );
>@@ -336,8 +335,7 @@
>   if( find_ip_in_name_record( namerec, new_ip ) )
>     return;
>   
>-  new_list = (struct in_addr *)malloc( (namerec->data.num_ips + 1)
>-                                       * sizeof(struct in_addr) );
>+  new_list = SMB_MALLOC_ARRAY( struct in_addr, namerec->data.num_ips + 1 );
>   if( NULL == new_list )
>   {
>     DEBUG(0,("add_ip_to_name_record: Malloc fail !\n"));
>@@ -492,7 +490,7 @@
>     /* Create an IP list containing all our known subnets. */
> 
>     num_ips = iface_count();
>-    iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) );
>+    iplist = SMB_MALLOC_ARRAY( struct in_addr, num_ips );
>     if( NULL == iplist )
>     {
>       DEBUG(0,("add_samba_names_to_subnet: Malloc fail !\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_nameregister.c samba-2.2.12-backport/source/nmbd/nmbd_nameregister.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_nameregister.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_nameregister.c	2004-12-16 11:27:21.000000000 -0500
>@@ -276,7 +276,7 @@
>   for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec) )
>     num_ips++;
> 
>-  if((ip_list = (struct in_addr *)malloc(num_ips * sizeof(struct in_addr)))==NULL)
>+  if((ip_list = SMB_MALLOC_ARRAY( struct in_addr, num_ips ))==NULL)
>   {
>     DEBUG(0,("multihomed_register_name: malloc fail !\n"));
>     return True;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_packets.c samba-2.2.12-backport/source/nmbd/nmbd_packets.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_packets.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_packets.c	2004-12-17 15:00:43.000000000 -0500
>@@ -193,7 +193,7 @@
>   struct nmb_packet *nmb = NULL;
> 
>   /* Allocate the packet_struct we will return. */
>-  if((packet = (struct packet_struct *)malloc(sizeof(*packet))) == NULL)
>+  if((packet = SMB_MALLOC_P(struct packet_struct)) == NULL)
>   {
>     DEBUG(0,("create_and_init_netbios_packet: malloc fail (1) for packet struct.\n"));
>     return NULL;
>@@ -240,7 +240,7 @@
> {
>   struct nmb_packet *nmb = &packet->packet.nmb;
> 
>-  if((nmb->additional = (struct res_rec *)malloc(sizeof(struct res_rec))) == NULL)
>+  if((nmb->additional = SMB_MALLOC_P(struct res_rec)) == NULL)
>   {
>     DEBUG(0,("initiate_name_register_packet: malloc fail for additional record.\n"));
>     return False;
>@@ -1705,7 +1705,7 @@
>   struct subnet_record *subrec = NULL;
>   int count = 0;
>   int num = 0;
>-  fd_set *pset = (fd_set *)malloc(sizeof(fd_set));
>+  fd_set *pset = SMB_MALLOC_P(fd_set);
> 
>   if(pset == NULL)
>   {
>@@ -1717,6 +1717,11 @@
>   for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec))
>     count++;
> 
>+  if(count >= (UINT_MAX/2)-2)
>+  {
>+    DEBUG(0,("create_listen_fdset: integer overflow detected.\n"));
>+    return True;
>+  }
>   if((count*2) + 2 > FD_SETSIZE)
>   {
>     DEBUG(0,("create_listen_fdset: Too many file descriptors needed (%d). We can \
>@@ -1724,7 +1729,7 @@
>     return True;
>   }
> 
>-  if((sock_array = (int *)malloc(((count*2) + 2)*sizeof(int))) == NULL)
>+  if((sock_array = SMB_MALLOC_ARRAY( int, (count*2) + 2)) == NULL)
>   {
>     DEBUG(0,("create_listen_fdset: malloc fail for socket array.\n"));
>     return True;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_responserecordsdb.c samba-2.2.12-backport/source/nmbd/nmbd_responserecordsdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_responserecordsdb.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_responserecordsdb.c	2004-12-15 23:48:20.000000000 -0500
>@@ -108,7 +108,7 @@
>   struct response_record *rrec;
>   struct nmb_packet *nmb = &p->packet.nmb;
> 
>-  if (!(rrec = (struct response_record *)malloc(sizeof(*rrec)))) 
>+  if (!(rrec = SMB_MALLOC_P(struct response_record)))
>   {
>     DEBUG(0,("make_response_queue_record: malloc fail for response_record.\n"));
>     return NULL;
>@@ -142,7 +142,7 @@
>     {
>       /* Primitive userdata, do a memcpy. */
>       if((rrec->userdata = (struct userdata_struct *)
>-           malloc(sizeof(struct userdata_struct)+userdata->userdata_len)) == NULL)
>+           SMB_MALLOC(sizeof(struct userdata_struct)+userdata->userdata_len)) == NULL)
>       {
>         DEBUG(0,("make_response_queue_record: malloc fail for userdata.\n"));
> 	ZERO_STRUCTP(rrec);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_serverlistdb.c samba-2.2.12-backport/source/nmbd/nmbd_serverlistdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_serverlistdb.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_serverlistdb.c	2004-12-15 23:48:20.000000000 -0500
>@@ -148,7 +148,7 @@
>     return NULL;
>   }
>   
>-  if((servrec = (struct server_record *)malloc(sizeof(*servrec))) == NULL)
>+  if((servrec = SMB_MALLOC_P(struct server_record)) == NULL)
>   {
>     DEBUG(0,("create_server_entry_on_workgroup: malloc fail !\n"));
>     return NULL;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_subnetdb.c samba-2.2.12-backport/source/nmbd/nmbd_subnetdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_subnetdb.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_subnetdb.c	2004-12-15 23:48:20.000000000 -0500
>@@ -164,7 +164,7 @@
> 
>   }
> 
>-  subrec = (struct subnet_record *)malloc(sizeof(*subrec));
>+  subrec = SMB_MALLOC_P(struct subnet_record);
>   
>   if (!subrec) 
>   {
>@@ -179,7 +179,7 @@
>                         namelist_entry_compare,
>                         ubi_trOVERWRITE );
> 
>-  if((subrec->subnet_name = strdup(name)) == NULL)
>+  if((subrec->subnet_name = SMB_STRDUP(name)) == NULL)
>   {
>     DEBUG(0,("make_subnet: malloc fail for subnet name !\n"));
>     close(nmb_sock);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_synclists.c samba-2.2.12-backport/source/nmbd/nmbd_synclists.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_synclists.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_synclists.c	2004-12-15 23:53:00.000000000 -0500
>@@ -146,7 +146,7 @@
> 		return;
> 	}
> 
>-	s = (struct sync_record *)malloc(sizeof(*s));
>+	s = SMB_MALLOC_P(struct sync_record);
> 	if (!s) goto done;
> 
> 	ZERO_STRUCTP(s);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_winsproxy.c samba-2.2.12-backport/source/nmbd/nmbd_winsproxy.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_winsproxy.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_winsproxy.c	2004-12-16 11:27:21.000000000 -0500
>@@ -61,7 +61,7 @@
>     iplist = &ip;
>   else
>   {
>-    if((iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) )) == NULL)
>+    if((iplist = SMB_MALLOC_ARRAY( struct in_addr, num_ips )) == NULL)
>     {
>       DEBUG(0,("wins_proxy_name_query_request_success: malloc fail !\n"));
>       return;
>@@ -140,7 +140,7 @@
> {
>   struct packet_struct *p, *copy_of_p;
>   struct userdata_struct *new_userdata = 
>-        (struct userdata_struct *)malloc( userdata->userdata_len );
>+        (struct userdata_struct *)SMB_MALLOC( userdata->userdata_len );
> 
>   if(new_userdata == NULL)
>     return NULL;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_winsserver.c samba-2.2.12-backport/source/nmbd/nmbd_winsserver.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_winsserver.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_winsserver.c	2004-12-16 11:27:21.000000000 -0500
>@@ -272,7 +272,7 @@
>     }
> 
>     /* Allocate the space for the ip_list. */
>-    if((ip_list = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr))) == NULL)
>+    if((ip_list = SMB_MALLOC_ARRAY( struct in_addr, num_ips )) == NULL)
>     {
>       DEBUG(0,("initialise_wins: Malloc fail !\n"));
>       return False;
>@@ -1237,7 +1237,7 @@
>     return;
>   }
> 
>-  if((prdata = (char *)malloc( num_ips * 6 )) == NULL)
>+  if((prdata = (char *)SMB_MALLOC( num_ips * 6 )) == NULL)
>   {
>     DEBUG(0,("process_wins_dmb_query_request: Malloc fail !.\n"));
>     return;
>@@ -1309,7 +1309,7 @@
>       prdata = rdata;
>     else
>     {
>-      if((prdata = (char *)malloc( namerec->data.num_ips * 6 )) == NULL)
>+      if((prdata = (char *)SMB_MALLOC( namerec->data.num_ips * 6 )) == NULL)
>       {
>         DEBUG(0,("send_wins_name_query_response: malloc fail !\n"));
>         return;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_workgroupdb.c samba-2.2.12-backport/source/nmbd/nmbd_workgroupdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nmbd/nmbd_workgroupdb.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/nmbd/nmbd_workgroupdb.c	2004-12-15 23:53:00.000000000 -0500
>@@ -55,7 +55,7 @@
>   struct subnet_record *subrec;
>   int t = -1;
>   
>-  if((work = (struct work_record *)malloc(sizeof(*work))) == NULL)
>+  if((work = SMB_MALLOC_P(struct work_record)) == NULL)
>   {
>     DEBUG(0,("create_workgroup: malloc fail !\n"));
>     return NULL;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/wb_client.c samba-2.2.12-backport/source/nsswitch/wb_client.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/wb_client.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/wb_client.c	2004-12-16 15:50:23.000000000 -0500
>@@ -312,7 +312,7 @@
> 		/* Add group to list if necessary */
> 
> 		if (!is_member) {
>-			tgr = (gid_t *)Realloc(groups, sizeof(gid_t) * ngroups + 1);
>+			tgr = SMB_REALLOC_ARRAY( groups, gid_t, ngroups + 1 );
> 			
> 			if (!tgr) {
> 				errno = ENOMEM;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd.c samba-2.2.12-backport/source/nsswitch/winbindd.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd.c	2004-12-16 11:52:16.000000000 -0500
>@@ -337,8 +337,7 @@
> 	
> 	/* Create new connection structure */
> 	
>-	if ((state = (struct winbindd_cli_state *) 
>-             malloc(sizeof(*state))) == NULL)
>+	if ((state = SMB_MALLOC_P(struct winbindd_cli_state)) == NULL)
> 		return;
> 	
> 	ZERO_STRUCTP(state);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_cache.c samba-2.2.12-backport/source/nsswitch/winbindd_cache.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_cache.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd_cache.c	2004-12-16 17:50:09.000000000 -0500
>@@ -95,7 +95,7 @@
> 
> 	if (ret) return ret;
> 	
>-	ret = smb_xmalloc(sizeof(*ret));
>+	ret = SMB_XMALLOC_P(struct winbind_cache);
> 	ZERO_STRUCTP(ret);
> 	switch (lp_security()) {
> #ifdef HAVE_ADS
>@@ -179,7 +179,7 @@
> 		smb_panic("centry_string");
> 	}
> 
>-	ret = talloc(mem_ctx, len+1);
>+	ret = TALLOC_ARRAY(mem_ctx, char, len+1);
> 	if (!ret) {
> 		smb_panic("centry_string out of memory\n");
> 	}
>@@ -292,7 +292,7 @@
> 		return NULL;
> 	}
> 
>-	centry = smb_xmalloc(sizeof(*centry));
>+	centry = SMB_XMALLOC_P(struct cache_entry);
> 	centry->data = (uchar *)data.dptr;
> 	centry->len = data.dsize;
> 	centry->ofs = 0;
>@@ -322,7 +322,7 @@
> 	uint8 *p;
> 	if (centry->len - centry->ofs >= len) return;
> 	centry->len *= 2;
>-	p = realloc(centry->data, centry->len);
>+	p = SMB_REALLOC(centry->data, centry->len);
> 	if (!p) {
> 		DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
> 		smb_panic("out of memory in centry_expand");
>@@ -381,10 +381,10 @@
> 
> 	if (!wcache->tdb) return NULL;
> 
>-	centry = smb_xmalloc(sizeof(*centry));
>+	centry = SMB_XMALLOC_P(struct cache_entry);
> 
> 	centry->len = 8192; /* reasonable default */
>-	centry->data = smb_xmalloc(centry->len);
>+	centry->data = SMB_XMALLOC_ARRAY(char, centry->len);
> 	centry->ofs = 0;
> 	centry->sequence_number = domain->sequence_number;
> 	centry_put_uint32(centry, NT_STATUS_V(status));
>@@ -494,7 +494,7 @@
> 	
> 	if (*num_entries == 0) goto do_cached;
> 
>-	(*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries));
>+	(*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
> 	if (! (*info)) smb_panic("query_user_list out of memory");
> 	for (i=0; i<(*num_entries); i++) {
> 		(*info)[i].acct_name = centry_string(centry, mem_ctx);
>@@ -580,7 +580,7 @@
> 	
> 	if (*num_entries == 0) goto do_cached;
> 
>-	(*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries));
>+	(*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
> 	if (! (*info)) smb_panic("enum_dom_groups out of memory");
> 	for (i=0; i<(*num_entries); i++) {
> 		fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
>@@ -783,7 +783,7 @@
> 	
> 	if (*num_groups == 0) goto do_cached;
> 
>-	(*user_gids) = talloc(mem_ctx, sizeof(**user_gids) * (*num_groups));
>+	(*user_gids) = TALLOC_ARRAY(mem_ctx, uint32, *num_groups);
> 	if (! (*user_gids)) smb_panic("lookup_usergroups out of memory");
> 	for (i=0; i<(*num_groups); i++) {
> 		(*user_gids)[i] = centry_uint32(centry);
>@@ -841,9 +841,9 @@
> 	
> 	if (*num_names == 0) goto do_cached;
> 
>-	(*rid_mem) = talloc(mem_ctx, sizeof(**rid_mem) * (*num_names));
>-	(*names) = talloc(mem_ctx, sizeof(**names) * (*num_names));
>-	(*name_types) = talloc(mem_ctx, sizeof(**name_types) * (*num_names));
>+	(*rid_mem) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
>+	(*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
>+	(*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
> 
> 	if (! (*rid_mem) || ! (*names) || ! (*name_types)) {
> 		smb_panic("lookup_groupmem out of memory");
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_cm.c samba-2.2.12-backport/source/nsswitch/winbindd_cm.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_cm.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd_cm.c	2004-12-16 11:52:16.000000000 -0500
>@@ -235,8 +235,7 @@
> 
> 	/* Create negative lookup cache entry for this domain and controller */
> 
>-	if (!(fcc = (struct failed_connection_cache *)
>-	      malloc(sizeof(struct failed_connection_cache)))) {
>+	if (!(fcc = SMB_MALLOC_P(struct failed_connection_cache))) {
> 		DEBUG(0, ("malloc failed in add_failed_connection_entry!\n"));
> 		return;
> 	}
>@@ -396,7 +395,7 @@
> 	}
> 	
> 	if (!conn) {
>-		if (!(conn = (struct winbindd_cm_conn *) malloc(sizeof(struct winbindd_cm_conn))))
>+		if (!(conn = SMB_MALLOC_P(struct winbindd_cm_conn)))
> 			return NT_STATUS_NO_MEMORY;
> 		
> 		ZERO_STRUCTP(conn);
>@@ -565,8 +564,7 @@
> 			basic_conn = conn;
> 	}
> 	
>-	if (!(conn = (struct winbindd_cm_conn *)
>-	      malloc(sizeof(struct winbindd_cm_conn))))
>+	if (!(conn = SMB_MALLOC_P(struct winbindd_cm_conn)))
> 		return NULL;
> 	
> 	ZERO_STRUCTP(conn);
>@@ -641,8 +639,7 @@
> 		return NULL;
> 	}
> 
>-	if (!(conn = (struct winbindd_cm_conn *)
>-	      malloc(sizeof(struct winbindd_cm_conn))))
>+	if (!(conn = SMB_MALLOC_P(struct winbindd_cm_conn)))
> 		return NULL;
> 	
> 	ZERO_STRUCTP(conn);
>@@ -718,8 +715,7 @@
> 		return NULL;
> 	}
> 
>-	if (!(conn = (struct winbindd_cm_conn *)
>-	      malloc(sizeof(struct winbindd_cm_conn))))
>+	if (!(conn = SMB_MALLOC_P(struct winbindd_cm_conn)))
> 		return NULL;
> 	
> 	ZERO_STRUCTP(conn);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_group.c samba-2.2.12-backport/source/nsswitch/winbindd_group.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_group.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd_group.c	2004-12-16 15:50:23.000000000 -0500
>@@ -151,7 +151,7 @@
> 	/* Allocate buffer */
> 
> 	if (!buf && buf_len != 0) {
>-		if (!(buf = malloc(buf_len))) {
>+		if (!(buf = SMB_MALLOC(buf_len))) {
> 			DEBUG(1, ("out of memory\n"));
> 			result = False;
> 			goto done;
>@@ -358,8 +358,7 @@
> 		
> 		/* Create a state record for this domain */
> 		
>-		if ((domain_state = (struct getent_state *)
>-		     malloc(sizeof(struct getent_state))) == NULL)
>+		if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL)
> 			return WINBINDD_ERROR;
> 		
> 		ZERO_STRUCTP(domain_state);
>@@ -431,7 +430,7 @@
> 	/* Copy entries into return buffer */
> 
> 	if (num_entries) {
>-		name_list = malloc(sizeof(struct acct_info) * num_entries);
>+		name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries);
> 		memcpy(name_list, sam_grp_entries, 
> 		       num_entries * sizeof(struct acct_info));
> 	}
>@@ -477,7 +476,7 @@
> 	num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);
> 
> 	if ((state->response.extra_data = 
>-	     malloc(num_groups * sizeof(struct winbindd_gr))) == NULL)
>+	     SMB_MALLOC_ARRAY( struct winbindd_gr, num_groups )) == NULL)
> 		return WINBINDD_ERROR;
> 
> 	state->response.data.num_entries = 0;
>@@ -593,7 +592,7 @@
> 
> 		if (result) {
> 			/* Append to group membership list */
>-			new_gr_mem_list = Realloc(
>+			new_gr_mem_list = SMB_REALLOC(
> 				gr_mem_list,
> 				gr_mem_list_len + gr_mem_len);
> 
>@@ -646,7 +645,7 @@
> 	if (group_list_ndx == 0)
> 		goto done;
> 
>-	new_extra_data = Realloc(
>+	new_extra_data = SMB_REALLOC(
> 		state->response.extra_data,
> 		group_list_ndx * sizeof(struct winbindd_gr) + gr_mem_list_len);
> 
>@@ -731,7 +730,7 @@
> 		/* Allocate some memory for extra data.  Note that we limit
> 		   account names to sizeof(fstring) = 128 characters.  */		
> 
>-                ted = Realloc(extra_data, sizeof(fstring) * total_entries);
>+                ted = SMB_REALLOC_ARRAY( extra_data, fstring, total_entries );
>  
> 		if (!ted) {
> 			DEBUG(0,("failed to enlarge buffer!\n"));
>@@ -830,7 +829,7 @@
> 	/* Copy data back to client */
> 
> 	num_gids = 0;
>-	gid_list = malloc(sizeof(gid_t) * num_groups);
>+	gid_list = SMB_MALLOC_ARRAY( gid_t, num_groups );
> 
> 	if (state->response.extra_data)
> 		goto done;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_misc.c samba-2.2.12-backport/source/nsswitch/winbindd_misc.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_misc.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd_misc.c	2004-12-16 15:50:23.000000000 -0500
>@@ -108,8 +108,7 @@
> 		/* Add domain to list */
> 
> 		total_entries++;
>-		ted = Realloc(extra_data, sizeof(fstring) * 
>-                              total_entries);
>+		ted = SMB_REALLOC_ARRAY( extra_data, fstring, total_entries );
> 
> 		if (!ted) {
> 			DEBUG(0,("winbindd_list_trusted_domains: failed to enlarge buffer!\n"));
>@@ -143,7 +142,7 @@
> 
> 	DEBUG(3, ("[%5d]: show sequence\n", state->pid));
> 
>-	extra_data = strdup("");
>+	extra_data = SMB_STRDUP("");
> 
> 	/* this makes for a very simple data format, and is easily parsable as well
> 	   if that is ever needed */
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_rpc.c samba-2.2.12-backport/source/nsswitch/winbindd_rpc.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_rpc.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd_rpc.c	2004-12-15 14:43:12.000000000 -0500
>@@ -34,7 +34,7 @@
> 	int maxlen = (str->uni_str_len+1)*4;
> 	if (!str->buffer)
> 		return NULL;
>-	s = (char *)talloc(ctx, maxlen); /* convervative */
>+	s = TALLOC_ARRAY(ctx, char *,maxlen); /* convervative */
> 	if (!s)
> 		return NULL;
> 	unistr2_to_unix(s, str, maxlen);
>@@ -111,8 +111,7 @@
> 		(*num_entries) += count;
> 
> 		/* now map the result into the WINBIND_USERINFO structure */
>-		(*info) = talloc_realloc(mem_ctx, *info,
>-					 (*num_entries)*sizeof(WINBIND_USERINFO));
>+		(*info) = TALLOC_REALLOC_ARRAY(mem_ctx, *info, WINBIND_USERINFO,*num_entries);
> 		if (!(*info)) {
> 			result = NT_STATUS_NO_MEMORY;
> 			talloc_destroy(ctx2);
>@@ -193,8 +192,7 @@
> 			break;
> 		}
> 
>-		(*info) = talloc_realloc(mem_ctx, *info, 
>-					 sizeof(**info) * ((*num_entries) + count));
>+		(*info) = TALLOC_REALLOC_ARRAY(mem_ctx, *info, struct acct_info, (*num_entries) + count);
> 		if (! *info) {
> 			talloc_destroy(mem_ctx2);
> 			cli_samr_close(hnd->cli, mem_ctx, &dom_pol);
>@@ -421,7 +419,7 @@
> 	if (!NT_STATUS_IS_OK(result) || (*num_groups) == 0)
> 		goto done;
> 
>-	(*user_gids) = talloc(mem_ctx, sizeof(uint32) * (*num_groups));
>+	(*user_gids) = TALLOC_ARRAY(mem_ctx, uint32, *num_groups);
> 	for (i=0;i<(*num_groups);i++) {
> 		(*user_gids)[i] = user_groups[i].g_rid;
> 	}
>@@ -499,8 +497,8 @@
> 
> #define MAX_LOOKUP_RIDS 900
> 
>-        *names = talloc_zero(mem_ctx, *num_names * sizeof(char *));
>-        *name_types = talloc_zero(mem_ctx, *num_names * sizeof(uint32));
>+        *names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_names);
>+        *name_types = TALLOC_ZERO_ARRAY(mem_ctx, uint32, *num_names);
> 
>         for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
>                 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_user.c samba-2.2.12-backport/source/nsswitch/winbindd_user.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_user.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd_user.c	2004-12-16 15:50:23.000000000 -0500
>@@ -291,8 +291,7 @@
> 
> 		/* Create a state record for this domain */
>                 
>-		if ((domain_state = (struct getent_state *)
>-		     malloc(sizeof(struct getent_state))) == NULL)
>+		if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL)
> 			return WINBINDD_ERROR;
>                 
> 		ZERO_STRUCTP(domain_state);
>@@ -368,10 +367,7 @@
> 	if (num_entries) {
> 		struct getpwent_user *tnl;
> 		
>-		tnl = (struct getpwent_user *)Realloc(name_list, 
>-						      sizeof(struct getpwent_user) *
>-						      (ent->num_sam_entries + 
>-						       num_entries));
>+		tnl = SMB_REALLOC_ARRAY(name_list, struct getpwent_user, ent->num_sam_entries + num_entries );
> 		
> 		if (!tnl) {
> 			DEBUG(0,("get_sam_user_entries realloc failed.\n"));
>@@ -438,7 +434,7 @@
> 	num_users = MIN(MAX_GETPWENT_USERS, state->request.data.num_entries);
> 	
> 	if ((state->response.extra_data = 
>-	     malloc(num_users * sizeof(struct winbindd_pw))) == NULL)
>+	     SMB_MALLOC_ARRAY(struct winbindd_pw, num_users)) == NULL)
> 		return WINBINDD_ERROR;
> 
> 	memset(state->response.extra_data, 0, num_users * 
>@@ -602,7 +598,7 @@
> 
> 		total_entries += num_entries;
> 			
>-		ted = Realloc(extra_data, sizeof(fstring) * total_entries);
>+		ted = SMB_REALLOC_ARRAY( extra_data, fstring, total_entries );
> 			
> 		if (!ted) {
> 			DEBUG(0,("failed to enlarge buffer!\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_util.c samba-2.2.12-backport/source/nsswitch/winbindd_util.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/nsswitch/winbindd_util.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/nsswitch/winbindd_util.c	2004-12-16 11:52:16.000000000 -0500
>@@ -91,8 +91,7 @@
>         
> 	/* Create new domain entry */
> 
>-	if ((domain = (struct winbindd_domain *)
>-	     malloc(sizeof(*domain))) == NULL)
>+	if ((domain = SMB_MALLOC_P(struct winbindd_domain)) == NULL)
> 		return NULL;
> 
> 	/* Fill in fields */
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/pam_smbpass/support.c samba-2.2.12-backport/source/pam_smbpass/support.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/pam_smbpass/support.c	2004-08-12 14:24:24.000000000 -0400
>+++ samba-2.2.12-backport/source/pam_smbpass/support.c	2004-12-17 14:05:14.000000000 -0500
>@@ -236,7 +236,7 @@
>     register char *new = NULL;
> 
>     if (x != NULL) {
>-        register int i;
>+        register size_t i;
> 
>         for (i = 0; x[i]; ++i); /* length of string */
>         if ((new = malloc(++i)) == NULL) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/param/loadparm.c samba-2.2.12-backport/source/param/loadparm.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/param/loadparm.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/param/loadparm.c	2004-12-16 15:50:23.000000000 -0500
>@@ -1499,7 +1499,7 @@
> 	if (!lp_talloc)
> 		lp_talloc = talloc_init();
> 
>-	ret = (char *)talloc(lp_talloc, len + 100);	/* leave room for substitution */
>+	ret = TALLOC_ARRAY(lp_talloc, char, len + 100);	/* leave room for substitution */
> 
> 	if (!ret)
> 		return NULL;
>@@ -1918,17 +1918,14 @@
> 			memcpy(oldservices, ServicePtrs, sizeof(service *) * iNumServices);
> #endif
> 
>-		tsp = (service **) Realloc(ServicePtrs,
>-						sizeof(service *) *
>-						num_to_alloc);
>+		tsp = SMB_REALLOC_ARRAY( ServicePtrs, service *, num_to_alloc );
>  
> 		if (!tsp) {
> 			DEBUG(0,("add_a_service: failed to enlarge ServicePtrs!\n"));
> 			return (-1);
> 		} else {
> 			ServicePtrs = tsp;
>-			ServicePtrs[iNumServices] =
>-				(service *) malloc(sizeof(service));
>+			ServicePtrs[iNumServices] = SMB_MALLOC_P(service);
>         }
> 
> #ifdef __INSURE__
>@@ -2270,16 +2267,16 @@
> 	}
>  
> 	if (!f) {
>-		f = (struct file_lists *)malloc(sizeof(file_lists[0]));
>+		f = SMB_MALLOC_P(struct file_lists);
> 		if (!f)
> 			return;
> 		f->next = file_lists;
>-		f->name = strdup(fname);
>+		f->name = SMB_STRDUP(fname);
> 		if (!f->name) {
> 			SAFE_FREE(f);
> 			return;
> 		}
>-		f->subfname = strdup(subfname);
>+		f->subfname = SMB_STRDUP(subfname);
> 		if (!f->subfname) {
> 			SAFE_FREE(f);
> 			return;
>@@ -2317,7 +2314,7 @@
> 			DEBUGADD(6, ("file %s modified: %s\n", n2, ctime(&mod_time)));
> 			f->modtime = mod_time;
> 			SAFE_FREE(f->subfname);
>-			f->subfname = strdup(n2);
>+			f->subfname = SMB_STRDUP(n2);
> 			return (True);
> 		}
> 		f = f->next;
>@@ -2375,7 +2372,7 @@
> 		if (line[len - 1] == '\n')
> 			line[--len] = '\0';
> 
>-		if ((varval = malloc(len + 1)) == NULL)
>+		if ((varval = SMB_MALLOC(len + 1)) == NULL)
> 		{
> 			DEBUG(0, ("source_env: Not enough memory!\n"));
> 			return (False);
>@@ -2495,7 +2492,7 @@
> 	 */
> 	string_set(ptr, pszParmValue);
> 	strupper(*ptr);
>-	saved_character_set = strdup(*ptr);
>+	saved_character_set = SMB_STRDUP(*ptr);
> 	interpret_character_set(*ptr, lp_client_code_page());
> 	return (True);
> }
>@@ -2732,7 +2729,7 @@
> {
> 	int i;
> 	SAFE_FREE(pservice->copymap);
>-	pservice->copymap = (BOOL *)malloc(sizeof(BOOL) * NUMPARAMETERS);
>+	pservice->copymap = SMB_MALLOC_ARRAY(BOOL, NUMPARAMETERS);
> 	if (!pservice->copymap)
> 		DEBUG(0,
> 		      ("Couldn't allocate copymap!! (size %d)\n",
>@@ -3302,7 +3299,7 @@
> 	if (!str)
> 		return;
> 
>-	s = strdup(str);
>+	s = SMB_STRDUP(str);
> 	if (!s)
> 		return;
> 
>@@ -3396,12 +3393,12 @@
> 			case P_STRING:
> 			case P_USTRING:
> 				parm_table[i].def.svalue =
>-					strdup(*(char **)parm_table[i].ptr);
>+					SMB_STRDUP(*(char **)parm_table[i].ptr);
> 				break;
> 			case P_GSTRING:
> 			case P_UGSTRING:
> 				parm_table[i].def.svalue =
>-					strdup((char *)parm_table[i].ptr);
>+					SMB_STRDUP((char *)parm_table[i].ptr);
> 				break;
> 			case P_BOOL:
> 			case P_BOOLREV:
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/param/params.c samba-2.2.12-backport/source/param/params.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/param/params.c	2004-08-12 14:24:23.000000000 -0400
>+++ samba-2.2.12-backport/source/param/params.c	2004-12-16 15:50:23.000000000 -0500
>@@ -252,7 +252,7 @@
>       {
>       char *tb;
> 
>-      tb = Realloc( bufr, bSize +BUFR_INC );
>+      tb = SMB_REALLOC( bufr, bSize +BUFR_INC );
>       if( NULL == tb )
>         {
>         DEBUG(0, ("%s Memory re-allocation failure.", func) );
>@@ -349,7 +349,7 @@
>       {
>       char *tb;
>  
>-      tb = Realloc( bufr, bSize + BUFR_INC );
>+      tb = SMB_REALLOC( bufr, bSize + BUFR_INC );
>       if( NULL == tb )
>         {
>         DEBUG(0, ("%s Memory re-allocation failure.", func) );
>@@ -416,7 +416,7 @@
>     if( i > (bSize - 2) )       /* Make sure there's enough room. */
>       {
>       bSize += BUFR_INC;
>-      bufr   = Realloc( bufr, bSize );
>+      bufr   = SMB_REALLOC( bufr, bSize );
>       if( NULL == bufr )
>         {
>         DEBUG(0, ("%s Memory re-allocation failure.", func) );
>@@ -532,7 +532,7 @@
>   int lvl = in_client?1:0;
>   myFILE *ret;
> 
>-  ret = (myFILE *)malloc(sizeof(*ret));
>+  ret = SMB_MALLOC_P(myFILE);
>   if (!ret) return NULL;
> 
>   ret->buf = file_load(FileName, &ret->size);
>@@ -583,7 +583,7 @@
>   else                                        /* If we don't have a buffer   */
>     {                                         /* allocate one, then parse,   */
>     bSize = BUFR_INC;                         /* then free.                  */
>-    bufr = (char *)malloc( bSize );
>+    bufr = (char *)SMB_MALLOC( bSize );
>     if( NULL == bufr )
>       {
>       DEBUG(0,("%s memory allocation failure.\n", func));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/passdb/pampass.c samba-2.2.12-backport/source/passdb/pampass.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/passdb/pampass.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/passdb/pampass.c	2004-12-16 14:51:06.000000000 -0500
>@@ -57,7 +57,7 @@
> /*
>  *  Macros to help make life easy
>  */
>-#define COPY_STRING(s) (s) ? strdup(s) : NULL
>+#define COPY_STRING(s) (s) ? SMB_STRDUP(s) : NULL
> 
> /*******************************************************************
>  PAM error handler.
>@@ -126,7 +126,7 @@
> 		return PAM_CONV_ERR;
> 	}
> 
>-	reply = malloc(sizeof(struct pam_response) * num_msg);
>+	reply = SMB_MALLOC_ARRAY( struct pam_response, num_msg );
> 	if (!reply)
> 		return PAM_CONV_ERR;
> 
>@@ -207,7 +207,7 @@
> 	struct chat_struct *tmp;
> 
> 	while (1) {
>-		t = (struct chat_struct *)malloc(sizeof(*t));
>+		t = SMB_MALLOC_P(struct chat_struct);
> 		if (!t) {
> 			DEBUG(0,("make_pw_chat: malloc failed!\n"));
> 			return NULL;
>@@ -286,7 +286,7 @@
> 		return PAM_CONV_ERR;
> 	}
> 
>-	reply = malloc(sizeof(struct pam_response) * num_msg);
>+	reply = SMB_MALLOC_ARRAY( struct pam_response, num_msg );
> 	if (!reply) {
> 		DEBUG(0,("smb_pam_passchange_conv: malloc for reply failed!\n"));
> 		free_pw_chat(pw_chat);
>@@ -402,8 +402,8 @@
> static struct pam_conv *smb_setup_pam_conv(smb_pam_conv_fn smb_pam_conv_fnptr, const char *user,
> 					const char *passwd, const char *newpass)
> {
>-	struct pam_conv *pconv = (struct pam_conv *)malloc(sizeof(struct pam_conv));
>-	struct smb_pam_userdata *udp = (struct smb_pam_userdata *)malloc(sizeof(struct smb_pam_userdata));
>+	struct pam_conv *pconv = SMB_MALLOC_P(struct pam_conv);
>+	struct smb_pam_userdata *udp = SMB_MALLOC_P(struct smb_pam_userdata);
> 
> 	if (pconv == NULL || udp == NULL) {
> 		SAFE_FREE(pconv);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/passdb/passdb.c samba-2.2.12-backport/source/passdb/passdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/passdb/passdb.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/passdb/passdb.c	2004-12-16 00:26:16.000000000 -0500
>@@ -110,7 +110,7 @@
> 		return False;
> 	}
> 	
>-	*user=(SAM_ACCOUNT *)malloc(sizeof(SAM_ACCOUNT));
>+	*user=SMB_MALLOC_P(SAM_ACCOUNT);
> 	
> 	if (*user==NULL) {
> 		DEBUG(0,("pdb_init_sam: error while allocating memory\n"));
>@@ -1620,7 +1620,7 @@
> 	if (sampass->nt_pw!=NULL)
> 		DEBUG(4,("pdb_set_nt_passwd: NT hash non NULL overwritting ?\n"));
> 	else
>-		sampass->nt_pw=(unsigned char *)malloc(sizeof(unsigned char)*16);
>+		sampass->nt_pw=SMB_MALLOC_ARRAY( unsigned char, 16 );
> 	
> 	if (sampass->nt_pw==NULL)
> 		return False;
>@@ -1651,7 +1651,7 @@
> 	if (sampass->lm_pw!=NULL)
> 		DEBUG(4,("pdb_set_lanman_passwd: LM hash non NULL overwritting ?\n"));
> 	else
>-		sampass->lm_pw=(unsigned char *)malloc(sizeof(unsigned char)*16);
>+		sampass->lm_pw=SMB_MALLOC_ARRAY( unsigned char, 16 );
> 	
> 	if (sampass->lm_pw==NULL)
> 		return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/passdb/pdb_ldap.c samba-2.2.12-backport/source/passdb/pdb_ldap.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/passdb/pdb_ldap.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/passdb/pdb_ldap.c	2004-12-16 15:50:23.000000000 -0500
>@@ -480,7 +480,7 @@
> 
> 	if (mods[i] == NULL)
> 	{
>-		mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *));
>+		mods = SMB_REALLOC_ARRAY ( mods, LDAPMod *, i + 2 );
> 		if (mods == NULL)
> 		{
> 			DEBUG(0, ("make_a_mod: out of memory!\n"));
>@@ -504,8 +504,7 @@
> 		if (mods[i]->mod_values != NULL) {
> 			for (; mods[i]->mod_values[j] != NULL; j++);
> 		}
>-		mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values,
>-					       (j + 2) * sizeof (char *));
>+		mods[i]->mod_values = SMB_REALLOC_ARRAY( mods[i]->mod_values, char *, j + 2 );
> 					       
> 		if (mods[i]->mod_values == NULL) {
> 			DEBUG (0, ("make_a_mod: Memory allocation failure!\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/passdb/pdb_smbpasswd.c samba-2.2.12-backport/source/passdb/pdb_smbpasswd.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/passdb/pdb_smbpasswd.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/passdb/pdb_smbpasswd.c	2004-12-15 23:15:42.000000000 -0500
>@@ -501,7 +501,7 @@
> 
>   new_entry_length = strlen(newpwd->smb_name) + 1 + 15 + 1 + 32 + 1 + 32 + 1 + NEW_PW_FORMAT_SPACE_PADDED_LEN + 1 + 13 + 2;
> 
>-  if((new_entry = (char *)malloc( new_entry_length )) == NULL) {
>+  if((new_entry = (char *)SMB_MALLOC( new_entry_length )) == NULL) {
>     DEBUG(0, ("format_new_smbpasswd_entry: Malloc failed adding entry for user %s.\n", newpwd->smb_name ));
>     return NULL;
>   }
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/printing/load.c samba-2.2.12-backport/source/printing/load.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/printing/load.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/printing/load.c	2004-12-15 23:26:44.000000000 -0500
>@@ -41,7 +41,7 @@
> {
> 	char *p;
> 	int printers;
>-	char *str = strdup(lp_auto_services());
>+	char *str = SMB_STRDUP(lp_auto_services());
> 
> 	if (!str) return;
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/printing/nt_printing.c samba-2.2.12-backport/source/printing/nt_printing.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/printing/nt_printing.c	2004-08-12 14:24:22.000000000 -0400
>+++ samba-2.2.12-backport/source/printing/nt_printing.c	2004-12-16 15:50:23.000000000 -0500
>@@ -448,7 +448,7 @@
> 		SAFE_FREE(dbuf.dptr);
> 		if (ret != dbuf.dsize) continue;
> 
>-		tl = Realloc(*list, sizeof(nt_forms_struct)*(n+1));
>+		tl = SMB_REALLOC_ARRAY( *list, nt_forms_struct, n+1 );
> 		if (!tl) {
> 			DEBUG(0,("get_ntforms: Realloc fail.\n"));
> 			return 0;
>@@ -519,7 +519,7 @@
> 	}
> 
> 	if (update==False) {
>-		if((tl=Realloc(*list, (n+1)*sizeof(nt_forms_struct))) == NULL) {
>+		if((tl=SMB_REALLOC_ARRAY( *list, nt_forms_struct, n+1 )) == NULL) {
> 			DEBUG(0,("add_a_form: failed to enlarge forms list!\n"));
> 			return False;
> 		}
>@@ -627,7 +627,7 @@
> 	     newkey = tdb_nextkey(tdb_drivers, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
> 		if (strncmp(kbuf.dptr, key, strlen(key)) != 0) continue;
> 		
>-		if((fl = Realloc(*list, sizeof(fstring)*(total+1))) == NULL) {
>+		if((fl = SMB_REALLOC_ARRAY( *list, fstring, total+1)) == NULL) {
> 			DEBUG(0,("get_ntdrivers: failed to enlarge list!\n"));
> 			return -1;
> 		}
>@@ -704,7 +704,7 @@
> 	char    *buf;
> 	ssize_t byte_count;
> 
>-	if ((buf=malloc(PE_HEADER_SIZE)) == NULL) {
>+	if ((buf=SMB_MALLOC(PE_HEADER_SIZE)) == NULL) {
> 		DEBUG(0,("get_file_version: PE file [%s] PE Header malloc failed bytes = %d\n",
> 				fname, PE_HEADER_SIZE));
> 		goto error_exit;
>@@ -757,7 +757,7 @@
> 		num_sections        = SVAL(buf,PE_HEADER_NUMBER_OF_SECTIONS);
> 		section_table_bytes = num_sections * PE_HEADER_SECT_HEADER_SIZE;
> 		SAFE_FREE(buf);
>-		if ((buf=malloc(section_table_bytes)) == NULL) {
>+		if ((buf=SMB_MALLOC(section_table_bytes)) == NULL) {
> 			DEBUG(0,("get_file_version: PE file [%s] section table malloc failed bytes = %d\n",
> 					fname, section_table_bytes));
> 			goto error_exit;
>@@ -778,7 +778,7 @@
> 				int section_bytes = IVAL(buf,sec_offset+PE_HEADER_SECT_SIZE_DATA_OFFSET);
> 
> 				SAFE_FREE(buf);
>-				if ((buf=malloc(section_bytes)) == NULL) {
>+				if ((buf=SMB_MALLOC(section_bytes)) == NULL) {
> 					DEBUG(0,("get_file_version: PE file [%s] version malloc failed bytes = %d\n",
> 							fname, section_bytes));
> 					goto error_exit;
>@@ -835,7 +835,7 @@
> 
> 		/* Allocate a bit more space to speed up things */
> 		SAFE_FREE(buf);
>-		if ((buf=malloc(VS_NE_BUF_SIZE)) == NULL) {
>+		if ((buf=SMB_MALLOC(VS_NE_BUF_SIZE)) == NULL) {
> 			DEBUG(0,("get_file_version: NE file [%s] malloc failed bytes  = %d\n",
> 					fname, PE_HEADER_SIZE));
> 			goto error_exit;
>@@ -1679,7 +1679,7 @@
> 	if (len != buflen) {
> 		char *tb;
> 
>-		tb = (char *)Realloc(buf, len);
>+		tb = (char *)SMB_REALLOC(buf, len);
> 		if (!tb) {
> 			DEBUG(0,("add_a_printer_driver_3: failed to enlarge buffer\n!"));
> 			ret = -1;
>@@ -1744,7 +1744,7 @@
> 	fstrcpy(info.configfile, "");
> 	fstrcpy(info.helpfile, "");
> 
>-	if ((info.dependentfiles=(fstring *)malloc(2*sizeof(fstring))) == NULL)
>+	if ((info.dependentfiles=SMB_MALLOC_ARRAY( fstring, 2 )) == NULL)
> 		return WERR_NOMEM;
> 
> 	memset(info.dependentfiles, '\0', 2*sizeof(fstring));
>@@ -1796,8 +1796,7 @@
> 	while (len < dbuf.dsize) {
> 		fstring *tddfs;
> 
>-		tddfs = (fstring *)Realloc(driver.dependentfiles,
>-							 sizeof(fstring)*(i+2));
>+		tddfs = (fstring *)SMB_REALLOC_ARRAY( driver.dependentfiles, fstring, i+2);
> 		if (tddfs == NULL) {
> 			DEBUG(0,("get_a_printer_driver_3: failed to enlarge buffer!\n"));
> 			break;
>@@ -2111,7 +2110,7 @@
> 	if (buflen != len) {
> 		char *tb;
> 
>-		tb = (char *)Realloc(buf, len);
>+		tb = (char *)SMB_REALLOC(buf, len);
> 		if (!tb) {
> 			DEBUG(0,("update_a_printer_2: failed to enlarge buffer!\n"));
> 			ret = WERR_NOMEM;
>@@ -2237,7 +2236,7 @@
> {
> 
> 	char adevice[MAXDEVICENAME+1];
>-	NT_DEVICEMODE *nt_devmode = (NT_DEVICEMODE *)malloc(sizeof(NT_DEVICEMODE));
>+	NT_DEVICEMODE *nt_devmode = SMB_MALLOC_P(NT_DEVICEMODE);
> 
> 	if (nt_devmode == NULL) {
> 		DEBUG(0,("construct_nt_devicemode: malloc fail.\n"));
>@@ -3070,7 +3069,7 @@
> 	if (buflen != len) {
> 		char *tb;
> 
>-		tb = (char *)Realloc(buf, len);
>+		tb = (char *)SMB_REALLOC(buf, len);
> 		if (!tb) {
> 			DEBUG(0, ("update_driver_init_2: failed to enlarge buffer!\n"));
> 			ret = -1;
>@@ -3196,7 +3195,7 @@
> 		if ((ctx = talloc_init()) == NULL)
> 			return WERR_NOMEM;
> 
>-		if ((nt_devmode = (NT_DEVICEMODE*)malloc(sizeof(NT_DEVICEMODE))) == NULL) {
>+		if ((nt_devmode = SMB_MALLOC_P(NT_DEVICEMODE)) == NULL) {
> 			status = WERR_NOMEM;
> 			goto done;
> 		}
>@@ -3293,7 +3292,7 @@
> 	{
> 		case 2:
> 		{
>-			if ((printer = (NT_PRINTER_INFO_LEVEL *)malloc(sizeof(NT_PRINTER_INFO_LEVEL))) == NULL) {
>+			if ((printer = SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL)) == NULL) {
> 				DEBUG(0,("get_a_printer: malloc fail.\n"));
> 				return WERR_NOMEM;
> 			}
>@@ -3598,7 +3597,7 @@
> 	/* exited because it exist */
> 	*type=param->type;		
> 	StrnCpy(value, param->value, sizeof(fstring)-1);
>-	*data=(uint8 *)malloc(param->data_len*sizeof(uint8));
>+	*data= SMB_MALLOC_ARRAY( uint8, param->data_len );
> 	if(*data == NULL)
> 		return False;
> 	ZERO_STRUCTP(*data);
>@@ -3638,7 +3637,7 @@
> 		/* exited because it exist */
> 		*type=param->type;	
> 		
>-		*data=(uint8 *)malloc(param->data_len*sizeof(uint8));
>+		*data= SMB_MALLOC_ARRAY( uint8, param->data_len );
> 		if(*data == NULL)
> 			return False;
> 		memcpy(*data, param->data, param->data_len);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/printing/print_cups.c samba-2.2.12-backport/source/printing/print_cups.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/printing/print_cups.c	2004-08-12 14:24:22.000000000 -0400
>+++ samba-2.2.12-backport/source/printing/print_cups.c	2004-12-22 16:19:37.000000000 -0500
>@@ -920,7 +920,7 @@
> 		{
> 			qalloc += 16;
> 
>-			temp = Realloc(queue, sizeof(print_queue_struct) * qalloc);
>+			temp = SMB_REALLOC_ARRAY( queue, print_queue_struct, qalloc );
> 
> 			if (temp == NULL)
> 			{
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/printing/print_generic.c samba-2.2.12-backport/source/printing/print_generic.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/printing/print_generic.c	2004-08-12 14:24:22.000000000 -0400
>+++ samba-2.2.12-backport/source/printing/print_generic.c	2004-12-16 11:23:49.000000000 -0500
>@@ -218,7 +218,7 @@
> 	qcount = 0;
> 	ZERO_STRUCTP(status);
> 	if (numlines)
>-		queue = (print_queue_struct *)malloc(sizeof(print_queue_struct)*(numlines+1));
>+		queue = SMB_MALLOC_ARRAY( print_queue_struct, numlines+1 );
> 
> 	if (queue) {
> 		for (i=0; i<numlines; i++) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/printing/print_svid.c samba-2.2.12-backport/source/printing/print_svid.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/printing/print_svid.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/printing/print_svid.c	2004-12-15 23:26:44.000000000 -0500
>@@ -89,9 +89,9 @@
> 			*tmp = '\0';
> 		
> 		/* add it to the cache */
>-		if ((ptmp = malloc(sizeof (*ptmp))) != NULL) {
>+		if ((ptmp = SMB_MALLOC_P(printer_t)) != NULL) {
> 			ZERO_STRUCTP(ptmp);
>-			if((ptmp->name = strdup(name)) == NULL)
>+			if((ptmp->name = SMB_STRDUP(name)) == NULL)
> 				DEBUG(0,("populate_printers: malloc fail in strdup !\n"));
> 			ptmp->next = printers;
> 			printers = ptmp;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/printing/printing.c samba-2.2.12-backport/source/printing/printing.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/printing/printing.c	2004-08-12 14:24:22.000000000 -0400
>+++ samba-2.2.12-backport/source/printing/printing.c	2004-12-16 00:32:46.000000000 -0500
>@@ -1313,8 +1313,7 @@
> 		return 0;
> 
> 	/* Allocate the queue size. */
>-	if ((tstruct.queue = (print_queue_struct *)
>-	     malloc(sizeof(print_queue_struct)*tsc.count)) == NULL)
>+	if ((tstruct.queue = SMB_MALLOC_ARRAY( print_queue_struct, tsc.count )) == NULL)
> 		return 0;
> 
> 	/*
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_client/cli_spoolss_notify.c samba-2.2.12-backport/source/rpc_client/cli_spoolss_notify.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_client/cli_spoolss_notify.c	2004-08-12 14:24:19.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_client/cli_spoolss_notify.c	2004-12-16 15:50:23.000000000 -0500
>@@ -328,7 +328,7 @@
> 		{
> 			DEBUG(10,("build_notify_data: %s set on [%s][%d]\n", msg_table[i].name,
> 				printer->info_2->printername, idx));
>-			if ((data=Realloc(*notify_data, (idx+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
>+			if ((data=SMB_REALLOC_ARRAY( *notify_data, SPOOL_NOTIFY_INFO_DATA, idx+1)) == NULL) {
> 				DEBUG(0,("build_notify_data: Realloc() failed with size [%d]!\n",
> 					(idx+1)*sizeof(SPOOL_NOTIFY_INFO_DATA)));
> 				return -1;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_dfs.c samba-2.2.12-backport/source/rpc_parse/parse_dfs.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_dfs.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_dfs.c	2004-12-22 15:02:13.000000000 -0500
>@@ -371,7 +371,7 @@
> 		depth++;
> 		/* should depend on whether marshalling or unmarshalling! */
> 		if(UNMARSHALLING(ps)) {
>-			ctr->dfs.info1 = (DFS_INFO_1 *)prs_alloc_mem(ps, sizeof(DFS_INFO_1)*num_entries);
>+			ctr->dfs.info1 = PRS_ALLOC_MEM( ps, DFS_INFO_1, num_entries );
> 			if (!ctr->dfs.info1)
> 				return False;
> 		}
>@@ -391,7 +391,7 @@
> 	case 2:
> 		depth++;
> 		if(UNMARSHALLING(ps)) {
>-			ctr->dfs.info2 = (DFS_INFO_2 *)prs_alloc_mem(ps, num_entries*sizeof(DFS_INFO_2));
>+			ctr->dfs.info2 = PRS_ALLOC_MEM( ps, DFS_INFO_2, num_entries );
> 			if (!ctr->dfs.info2)
> 				return False;
> 		}
>@@ -421,7 +421,7 @@
> 	case 3:
> 		depth++;
> 		if(UNMARSHALLING(ps)) {
>-			ctr->dfs.info3 = (DFS_INFO_3 *)prs_alloc_mem(ps, num_entries*sizeof(DFS_INFO_3));
>+			ctr->dfs.info3 = PRS_ALLOC_MEM(ps, DFS_INFO_3, num_entries );
> 			if (!ctr->dfs.info3)
> 				return False;
> 		}
>@@ -514,7 +514,7 @@
> 	depth++;
> 
> 	if(UNMARSHALLING(ps)) {
>-		info3->storages = (DFS_STORAGE_INFO *)prs_alloc_mem(ps, info3->num_storage_infos*sizeof(DFS_STORAGE_INFO));
>+		info3->storages = PRS_ALLOC_MEM( ps, DFS_STORAGE_INFO, info3->num_storage_infos );
> 		if (!info3->storages)
> 			return False;
> 	}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_lsa.c samba-2.2.12-backport/source/rpc_parse/parse_lsa.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_lsa.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_lsa.c	2004-12-22 15:02:13.000000000 -0500
>@@ -251,7 +251,7 @@
> 
> 	if (attr->ptr_sec_qos != 0) {
> 		if (UNMARSHALLING(ps))
>-			if (!(attr->sec_qos = (LSA_SEC_QOS *)prs_alloc_mem(ps,sizeof(LSA_SEC_QOS))))
>+			if (!(attr->sec_qos = PRS_ALLOC_MEM( ps, LSA_SEC_QOS, 1 )))
> 				return False;
> 
> 		if(!lsa_io_sec_qos("sec_qos", attr->sec_qos, ps, depth))
>@@ -538,13 +538,13 @@
>                 r_e->ptr_enum_domains = 1;
>                 r_e->num_domains2 = 1;
> 		
>-		if (!(r_e->hdr_domain_name = (UNIHDR2 *)talloc(ctx,sizeof(UNIHDR2))))
>+		if (!(r_e->hdr_domain_name = TALLOC_P(ctx,UNIHDR2)))
> 			return;
> 
>-		if (!(r_e->uni_domain_name = (UNISTR2 *)talloc(ctx,sizeof(UNISTR2))))
>+		if (!(r_e->uni_domain_name = TALLOC_P(ctx,UNISTR2)))
> 			return;
> 
>-		if (!(r_e->domain_sid = (DOM_SID2 *)talloc(ctx,sizeof(DOM_SID2))))
>+		if (!(r_e->domain_sid = TALLOC_P(ctx,DOM_SID2)))
> 			return;
> 
> 		init_uni_hdr2(&r_e->hdr_domain_name[0], len_domain_name);
>@@ -585,13 +585,13 @@
> 		num_domains = r_e->num_domains2;
> 
> 		if (UNMARSHALLING(ps)) {
>-			if (!(r_e->hdr_domain_name = (UNIHDR2 *)prs_alloc_mem(ps,sizeof(UNIHDR2) * num_domains)))
>+			if (!(r_e->hdr_domain_name = PRS_ALLOC_MEM( ps, UNIHDR2, num_domains )))
> 				return False;
> 
>-			if (!(r_e->uni_domain_name = (UNISTR2 *)prs_alloc_mem(ps,sizeof(UNISTR2) * num_domains)))
>+			if (!(r_e->uni_domain_name = PRS_ALLOC_MEM( ps, UNISTR2, num_domains )))
> 				return False;
> 
>-			if (!(r_e->domain_sid = (DOM_SID2 *)prs_alloc_mem(ps,sizeof(DOM_SID2) * num_domains)))
>+			if (!(r_e->domain_sid = PRS_ALLOC_MEM( ps, DOM_SID2, num_domains )))
> 				return False;
> 		}
> 
>@@ -686,7 +686,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		d_q->auditsettings = (uint32 *)talloc_zero(ps->mem_ctx, d_q->count2 * sizeof(uint32));
>+		d_q->auditsettings = (uint32 *)TALLOC_ZERO_ARRAY(ps->mem_ctx, uint32, d_q->count2);
> 	}
> 
> 	if (d_q->auditsettings == NULL) {
>@@ -807,14 +807,12 @@
> 
> 	if (num_entries == 0) return;
> 
>-	if ((sen->ptr_sid = (uint32 *)talloc_zero(mem_ctx, num_entries * 
>-					     sizeof(uint32))) == NULL) {
>+	if ((sen->ptr_sid = (uint32 *)TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_entries)) == NULL) {
> 		DEBUG(3, ("init_lsa_sid_enum(): out of memory for ptr_sid\n"));
> 		return;
> 	}
> 
>-	if ((sen->sid = (DOM_SID2 *)talloc_zero(mem_ctx, num_entries * 
>-					   sizeof(DOM_SID2))) == NULL) {
>+	if ((sen->sid = (DOM_SID2 *)TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID2, num_entries)) == NULL) {
> 		DEBUG(3, ("init_lsa_sid_enum(): out of memory for sids\n"));
> 		return;
> 	}
>@@ -861,15 +859,13 @@
> 	/* Mallocate memory if we're unpacking from the wire */
> 
> 	if (UNMARSHALLING(ps)) {
>-		if ((sen->ptr_sid = (uint32 *)prs_alloc_mem( ps,
>-			sen->num_entries * sizeof(uint32))) == NULL) {
>+		if ((sen->ptr_sid = PRS_ALLOC_MEM( ps, uint32, sen->num_entries )) == NULL) {
> 			DEBUG(3, ("init_lsa_sid_enum(): out of memory for "
> 				  "ptr_sid\n"));
> 			return False;
> 		}
> 
>-		if ((sen->sid = (DOM_SID2 *)prs_alloc_mem( ps,
>-			sen->num_entries * sizeof(DOM_SID2))) == NULL) {
>+		if ((sen->sid = PRS_ALLOC_MEM( ps, DOM_SID2, sen->num_entries )) == NULL) {
> 			DEBUG(3, ("init_lsa_sid_enum(): out of memory for "
> 				  "sids\n"));
> 			return False;
>@@ -969,15 +965,11 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps)) {
>-			if ((trn->name = (LSA_TRANS_NAME *)
>-			     prs_alloc_mem(ps, trn->num_entries * 
>-				    sizeof(LSA_TRANS_NAME))) == NULL) {
>+			if ((trn->name = PRS_ALLOC_MEM( ps, LSA_TRANS_NAME, trn->num_entries )) == NULL) {
> 				return False;
> 			}
> 
>-			if ((trn->uni_name = (UNISTR2 *)
>-			     prs_alloc_mem(ps, trn->num_entries *
>-				    sizeof(UNISTR2))) == NULL) {
>+			if ((trn->uni_name = PRS_ALLOC_MEM( ps, UNISTR2, trn->num_entries )) == NULL) {
> 				return False;
> 			}
> 		}
>@@ -1057,14 +1049,14 @@
> 	q_l->num_entries2 = num_names;
> 	q_l->lookup_level = 1;
> 
>-	if ((q_l->uni_name = (UNISTR2 *)talloc_zero(
>-		mem_ctx, num_names * sizeof(UNISTR2))) == NULL) {
>+	if ((q_l->uni_name = (UNISTR2 *)TALLOC_ZERO_ARRAY(
>+		mem_ctx, UNISTR2, num_names)) == NULL) {
> 		DEBUG(3, ("init_q_lookup_names(): out of memory\n"));
> 		return;
> 	}
> 
>-	if ((q_l->hdr_name = (UNIHDR *)talloc_zero(
>-		mem_ctx, num_names * sizeof(UNIHDR))) == NULL) {
>+	if ((q_l->hdr_name = (UNIHDR *)TALLOC_ZERO_ARRAY(
>+		mem_ctx, UNIHDR, num_names)) == NULL) {
> 		DEBUG(3, ("init_q_lookup_names(): out of memory\n"));
> 		return;
> 	}
>@@ -1105,11 +1097,9 @@
> 
> 	if (UNMARSHALLING(ps)) {
> 		if (q_r->num_entries) {
>-			if ((q_r->hdr_name = (UNIHDR *)prs_alloc_mem(ps,
>-					q_r->num_entries * sizeof(UNIHDR))) == NULL)
>+			if ((q_r->hdr_name = PRS_ALLOC_MEM( ps, UNIHDR, q_r->num_entries )) == NULL)
> 				return False;
>-			if ((q_r->uni_name = (UNISTR2 *)prs_alloc_mem(ps,
>-					q_r->num_entries * sizeof(UNISTR2))) == NULL)
>+			if ((q_r->uni_name = PRS_ALLOC_MEM( ps, UNISTR2, q_r->num_entries )) == NULL)
> 				return False;
> 		}
> 	}
>@@ -1179,7 +1169,7 @@
> 		}
> 
> 		if (UNMARSHALLING(ps)) {
>-			if ((r_r->dom_rid = (DOM_RID2 *)prs_alloc_mem(ps, r_r->num_entries2 * sizeof(DOM_RID2)))
>+			if ((r_r->dom_rid = PRS_ALLOC_MEM( ps, DOM_RID2, r_r->num_entries2 ))
> 			    == NULL) {
> 				DEBUG(3, ("lsa_io_r_lookup_names(): out of memory\n"));
> 				return False;
>@@ -1401,7 +1391,7 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps))
>-			if (!(r_q->privs = (LSA_PRIV_ENTRY *)prs_alloc_mem(ps, sizeof(LSA_PRIV_ENTRY) * r_q->count1)))
>+			if (!(r_q->privs = PRS_ALLOC_MEM(ps, LSA_PRIV_ENTRY, r_q->count1)))
> 				return False;
> 
> 		if (!lsa_io_priv_entries("", r_q->privs, r_q->count1, ps, depth))
>@@ -1834,7 +1824,7 @@
> 		/* malloc memory if unmarshalling here */
> 
> 		if (UNMARSHALLING(ps) && r_c->count!=0) {
>-			if (!(r_c->set.set = (LUID_ATTR *)prs_alloc_mem(ps,sizeof(LUID_ATTR) * r_c->count)))
>+			if (!(r_c->set.set = PRS_ALLOC_MEM( ps, LUID_ATTR, r_c->count )))
> 				return False;
> 
> 		}
>@@ -2006,7 +1996,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps) && r_c->count!=0) {
>-		if (!(r_c->set.set = (LUID_ATTR *)prs_alloc_mem(ps,sizeof(LUID_ATTR) * r_c->count)))
>+		if (!(r_c->set.set = PRS_ALLOC_MEM( ps, LUID_ATTR, r_c->count )))
> 			return False;
> 	}
> 	
>@@ -2065,7 +2055,7 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps) && r_c->count!=0) {
>-			if (!(r_c->set.set = (LUID_ATTR *)prs_alloc_mem(ps,sizeof(LUID_ATTR) * r_c->count)))
>+			if (!(r_c->set.set = PRS_ALLOC_MEM(ps,LUID_ATTR, r_c->count)))
> 				return False;
> 		}
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_misc.c samba-2.2.12-backport/source/rpc_parse/parse_misc.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_misc.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_misc.c	2004-12-22 15:02:13.000000000 -0500
>@@ -529,16 +529,14 @@
> 
> 	len = strlen(buf) + 1;
> 
>-	if (len < MAX_UNISTRLEN)
>-		len = MAX_UNISTRLEN;
>-	len *= sizeof(uint16);
>+	len = MAX(len, MAX_UNISTRLEN);
> 
>-	str->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len);
>+	str->buffer = (uint16 *)TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, len);
> 	if (str->buffer == NULL)
> 		smb_panic("init_unistr: malloc fail\n");
> 
> 	/* store the string (null-terminated copy) */
>-	dos_struni2((char *)str->buffer, buf, len);
>+	dos_struni2((char *)str->buffer, buf, sizeof(uint16)*len);
> }
> 
> /*******************************************************************
>@@ -566,10 +564,9 @@
> 
> static void create_buffer3(BUFFER3 *str, size_t len)
> {
>-	if (len < MAX_BUFFERLEN)
>-		len = MAX_BUFFERLEN;
>+	len = MAX(len,MAX_BUFFERLEN);
> 
>-	str->buffer = talloc_zero(get_talloc_ctx(), len);
>+	str->buffer = TALLOC_ZERO(get_talloc_ctx(), len);
> 	if (str->buffer == NULL)
> 		smb_panic("create_buffer3: talloc fail\n");
> 
>@@ -658,7 +655,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		buf3->buffer = (unsigned char *)prs_alloc_mem(ps, buf3->buf_max_len);
>+		buf3->buffer = PRS_ALLOC_MEM( ps, unsigned char, buf3->buf_max_len );
> 		if (buf3->buffer == NULL)
> 			return False;
> 	}
>@@ -710,9 +707,8 @@
> 	str->buf_len = buf != NULL ? len : 0;
> 
> 	if (buf != NULL) {
>-		if (len < MAX_BUFFERLEN)
>-			len = MAX_BUFFERLEN;
>-		str->buffer = talloc_zero(get_talloc_ctx(), len);
>+		len = MAX(len, MAX_BUFFERLEN);
>+		str->buffer = TALLOC_ZERO(get_talloc_ctx(), len);
> 		if (str->buffer == NULL)
> 			smb_panic("init_buffer2: talloc fail\n");
> 		memcpy(str->buffer, buf, MIN(str->buf_len, len));
>@@ -799,15 +795,9 @@
> 	   (the the length of the source string) to prevent
> 	   reallocation of memory. */
> 	if (str->buffer == NULL) {
>-		size_t len = from->uni_max_len * sizeof(uint16);
>-
>-		if (len < MAX_UNISTRLEN)
>-			len = MAX_UNISTRLEN;
>-		len *= sizeof(uint16);
>-
>-   		str->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len);
>-		if ((str->buffer == NULL) && (len > 0 ))
>-		{
>+	    size_t alloc_len = MAX(from->uni_max_len,MAX_UNISTRLEN);
>+	    str->buffer = (uint16 *)TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, alloc_len);
>+	    if ((str->buffer == NULL)) {
> 			smb_panic("copy_unistr2: talloc fail\n");
> 			return;
> 		}
>@@ -823,8 +813,6 @@
> 
> void init_string2(STRING2 *str, const char *buf, int max_len, int str_len)
> {
>-	int alloc_len = 0;
>-
> 	/* set up string lengths. */
> 	str->str_max_len = max_len;
> 	str->undoc       = 0;
>@@ -832,9 +820,8 @@
> 
> 	/* store the string */
> 	if(str_len != 0) {
>-		if (str_len < MAX_STRINGLEN)
>-			alloc_len = MAX_STRINGLEN;
>-		str->buffer = talloc_zero(get_talloc_ctx(), alloc_len);
>+		int alloc_len = MAX(str_len,MAX_STRINGLEN);
>+		str->buffer = TALLOC_ZERO(get_talloc_ctx(), alloc_len);
> 		if (str->buffer == NULL)
> 			smb_panic("init_string2: malloc fail\n");
> 		memcpy(str->buffer, buf, str_len);
>@@ -897,17 +884,18 @@
> 	str->undoc       = 0;
> 	str->uni_str_len = (uint32)len;
> 
>-	if (len < MAX_UNISTRLEN)
>-		len = MAX_UNISTRLEN;
>-	len *= sizeof(uint16);
>+	len = MAX(len, MAX_UNISTRLEN);
> 
>-	str->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len);
>-	if ((str->buffer == NULL) && (len > 0))
>+	str->buffer = TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, len);
>+	if (str->buffer == NULL)
> 	{
> 		smb_panic("init_unistr2: malloc fail\n");
> 		return;
> 	}
> 
>+	/* Ensure len is the length in *bytes* */
>+	len *= sizeof(uint16);
>+
> 	/*
> 	 * don't move this test above ! The UNISTR2 must be initialized !!!
> 	 * jfm, 7/7/2001.
>@@ -950,7 +938,7 @@
> 	to->uni_str_len = i;
> 
> 	/* allocate the space and copy the string buffer */
>-	to->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), sizeof(uint16)*(to->uni_str_len));
>+	to->buffer = TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, to->uni_str_len);
> 	if (to->buffer == NULL)
> 		smb_panic("init_unistr2_from_unistr: malloc fail\n");
> 	memcpy(to->buffer, from->buffer, to->uni_max_len*sizeof(uint16));
>@@ -1482,14 +1470,12 @@
> 	if (len < MAX_UNISTRLEN)
> 		len = MAX_UNISTRLEN;
> 
>-	len *= sizeof(uint16);
>-
>-	str->str.buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len);
>+	str->str.buffer = TALLOC_ZERO_ARRAY(get_talloc_ctx(), uint16, len);
> 	if (str->str.buffer == NULL)
> 		smb_panic("init_unistr3: malloc fail\n");
> 
> 	/* store the string (null-terminated copy) */
>-	dos_struni2((char *)str->str.buffer, buf, len);
>+	dos_struni2((char *)str->str.buffer, buf, len*sizeof(uint16));
> }
> 
> /*******************************************************************
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_net.c samba-2.2.12-backport/source/rpc_parse/parse_net.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_net.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_net.c	2004-12-22 16:11:10.000000000 -0500
>@@ -824,7 +824,7 @@
> 			;
> 
> 		/* Now allocate space for them. */
>-		*ppsids = (DOM_SID2 *)talloc_zero(ctx, count * sizeof(DOM_SID2));
>+		*ppsids = TALLOC_ZERO_ARRAY(ctx, DOM_SID2, count);
> 		if (*ppsids == NULL)
> 			return 0;
> 
>@@ -1121,7 +1121,7 @@
> 	depth++;
> 
> 	if (UNMARSHALLING(ps)) {
>-		ctr = *pp_ctr = (NET_ID_INFO_CTR *)prs_alloc_mem(ps, sizeof(NET_ID_INFO_CTR));
>+		ctr = *pp_ctr = PRS_ALLOC_MEM( ps, NET_ID_INFO_CTR, 1 );
> 		if (ctr == NULL)
> 			return False;
> 	}
>@@ -1291,7 +1291,7 @@
> 	/* always have at least one group == the user's primary group */
> 	usr->num_groups2 = num_groups+1;
> 
>-	usr->gids = (DOM_GID *)talloc_zero(ctx,sizeof(DOM_GID) * (num_groups+1));
>+	usr->gids = TALLOC_ZERO_ARRAY(ctx,DOM_GID, num_groups+1);
> 	if (usr->gids == NULL)
> 		return;
> 
>@@ -1426,7 +1426,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps) && usr->num_groups2 > 0) {
>-		usr->gids = (DOM_GID *)prs_alloc_mem(ps, sizeof(DOM_GID)*usr->num_groups2);
>+		usr->gids = PRS_ALLOC_MEM( ps, DOM_GID, usr->num_groups2 );
> 		if (usr->gids == NULL)
> 			return False;
> 	}
>@@ -1447,7 +1447,7 @@
> 	if (usr->num_other_sids) {
> 
> 		if (UNMARSHALLING(ps)) {
>-			usr->other_sids = (DOM_SID2 *)prs_alloc_mem(ps, sizeof(DOM_SID2)*usr->num_other_sids);
>+			usr->other_sids = PRS_ALLOC_MEM( ps, DOM_SID2, usr->num_other_sids );
> 			if (usr->other_sids == NULL)
> 				return False;
> 		}
>@@ -1456,7 +1456,7 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps) && usr->num_other_groups > 0) {
>-			usr->other_gids = (DOM_GID *)prs_alloc_mem(ps, sizeof(DOM_GID)*usr->num_other_groups);
>+			usr->other_gids = PRS_ALLOC_MEM( ps, DOM_GID, usr->num_other_groups );
> 			if (usr->other_gids == NULL)
> 				return False;
> 		}
>@@ -2130,8 +2130,7 @@
> 			return False;
> 		}
> 
>-                info->rids = talloc(ps->mem_ctx, sizeof(uint32) *
>-                                    info->num_members2);
>+                info->rids = TALLOC_ARRAY(ps->mem_ctx, uint32, info->num_members2);
> 
>                 if (info->rids == NULL) {
>                         DEBUG(0, ("out of memory allocating %d rids\n",
>@@ -2158,8 +2157,7 @@
> 			return False;
> 		}
> 
>-                info->attribs = talloc(ps->mem_ctx, sizeof(uint32) *
>-                                       info->num_members3);
>+                info->attribs = TALLOC_ARRAY(ps->mem_ctx, uint32, info->num_members3);
> 
>                 if (info->attribs == NULL) {
>                         DEBUG(0, ("out of memory allocating %d attribs\n",
>@@ -2245,8 +2243,7 @@
> 			return False;
> 		}
> 
>-                info->ptr_sids = talloc(ps->mem_ctx, sizeof(uint32) *
>-                                        info->num_sids);
>+                info->ptr_sids = TALLOC_ARRAY(ps->mem_ctx, uint32, info->num_sids);
>                 
>                 if (info->ptr_sids == NULL) {
>                         DEBUG(0, ("out of memory allocating %d ptr_sids\n",
>@@ -2261,8 +2258,7 @@
>                                 return False;
> 		}
> 
>-                info->sids = talloc(ps->mem_ctx, sizeof(DOM_SID2) *
>-                                    info->num_sids);
>+                info->sids = TALLOC_ARRAY(ps->mem_ctx, DOM_SID2, info->num_sids);
> 
>                 if (info->sids == NULL) {
>                         DEBUG(0, ("error allocating %d sids\n",
>@@ -2402,9 +2398,7 @@
> 			}
> 
>                         if (r_s->num_deltas2 > 0) {
>-                                r_s->hdr_deltas = (SAM_DELTA_HDR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas2 *
>-                                               sizeof(SAM_DELTA_HDR));
>+                                r_s->hdr_deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_HDR, r_s->num_deltas2);
>                           
>                                 if (r_s->hdr_deltas == NULL) {
>                                         DEBUG(0, ("error tallocating memory "
>@@ -2423,9 +2417,7 @@
> 			}
> 
>                         if (r_s->num_deltas2 > 0) {
>-                                r_s->deltas = (SAM_DELTA_CTR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas2 *
>-                                               sizeof(SAM_DELTA_CTR));
>+                                r_s->deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_CTR, r_s->num_deltas2 );
> 
>                                 if (r_s->deltas == NULL) {
>                                         DEBUG(0, ("error tallocating memory "
>@@ -2538,9 +2530,7 @@
> 		if (r_s->ptr_deltas != 0)
> 		{
>                         if (r_s->num_deltas > 0) {
>-                                r_s->hdr_deltas = (SAM_DELTA_HDR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas *
>-                                               sizeof(SAM_DELTA_HDR));
>+                                r_s->hdr_deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_HDR, r_s->num_deltas);
>                                 if (r_s->hdr_deltas == NULL) {
>                                         DEBUG(0, ("error tallocating memory "
>                                                   "for %d delta headers\n", 
>@@ -2556,9 +2546,7 @@
> 			}
>                         
>                         if (r_s->num_deltas > 0) {
>-                                r_s->deltas = (SAM_DELTA_CTR *)
>-                                        talloc(ps->mem_ctx, r_s->num_deltas *
>-                                               sizeof(SAM_DELTA_CTR));
>+                                r_s->deltas = TALLOC_ARRAY(ps->mem_ctx, SAM_DELTA_CTR, r_s->num_deltas );
> 
>                                 if (r_s->deltas == NULL) {
>                                         DEBUG(0, ("error tallocating memory "
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_prs.c samba-2.2.12-backport/source/rpc_parse/parse_prs.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_prs.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_prs.c	2004-12-22 16:02:49.000000000 -0500
>@@ -83,7 +83,7 @@
> 
> 	if (size != 0) {
> 		ps->buffer_size = size;
>-		if((ps->data_p = (char *)malloc((size_t)size)) == NULL) {
>+		if((ps->data_p = (char *)SMB_MALLOC((size_t)size)) == NULL) {
> 			DEBUG(0,("prs_init: malloc fail for %u bytes.\n", (unsigned int)size));
> 			return False;
> 		}
>@@ -136,20 +136,6 @@
> }
> 
> /*******************************************************************
>- Allocate memory when unmarshalling... Always zero clears.
>- ********************************************************************/
>-
>-char *prs_alloc_mem(prs_struct *ps, size_t size)
>-{
>-	char *ret = talloc(ps->mem_ctx, size);
>-
>-	if (ret)
>-		memset(ret, '\0', size);
>-
>-	return ret;
>-}
>-
>-/*******************************************************************
>  Return the current talloc context we're using.
>  ********************************************************************/
> 
>@@ -193,7 +179,7 @@
> 		return prs_force_grow(ps, newsize - ps->buffer_size);
> 
> 	if (newsize < ps->buffer_size) {
>-		char *new_data_p = Realloc(ps->data_p, newsize);
>+		char *new_data_p = SMB_REALLOC(ps->data_p, newsize);
> 		/* if newsize is zero, Realloc acts like free() & returns NULL*/
> 		if (new_data_p == NULL && newsize != 0) {
> 			DEBUG(0,("prs_set_buffer_size: Realloc failure for size %u.\n",
>@@ -247,7 +233,7 @@
> 
> 		new_size = MAX(MAX_PDU_FRAG_LEN,extra_space);
> 
>-		if((new_data = malloc(new_size)) == NULL) {
>+		if((new_data = SMB_MALLOC(new_size)) == NULL) {
> 			DEBUG(0,("prs_grow: Malloc failure for size %u.\n", (unsigned int)new_size));
> 			return False;
> 		}
>@@ -259,7 +245,7 @@
> 		 */
> 		new_size = MAX(ps->buffer_size*2, ps->buffer_size + extra_space);		
> 
>-		if ((new_data = Realloc(ps->data_p, new_size)) == NULL) {
>+		if ((new_data = SMB_REALLOC(ps->data_p, new_size)) == NULL) {
> 			DEBUG(0,("prs_grow: Realloc failure for size %u.\n",
> 				(unsigned int)new_size));
> 			return False;
>@@ -290,7 +276,7 @@
> 		return False;
> 	}
> 
>-	if((new_data = Realloc(ps->data_p, new_size)) == NULL) {
>+	if((new_data = SMB_REALLOC(ps->data_p, new_size)) == NULL) {
> 		DEBUG(0,("prs_force_grow: Realloc failure for size %u.\n",
> 			(unsigned int)new_size));
> 		return False;
>@@ -839,7 +825,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		str->buffer = (uint16 *)prs_alloc_mem(ps,str->buf_len * sizeof(uint16));
>+		str->buffer = PRS_ALLOC_MEM( ps, uint16, str->buf_len );
> 		if (str->buffer == NULL)
> 			return False;
> 	}
>@@ -870,7 +856,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		str->buffer = (uint16 *)prs_alloc_mem(ps,str->buf_len);
>+		str->buffer = PRS_ALLOC_MEM( ps, uint16, str->buf_len );
> 		if (str->buffer == NULL)
> 			return False;
> 	}
>@@ -896,7 +882,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		str->buffer = (unsigned char *)prs_alloc_mem(ps,str->str_max_len);
>+		str->buffer = PRS_ALLOC_MEM( ps, unsigned char, str->str_max_len );
> 		if (str->buffer == NULL)
> 			return False;
> 	}
>@@ -940,7 +926,7 @@
> 		return True;
> 
> 	if (UNMARSHALLING(ps)) {
>-		str->buffer = (uint16 *)prs_alloc_mem(ps,str->uni_max_len * sizeof(uint16));
>+		str->buffer = PRS_ALLOC_MEM( ps, uint16, str->uni_max_len );
> 		if (str->buffer == NULL)
> 			return False;
> 	}
>@@ -967,7 +953,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		str->str.buffer = (uint16 *)prs_alloc_mem(ps,str->uni_str_len * sizeof(uint16));
>+		str->str.buffer = PRS_ALLOC_MEM(ps, uint16, str->uni_str_len );
> 		if (str->str.buffer == NULL)
> 			return False;
> 	}
>@@ -1055,7 +1041,7 @@
> 			;
> 
> 		/* should we allocate anything at all? */
>-		str->buffer = (uint16 *)prs_alloc_mem(ps,alloc_len * sizeof(uint16));
>+		str->buffer = PRS_ALLOC_MEM( ps, uint16, alloc_len );
> 		if ((str->buffer == NULL) && (alloc_len > 0))
> 			return False;
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_samr.c samba-2.2.12-backport/source/rpc_parse/parse_samr.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_samr.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_samr.c	2004-12-22 16:14:44.000000000 -0500
>@@ -1346,8 +1346,8 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps) && (r_u->num_entries2 != 0)) {
>-			r_u->sam = (SAM_ENTRY *)prs_alloc_mem(ps,sizeof(SAM_ENTRY)*r_u->num_entries2);
>-			r_u->uni_acct_name = (UNISTR2 *)prs_alloc_mem(ps,sizeof(UNISTR2)*r_u->num_entries2);
>+			r_u->sam = PRS_ALLOC_MEM( ps, SAM_ENTRY, r_u->num_entries2 );
>+			r_u->uni_acct_name = PRS_ALLOC_MEM( ps, UNISTR2, r_u->num_entries2 );
> 		}
> 
> 		if ((r_u->sam == NULL || r_u->uni_acct_name == NULL) && r_u->num_entries2 != 0) {
>@@ -1451,11 +1451,11 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	sam->sam=(SAM_ENTRY1 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY1));
>+	sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY1, num_entries);
> 	if (!sam->sam)
> 		return NT_STATUS_NO_MEMORY;
> 
>-	sam->str=(SAM_STR1 *)talloc(ctx, num_entries*sizeof(SAM_STR1));
>+	sam->str=TALLOC_ARRAY(ctx, SAM_STR1, num_entries);
> 	if (!sam->str)
> 		return NT_STATUS_NO_MEMORY;
> 
>@@ -1505,16 +1505,12 @@
> 
> 	if (UNMARSHALLING(ps) && num_entries > 0) {
> 
>-		if ((sam->sam = (SAM_ENTRY1 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_ENTRY1) *
>-				   num_entries)) == NULL) {
>+		if ((sam->sam = PRS_ALLOC_MEM(ps, SAM_ENTRY1, num_entries)) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_ENTRY1\n"));
> 			return False;
> 		}
> 
>-		if ((sam->str = (SAM_STR1 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_STR1) * 
>-				   num_entries)) == NULL) {
>+		if ((sam->str = PRS_ALLOC_MEM(ps, SAM_STR1, num_entries)) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_STR1\n"));
> 			return False;
> 		}
>@@ -1554,10 +1550,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY2 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY2))))
>+	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY2, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR2 *)talloc(ctx, num_entries*sizeof(SAM_STR2))))
>+	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR2, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -1605,16 +1601,12 @@
> 
> 	if (UNMARSHALLING(ps) && num_entries > 0) {
> 
>-		if ((sam->sam = (SAM_ENTRY2 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_ENTRY2) *
>-				   num_entries)) == NULL) {
>+		if ((sam->sam = PRS_ALLOC_MEM( ps, SAM_ENTRY2, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_ENTRY2\n"));
> 			return False;
> 		}
> 
>-		if ((sam->str = (SAM_STR2 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_STR2) * 
>-				   num_entries)) == NULL) {
>+		if ((sam->str = PRS_ALLOC_MEM( ps, SAM_STR2, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_STR2\n"));
> 			return False;
> 		}
>@@ -1652,10 +1644,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY3 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY3))))
>+	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY3, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR3 *)talloc(ctx, num_entries*sizeof(SAM_STR3))))
>+	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR3, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -1699,16 +1691,12 @@
> 
> 	if (UNMARSHALLING(ps) && num_entries > 0) {
> 
>-		if ((sam->sam = (SAM_ENTRY3 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_ENTRY3) *
>-				   num_entries)) == NULL) {
>+		if ((sam->sam = PRS_ALLOC_MEM( ps, SAM_ENTRY3, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_ENTRY3\n"));
> 			return False;
> 		}
> 
>-		if ((sam->str = (SAM_STR3 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_STR3) * 
>-				   num_entries)) == NULL) {
>+		if ((sam->str = PRS_ALLOC_MEM( ps, SAM_STR3, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_STR3\n"));
> 			return False;
> 		}
>@@ -1747,10 +1735,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY4 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY4))))
>+	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY4, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR4 *)talloc(ctx, num_entries*sizeof(SAM_STR4))))
>+	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR4, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -1792,16 +1780,12 @@
> 
> 	if (UNMARSHALLING(ps) && num_entries > 0) {
> 
>-		if ((sam->sam = (SAM_ENTRY4 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_ENTRY4) *
>-				   num_entries)) == NULL) {
>+		if ((sam->sam = PRS_ALLOC_MEM( ps, SAM_ENTRY4, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_ENTRY4\n"));
> 			return False;
> 		}
> 
>-		if ((sam->str = (SAM_STR4 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_STR4) * 
>-				   num_entries)) == NULL) {
>+		if ((sam->str = PRS_ALLOC_MEM(ps, SAM_STR4, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_STR4\n"));
> 			return False;
> 		}
>@@ -1838,10 +1822,10 @@
> 	if (num_entries==0)
> 		return NT_STATUS_OK;
> 
>-	if (!(sam->sam=(SAM_ENTRY5 *)talloc(ctx, num_entries*sizeof(SAM_ENTRY5))))
>+	if (!(sam->sam=TALLOC_ARRAY(ctx, SAM_ENTRY5, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(sam->str=(SAM_STR5 *)talloc(ctx, num_entries*sizeof(SAM_STR5))))
>+	if (!(sam->str=TALLOC_ARRAY(ctx, SAM_STR5, num_entries)))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(sam->sam);
>@@ -1882,16 +1866,12 @@
> 
> 	if (UNMARSHALLING(ps) && num_entries > 0) {
> 
>-		if ((sam->sam = (SAM_ENTRY5 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_ENTRY5) *
>-				   num_entries)) == NULL) {
>+		if ((sam->sam = PRS_ALLOC_MEM( ps, SAM_ENTRY5, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_ENTRY5\n"));
> 			return False;
> 		}
> 
>-		if ((sam->str = (SAM_STR5 *)
>-		     prs_alloc_mem(ps, sizeof(SAM_STR5) * 
>-				   num_entries)) == NULL) {
>+		if ((sam->str = PRS_ALLOC_MEM( ps, SAM_STR5, num_entries )) == NULL) {
> 			DEBUG(0, ("out of memory allocating SAM_STR5\n"));
> 			return False;
> 		}
>@@ -2231,7 +2211,7 @@
> 				prs_struct *ps, int depth)
> {
> 	if (UNMARSHALLING(ps))
>-		*ctr = (GROUP_INFO_CTR *)prs_alloc_mem(ps,sizeof(GROUP_INFO_CTR));
>+		*ctr = PRS_ALLOC_MEM( ps, GROUP_INFO_CTR, 1 );
> 
> 	if (*ctr == NULL)
> 		return False;
>@@ -2804,7 +2784,7 @@
> 			if(!prs_uint32("num_rids", ps, depth, &r_u->num_rids))
> 				return False;
> 			if (UNMARSHALLING(ps) && r_u->num_rids != 0) {
>-				r_u->rid = (uint32 *)prs_alloc_mem(ps,sizeof(r_u->rid[0])*r_u->num_rids);
>+				r_u->rid = PRS_ALLOC_MEM( ps, uint32, r_u->num_rids );
> 				if (r_u->rid == NULL)
> 					return False;
> 			}
>@@ -2820,7 +2800,7 @@
> 				return False;
> 
> 			if (UNMARSHALLING(ps) && r_u->num_attrs != 0) {
>-				r_u->attr = (uint32 *)prs_alloc_mem(ps,sizeof(r_u->attr[0])*r_u->num_attrs);
>+				r_u->attr = PRS_ALLOC_MEM( ps, uint32, r_u->num_attrs );
> 				if (r_u->attr == NULL)
> 					return False;
> 			}
>@@ -2921,7 +2901,7 @@
> 
> 	if ((*num_gids) != 0) {
> 		if (UNMARSHALLING(ps)) {
>-			(*gid) = (DOM_GID *)prs_alloc_mem(ps,sizeof(DOM_GID)*(*num_gids));
>+			(*gid) = PRS_ALLOC_MEM( ps, DOM_GID, (*num_gids) );
> 		}
> 
> 		if ((*gid) == NULL) {
>@@ -3076,8 +3056,8 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps)) {
>-			r_u->sam = (SAM_ENTRY *)prs_alloc_mem(ps,sizeof(SAM_ENTRY)*r_u->num_entries2);
>-			r_u->uni_dom_name = (UNISTR2 *)prs_alloc_mem(ps,sizeof(UNISTR2)*r_u->num_entries2);
>+			r_u->sam = PRS_ALLOC_MEM( ps, SAM_ENTRY, r_u->num_entries2 );
>+			r_u->uni_dom_name = PRS_ALLOC_MEM( ps, UNISTR2, r_u->num_entries2 );
> 		}
> 
> 		if ((r_u->sam == NULL || r_u->uni_dom_name == NULL) && r_u->num_entries2 != 0) {
>@@ -3215,8 +3195,8 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps)) {
>-			r_u->sam = (SAM_ENTRY *)prs_alloc_mem(ps,sizeof(SAM_ENTRY)*r_u->num_entries2);
>-			r_u->uni_grp_name = (UNISTR2 *)prs_alloc_mem(ps,sizeof(UNISTR2)*r_u->num_entries2);
>+			r_u->sam = PRS_ALLOC_MEM(ps, SAM_ENTRY, r_u->num_entries2 );
>+			r_u->uni_grp_name = PRS_ALLOC_MEM( ps, UNISTR2, r_u->num_entries2 );
> 		}
> 
> 		if ((r_u->sam == NULL || r_u->uni_grp_name == NULL) && r_u->num_entries2 != 0) {
>@@ -3349,8 +3329,8 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps) && (r_u->num_entries2 > 0)) {
>-			r_u->sam = (SAM_ENTRY *)prs_alloc_mem(ps,sizeof(SAM_ENTRY)*r_u->num_entries2);
>-			r_u->uni_grp_name = (UNISTR2 *)prs_alloc_mem(ps,sizeof(UNISTR2)*r_u->num_entries2);
>+			r_u->sam = PRS_ALLOC_MEM( ps, SAM_ENTRY, r_u->num_entries2 );
>+			r_u->uni_grp_name = PRS_ALLOC_MEM( ps, UNISTR2, r_u->num_entries2 );
> 		}
> 
> 		if (r_u->num_entries2 != 0 && 
>@@ -3712,11 +3692,11 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps) && (q_u->num_sids2 != 0)) {
>-		q_u->ptr_sid = (uint32 *)prs_alloc_mem(ps,sizeof(q_u->ptr_sid[0])*q_u->num_sids2);
>+		q_u->ptr_sid = PRS_ALLOC_MEM( ps, uint32, q_u->num_sids2 );
> 		if (q_u->ptr_sid == NULL)
> 			return False;
> 
>-		q_u->sid = (DOM_SID2 *)prs_alloc_mem(ps, sizeof(q_u->sid[0]) * q_u->num_sids2);
>+		q_u->sid = PRS_ALLOC_MEM( ps, DOM_SID2, q_u->num_sids2 );
> 		if (q_u->sid == NULL)
> 			return False;
> 	}
>@@ -3787,7 +3767,7 @@
> 	if ((*num_rids) != 0) {
> 		if (UNMARSHALLING(ps)) {
> 			/* reading */
>-			(*rid) = (uint32 *)prs_alloc_mem(ps,sizeof(uint32)*(*num_rids));
>+			(*rid) = PRS_ALLOC_MEM( ps, uint32, (*num_rids) );
> 		}
> 		if ((*rid) == NULL)
> 			return False;
>@@ -3918,7 +3898,7 @@
> 	q_u->flags = flags;
> 	q_u->ptr = 0;
> 	q_u->num_rids2 = num_rids;
>-	q_u->rid = (uint32 *)talloc_zero(ctx, num_rids * sizeof(q_u->rid[0]));
>+	q_u->rid = TALLOC_ZERO_ARRAY(ctx, uint32, num_rids);
> 	if (q_u->rid == NULL) {
> 		q_u->num_rids1 = 0;
> 		q_u->num_rids2 = 0;
>@@ -3962,7 +3942,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps) && (q_u->num_rids2 != 0)) {
>-		q_u->rid = (uint32 *)prs_alloc_mem(ps, sizeof(q_u->rid[0])*q_u->num_rids2);
>+		q_u->rid = PRS_ALLOC_MEM( ps, uint32, q_u->num_rids2 );
> 		if (q_u->rid == NULL)
> 			return False;
> 	}
>@@ -4043,11 +4023,11 @@
> 
> 
> 		if (UNMARSHALLING(ps) && (r_u->num_names2 != 0)) {
>-			r_u->hdr_name = (UNIHDR *) prs_alloc_mem(ps, r_u->num_names2 * sizeof(r_u->hdr_name[0]));
>+			r_u->hdr_name = PRS_ALLOC_MEM( ps, UNIHDR, r_u->num_names2 );
> 			if (r_u->hdr_name == NULL)
> 				return False;
> 
>-			r_u->uni_name = (UNISTR2 *)prs_alloc_mem(ps, r_u->num_names2 * sizeof(r_u->uni_name[0]));
>+			r_u->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, r_u->num_names2 );
> 			if (r_u->uni_name == NULL)
> 				return False;
> 		}
>@@ -4078,7 +4058,7 @@
> 			return False;
> 
> 		if (UNMARSHALLING(ps) && (r_u->num_types2 != 0)) {
>-			r_u->type = (uint32 *)prs_alloc_mem(ps, r_u->num_types2 * sizeof(r_u->type[0]));
>+			r_u->type = PRS_ALLOC_MEM(ps, uint32, r_u->num_types2 );
> 			if (r_u->type == NULL)
> 				return False;
> 		}
>@@ -4550,10 +4530,10 @@
> 	q_u->ptr = 0;
> 	q_u->num_names2 = num_names;
> 
>-	if (!(q_u->hdr_name = (UNIHDR *)talloc_zero(ctx, num_names * sizeof(UNIHDR))))
>+	if (!(q_u->hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR, num_names)))
> 		return NT_STATUS_NO_MEMORY;
> 
>-	if (!(q_u->uni_name = (UNISTR2 *)talloc_zero(ctx, num_names * sizeof(UNISTR2))))
>+	if (!(q_u->uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_names)))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	for (i = 0; i < num_names; i++) {
>@@ -4599,10 +4579,8 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps) && (q_u->num_names2 != 0)) {
>-		q_u->hdr_name = (UNIHDR *)prs_alloc_mem(ps, sizeof(UNIHDR) *
>-							q_u->num_names2);
>-		q_u->uni_name = (UNISTR2 *)prs_alloc_mem(ps, sizeof(UNISTR2) *
>-							 q_u->num_names2);
>+		q_u->hdr_name = PRS_ALLOC_MEM( ps, UNIHDR, q_u->num_names2 );
>+		q_u->uni_name = PRS_ALLOC_MEM( ps, UNISTR2, q_u->num_names2 );
> 		if (!q_u->hdr_name || !q_u->uni_name)
> 			return False;
> 	}
>@@ -4642,9 +4620,9 @@
> 		r_u->ptr_rids = 1;
> 		r_u->num_rids2 = num_rids;
> 
>-		if (!(r_u->rids = (uint32 *)talloc_zero(ctx, sizeof(uint32)*num_rids)))
>+		if (!(r_u->rids = TALLOC_ZERO_ARRAY(ctx, uint32,num_rids)))
> 			return NT_STATUS_NO_MEMORY;
>-		if (!(r_u->types = (uint32 *)talloc_zero(ctx, sizeof(uint32)*num_rids)))
>+		if (!(r_u->types = TALLOC_ZERO_ARRAY(ctx, uint32,num_rids)))
> 			return NT_STATUS_NO_MEMORY;
> 
> 		if (!r_u->rids || !r_u->types)
>@@ -4711,7 +4689,7 @@
> 		}
> 
> 		if (UNMARSHALLING(ps))
>-			r_u->rids = (uint32 *)prs_alloc_mem(ps, sizeof(uint32)*r_u->num_rids2);
>+			r_u->rids = PRS_ALLOC_MEM( ps, uint32, r_u->num_rids2 );
> 
> 		if (!r_u->rids) {
> 			DEBUG(0, ("NULL rids in samr_io_r_lookup_names\n"));
>@@ -4740,7 +4718,7 @@
> 		}
> 
> 		if (UNMARSHALLING(ps))
>-			r_u->types = (uint32 *)prs_alloc_mem(ps, sizeof(uint32)*r_u->num_types2);
>+			r_u->types = PRS_ALLOC_MEM( ps, uint32, r_u->num_types2 );
> 
> 		if (!r_u->types) {
> 			DEBUG(0, ("NULL types in samr_io_r_lookup_names\n"));
>@@ -6089,7 +6067,7 @@
> 
> 	switch (switch_value) {
> 	case 0x10:
>-		ctr->info.id10 = (SAM_USER_INFO_10 *)talloc_zero(ctx,sizeof(SAM_USER_INFO_10));
>+		ctr->info.id10 = TALLOC_ZERO_P(ctx,SAM_USER_INFO_10);
> 		if (ctr->info.id10 == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 
>@@ -6105,7 +6083,7 @@
> 			expire.low = 0xffffffff;
> 			expire.high = 0x7fffffff;
> 
>-			ctr->info.id = (SAM_USER_INFO_11 *) talloc_zero(ctx,sizeof(*ctr->info.id11));
>+			ctr->info.id = TALLOC_ZERO_P(ctx,SAM_USER_INFO_11);
> 			init_sam_user_info11(ctr->info.id11, &expire,
> 					     "BROOKFIELDS$",	/* name */
> 					     0x03ef,	/* user rid */
>@@ -6116,7 +6094,7 @@
> 		}
> #endif
> 	case 0x12:
>-		ctr->info.id12 = (SAM_USER_INFO_12 *)talloc_zero(ctx,sizeof(SAM_USER_INFO_12));
>+		ctr->info.id12 = TALLOC_ZERO_P(ctx,SAM_USER_INFO_12);
> 		if (ctr->info.id12 == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 
>@@ -6125,7 +6103,7 @@
> 	case 21:
> 		{
> 			SAM_USER_INFO_21 *cusr;
>-			cusr = (SAM_USER_INFO_21 *)talloc_zero(ctx,sizeof(SAM_USER_INFO_21));
>+			cusr = TALLOC_ZERO_P(ctx,SAM_USER_INFO_21);
> 			ctr->info.id21 = cusr;
> 			if (ctr->info.id21 == NULL)
> 				return NT_STATUS_NO_MEMORY;
>@@ -6184,7 +6162,7 @@
> 	depth++;
> 
> 	if (UNMARSHALLING(ps)) {
>-		ctr = (SAM_USERINFO_CTR *)prs_alloc_mem(ps,sizeof(SAM_USERINFO_CTR));
>+		ctr = PRS_ALLOC_MEM( ps, SAM_USERINFO_CTR, 1 );
> 		if (ctr == NULL)
> 			return False;
> 		*ppctr = ctr;
>@@ -6204,7 +6182,7 @@
> 	switch (ctr->switch_value) {
> 	case 0x10:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id10 = (SAM_USER_INFO_10 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_10));
>+			ctr->info.id10 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_10, 1);
> 		if (ctr->info.id10 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
> 			return False;
>@@ -6213,7 +6191,7 @@
> 		break;
> 	case 0x11:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id11 = (SAM_USER_INFO_11 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_11));
>+			ctr->info.id11 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_11, 1 );
> 
> 		if (ctr->info.id11 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
>@@ -6223,7 +6201,7 @@
> 		break;
> 	case 0x12:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id12 = (SAM_USER_INFO_12 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_12));
>+			ctr->info.id12 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_12, 1 );
> 
> 		if (ctr->info.id12 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
>@@ -6233,7 +6211,7 @@
> 		break;
> 	case 20:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id20 = (SAM_USER_INFO_20 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_20));
>+			ctr->info.id20 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_20, 1 );
> 
> 		if (ctr->info.id20 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
>@@ -6243,7 +6221,7 @@
> 		break;
> 	case 21:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id21 = (SAM_USER_INFO_21 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_21));
>+			ctr->info.id21 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_21, 1 );
> 
> 		if (ctr->info.id21 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
>@@ -6253,7 +6231,7 @@
> 		break;
> 	case 23:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id23 = (SAM_USER_INFO_23 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_23));
>+			ctr->info.id23 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_23, 1 );
> 
> 		if (ctr->info.id23 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
>@@ -6263,7 +6241,7 @@
> 		break;
> 	case 24:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id24 = (SAM_USER_INFO_24 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_24));
>+			ctr->info.id24 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_24, 1);
> 
> 		if (ctr->info.id24 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
>@@ -6273,7 +6251,7 @@
> 		break;
> 	case 25:
> 		if (UNMARSHALLING(ps))
>-			ctr->info.id25 = (SAM_USER_INFO_25 *)prs_alloc_mem(ps,sizeof(SAM_USER_INFO_25));
>+			ctr->info.id25 = PRS_ALLOC_MEM( ps, SAM_USER_INFO_25, 1 );
> 
> 		if (ctr->info.id25 == NULL) {
> 			DEBUG(2,("samr_io_userinfo_ctr: info pointer not initialised\n"));
>@@ -7094,7 +7072,7 @@
> 	if(!prs_align(ps))
> 		return False;
> 
>-	if ((q_u->ctr = (SAM_UNK_CTR *)prs_alloc_mem(ps, sizeof(SAM_UNK_CTR))) == NULL)
>+	if ((q_u->ctr = PRS_ALLOC_MEM( ps, SAM_UNK_CTR, 1 )) == NULL)
> 		return False;
> 	
> 	switch (q_u->switch_value) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_sec.c samba-2.2.12-backport/source/rpc_parse/parse_sec.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_sec.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_sec.c	2004-12-22 16:06:58.000000000 -0500
>@@ -116,7 +116,7 @@
> 	SEC_ACL *dst;
> 	int i;
> 
>-	if((dst = (SEC_ACL *)talloc_zero(ctx,sizeof(SEC_ACL))) == NULL)
>+	if((dst = TALLOC_ZERO_P(ctx,SEC_ACL)) == NULL)
> 		return NULL;
> 
> 	dst->revision = revision;
>@@ -130,7 +130,7 @@
> 	   positive number. */
> 
> 	if ((num_aces) && 
>-            ((dst->ace = (SEC_ACE *)talloc(ctx, sizeof(SEC_ACE) * num_aces)) 
>+            ((dst->ace = TALLOC_ARRAY(ctx, SEC_ACE,num_aces)) 
>              == NULL)) {
> 		return NULL;
> 	}
>@@ -185,7 +185,7 @@
> 		/*
> 		 * This is a read and we must allocate the stuct to read into.
> 		 */
>-		if((psa = (SEC_ACL *)prs_alloc_mem(ps, sizeof(SEC_ACL))) == NULL)
>+		if((psa = PRS_ALLOC_MEM( ps, SEC_ACL, 1 )) == NULL)
> 			return False;
> 		*ppsa = psa;
> 	}
>@@ -210,7 +210,7 @@
> 		 * between a non-present DACL (allow all access) and a DACL with no ACE's
> 		 * (allow no access).
> 		 */
>-		if((psa->ace = (SEC_ACE *)prs_alloc_mem(ps,sizeof(psa->ace[0]) * (psa->num_aces+1))) == NULL)
>+		if((psa->ace = PRS_ALLOC_MEM( ps, SEC_ACE, psa->num_aces+1 )) == NULL)
> 			return False;
> 	}
> 
>@@ -461,7 +461,7 @@
>   if(!src)
>     return NULL;
> 
>-  if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) {
>+  if((dst = TALLOC_ZERO_P(ctx, DOM_SID)) != NULL) {
>     sid_copy( dst, src);
>   }
> 
>@@ -481,7 +481,7 @@
> 
> 	*sd_size = 0;
> 
>-	if(( dst = (SEC_DESC *)talloc_zero(ctx, sizeof(SEC_DESC))) == NULL)
>+	if(( dst = TALLOC_ZERO_P(ctx, SEC_DESC)) == NULL)
> 		return NULL;
> 
> 	dst->revision = revision;
>@@ -604,7 +604,7 @@
> 
> 	if (psd == NULL) {
> 		if(UNMARSHALLING(ps)) {
>-			if((psd = (SEC_DESC *)prs_alloc_mem(ps,sizeof(SEC_DESC))) == NULL)
>+			if((psd = PRS_ALLOC_MEM( ps, SEC_DESC, 1 )) == NULL)
> 				return False;
> 			*ppsd = psd;
> 		} else {
>@@ -657,7 +657,7 @@
> 
> 		if (UNMARSHALLING(ps)) {
> 			/* reading */
>-			if((psd->owner_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->owner_sid))) == NULL)
>+			if((psd->owner_sid = PRS_ALLOC_MEM( ps, DOM_SID, 1 )) == NULL)
> 				return False;
> 		}
> 
>@@ -678,7 +678,7 @@
> 
> 		if (UNMARSHALLING(ps)) {
> 			/* reading */
>-			if((psd->grp_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->grp_sid))) == NULL)
>+			if((psd->grp_sid = PRS_ALLOC_MEM( ps, DOM_SID, 1 )) == NULL)
> 				return False;
> 		}
> 
>@@ -726,7 +726,7 @@
> {
> 	SEC_DESC_BUF *dst;
> 
>-	if((dst = (SEC_DESC_BUF *)talloc_zero(ctx, sizeof(SEC_DESC_BUF))) == NULL)
>+	if((dst = TALLOC_ZERO_P(ctx, SEC_DESC_BUF)) == NULL)
> 		return NULL;
> 
> 	/* max buffer size (allocated size) */
>@@ -772,7 +772,7 @@
> 	psdb = *ppsdb;
> 
> 	if (UNMARSHALLING(ps) && psdb == NULL) {
>-		if((psdb = (SEC_DESC_BUF *)prs_alloc_mem(ps,sizeof(SEC_DESC_BUF))) == NULL)
>+		if((psdb = PRS_ALLOC_MEM( ps, SEC_DESC_BUF, 1 )) == NULL)
> 			return False;
> 		*ppsdb = psdb;
> 	}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_spoolss.c samba-2.2.12-backport/source/rpc_parse/parse_spoolss.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_spoolss.c	2004-08-12 14:24:28.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_spoolss.c	2004-12-22 15:46:35.000000000 -0500
>@@ -266,7 +266,7 @@
> 
> 	/* reading */
> 	if (UNMARSHALLING(ps))
>-		if((ctr->type=(SPOOL_NOTIFY_OPTION_TYPE *)prs_alloc_mem(ps,ctr->count*sizeof(SPOOL_NOTIFY_OPTION_TYPE))) == NULL)
>+		if((ctr->type=PRS_ALLOC_MEM( ps, SPOOL_NOTIFY_OPTION_TYPE, ctr->count )) == NULL)
> 			return False;
> 		
> 	/* the option type struct */
>@@ -416,7 +416,7 @@
> 
> 			/* Tallocate memory for string */
> 
>-			data->notify_data.data.string = (uint16 *)prs_alloc_mem(ps, x * 2);
>+			data->notify_data.data.string = PRS_ALLOC_MEM( ps, uint16, x );
> 			if (!data->notify_data.data.string) 
> 				return False;
> 
>@@ -582,7 +582,7 @@
> 	depth++;
> 
> 	if (UNMARSHALLING(ps)) {
>-		devmode->devicename.buffer = (uint16 *)prs_alloc_mem(ps, 32 * sizeof(uint16) );
>+		devmode->devicename.buffer = PRS_ALLOC_MEM( ps, uint16, 32 );
> 		if (devmode->devicename.buffer == NULL)
> 			return False;
> 	}
>@@ -646,7 +646,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		devmode->formname.buffer = (uint16 *)prs_alloc_mem(ps, 32 * sizeof(uint16) );
>+		devmode->formname.buffer = PRS_ALLOC_MEM( ps, uint16, 32 );
> 		if (devmode->formname.buffer == NULL)
> 			return False;
> 	}
>@@ -711,7 +711,7 @@
> 
> 	if (devmode->driverextra!=0) {
> 		if (UNMARSHALLING(ps)) {
>-			devmode->private=(uint8 *)prs_alloc_mem(ps, devmode->driverextra*sizeof(uint8));
>+			devmode->private= PRS_ALLOC_MEM( ps, uint8, devmode->driverextra );
> 			if(devmode->private == NULL)
> 				return False;
> 			DEBUG(7,("spoolss_io_devmode: allocated memory [%d] for private\n",devmode->driverextra)); 
>@@ -757,7 +757,7 @@
> 	/* so we have a DEVICEMODE to follow */		
> 	if (UNMARSHALLING(ps)) {
> 		DEBUG(9,("Allocating memory for spoolss_io_devmode\n"));
>-		dm_c->devmode=(DEVICEMODE *)prs_alloc_mem(ps,sizeof(DEVICEMODE));
>+		dm_c->devmode= PRS_ALLOC_MEM( ps, DEVICEMODE, 1 );
> 		if(dm_c->devmode == NULL)
> 			return False;
> 	}
>@@ -911,7 +911,7 @@
> 	SPOOL_PRINTER_INFO_LEVEL_2 *inf;
> 
> 	/* allocate the necessary memory */
>-	if (!(inf=(SPOOL_PRINTER_INFO_LEVEL_2*)talloc(mem_ctx, sizeof(SPOOL_PRINTER_INFO_LEVEL_2)))) {
>+	if (!(inf=TALLOC_P(mem_ctx, SPOOL_PRINTER_INFO_LEVEL_2))) {
> 		DEBUG(0,("make_spoolss_printer_info_2: Unable to allocate SPOOL_PRINTER_INFO_LEVEL_2 sruct!\n"));
> 		return False;
> 	}
>@@ -1206,7 +1206,7 @@
> 		return False;
> 	
> 	if (UNMARSHALLING(ps) && r_u->size) {
>-		r_u->data = prs_alloc_mem(ps, r_u->size);
>+		r_u->data = PRS_ALLOC_MEM( ps, unsigned char, r_u->size );
> 		if(!r_u->data)
> 			return False;
> 	}
>@@ -1589,7 +1589,7 @@
> 	if (q_u->buffer_size!=0)
> 	{
> 		if (UNMARSHALLING(ps))
>-			q_u->buffer=(uint8 *)prs_alloc_mem(ps,q_u->buffer_size*sizeof(uint8));
>+			q_u->buffer=PRS_ALLOC_MEM( ps, uint8, q_u->buffer_size );
> 		if(q_u->buffer == NULL)
> 			return False;	
> 		if(!prs_uint8s(True, "buffer", ps, depth, q_u->buffer, q_u->buffer_size))
>@@ -1656,7 +1656,7 @@
> 	if (q_u->option_ptr!=0) {
> 	
> 		if (UNMARSHALLING(ps))
>-			if((q_u->option=(SPOOL_NOTIFY_OPTION *)prs_alloc_mem(ps,sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
>+			if((q_u->option= PRS_ALLOC_MEM( ps, SPOOL_NOTIFY_OPTION, 1 )) == NULL)
> 				return False;
> 	
> 		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
>@@ -1707,7 +1707,7 @@
> 	if (q_u->option_ptr!=0) {
> 	
> 		if (UNMARSHALLING(ps))
>-			if((q_u->option=(SPOOL_NOTIFY_OPTION *)prs_alloc_mem(ps,sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
>+			if((q_u->option= PRS_ALLOC_MEM( ps, SPOOL_NOTIFY_OPTION, 1 )) == NULL)
> 				return False;
> 	
> 		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
>@@ -1930,7 +1930,7 @@
> 
> 			/* Yes this should be malloc not talloc. Don't change. */
> 
>-			chaine.buffer = malloc((q-p+1)*sizeof(uint16));
>+			chaine.buffer = SMB_MALLOC_ARRAY( uint16, q-p+1 );
> 			if (chaine.buffer == NULL)
> 				return False;
> 
>@@ -1999,7 +1999,7 @@
> 
> 				/* Yes this should be realloc - it's freed below. JRA */
> 
>-				if((tc2=(uint16 *)Realloc(chaine2, realloc_size)) == NULL) {
>+				if((tc2=SMB_REALLOC_ARRAY(chaine2, uint16, l_chaine2+l_chaine+2 )) == NULL) {
> 					SAFE_FREE(chaine2);
> 					return False;
> 				}
>@@ -2015,7 +2015,7 @@
> 		if (chaine2)
> 		{
> 			chaine2[l_chaine2] = '\0';
>-			*string=(uint16 *)talloc_memdup(prs_get_mem_context(ps),chaine2,realloc_size);
>+			*string=(uint16 *)TALLOC_MEMDUP(prs_get_mem_context(ps),chaine2,realloc_size);
> 			SAFE_FREE(chaine2);
> 		}
> 
>@@ -2143,7 +2143,7 @@
> 			return False;
> 
> 		/* read the string */
>-		if((*devmode=(DEVICEMODE *)prs_alloc_mem(ps,sizeof(DEVICEMODE))) == NULL)
>+		if((*devmode= PRS_ALLOC_MEM( ps, DEVICEMODE, 1 )) == NULL)
> 			return False;
> 		if (!spoolss_io_devmode(desc, ps, depth, *devmode))
> 			return False;
>@@ -2794,7 +2794,7 @@
> 	depth++;
> 	
> 	if (UNMARSHALLING(ps))
>-		buffer = *pp_buffer = (NEW_BUFFER *)prs_alloc_mem(ps, sizeof(NEW_BUFFER));
>+		buffer = *pp_buffer = PRS_ALLOC_MEM( ps, NEW_BUFFER, 1 );
> 
> 	if (buffer == NULL)
> 		return False;
>@@ -3839,7 +3839,7 @@
> 		
> 		make_spoolss_printer_info_2 (mem_ctx, &q_u->info.info_2, info->printers_2);
> #if 1	/* JERRY TEST */
>-		q_u->secdesc_ctr = (SEC_DESC_BUF*)malloc(sizeof(SEC_DESC_BUF));
>+		q_u->secdesc_ctr = SMB_MALLOC_P(SEC_DESC_BUF);
> 		if (!q_u->secdesc_ctr)
> 			return False;
> 		q_u->secdesc_ctr->ptr = (secdesc != NULL) ? 1: 0;
>@@ -4642,7 +4642,7 @@
> 		case 1:
> 		{
> 			if (UNMARSHALLING(ps)) {
>-				if ((il->info_1=(SPOOL_PRINTER_INFO_LEVEL_1 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_INFO_LEVEL_1))) == NULL)
>+				if ((il->info_1= PRS_ALLOC_MEM( ps, SPOOL_PRINTER_INFO_LEVEL_1, 1 )) == NULL)
> 					return False;
> 			}
> 			if (!spool_io_printer_info_level_1("", il->info_1, ps, depth))
>@@ -4655,7 +4655,7 @@
> 		 */	
> 		case 2:
> 			if (UNMARSHALLING(ps)) {
>-				if ((il->info_2=(SPOOL_PRINTER_INFO_LEVEL_2 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_INFO_LEVEL_2))) == NULL)
>+				if ((il->info_2= PRS_ALLOC_MEM( ps,  SPOOL_PRINTER_INFO_LEVEL_2, 1 )) == NULL)
> 					return False;
> 			}
> 			if (!spool_io_printer_info_level_2("", il->info_2, ps, depth))
>@@ -4665,7 +4665,7 @@
> 		case 3:
> 		{
> 			if (UNMARSHALLING(ps)) {
>-				if ((il->info_3=(SPOOL_PRINTER_INFO_LEVEL_3 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_INFO_LEVEL_3))) == NULL)
>+				if ((il->info_3= PRS_ALLOC_MEM( ps, SPOOL_PRINTER_INFO_LEVEL_3, 1 )) == NULL)
> 					return False;
> 			}
> 			if (!spool_io_printer_info_level_3("", il->info_3, ps, depth))
>@@ -4772,7 +4772,7 @@
> 		
> 	/* reading */
> 	if (UNMARSHALLING(ps)) {
>-		il=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3));
>+		il= PRS_ALLOC_MEM( ps, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3, 1);
> 		if(il == NULL)
> 			return False;
> 		*q_u=il;
>@@ -4850,7 +4850,7 @@
> 		
> 	/* reading */
> 	if (UNMARSHALLING(ps)) {
>-		il=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6));
>+		il= PRS_ALLOC_MEM( ps, SPOOL_PRINTER_DRIVER_INFO_LEVEL_6, 1 );
> 		if(il == NULL)
> 			return False;
> 		*q_u=il;
>@@ -5009,7 +5009,7 @@
> 	while (src < ((char *)buf5->buffer) + buf5->buf_len*2) {
> 		unistr_to_dos(f, src, sizeof(f)-1);
> 		src = skip_unibuf(src, 2*buf5->buf_len - PTR_DIFF(src,buf5->buffer));
>-		tar = (fstring *)Realloc(*ar, sizeof(fstring)*(n+2));
>+		tar = SMB_REALLOC_ARRAY( *ar, fstring, n+2 );
> 		if (!tar)
> 			return False;
> 		else
>@@ -5123,7 +5123,7 @@
> 	BOOL		null_char = False;
> 	SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *inf;
> 
>-	if (!(inf=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3*)talloc_zero(mem_ctx, sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3))))
>+	if (!(inf=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3*)TALLOC_ZERO_P(mem_ctx, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3)))
> 		return False;
> 	
> 	inf->cversion	= info3->version;
>@@ -5186,8 +5186,7 @@
> {
> 
> 	buf5->buf_len = len;
>-	if((buf5->buffer=(uint16*)talloc_memdup(mem_ctx, src, sizeof(uint16)*len)) == NULL)
>-	{
>+	if((buf5->buffer=(uint16*)TALLOC_MEMDUP(mem_ctx, src, sizeof(uint16)*len)) == NULL) {
> 		DEBUG(0,("make_spoolss_buffer5: Unable to malloc memory for buffer!\n"));
> 		return False;
> 	}
>@@ -5249,7 +5248,7 @@
> 	
> 	if (*asc==NULL)
> 	{
>-		*asc=(NT_PRINTER_DRIVER_INFO_LEVEL_3 *)malloc(sizeof(NT_PRINTER_DRIVER_INFO_LEVEL_3));
>+		*asc=SMB_MALLOC_P(NT_PRINTER_DRIVER_INFO_LEVEL_3);
> 		if(*asc == NULL)
> 			return False;
> 		ZERO_STRUCTP(*asc);
>@@ -5296,7 +5295,7 @@
> 	
> 	if (*asc==NULL)
> 	{
>-		*asc=(NT_PRINTER_DRIVER_INFO_LEVEL_6 *)malloc(sizeof(NT_PRINTER_DRIVER_INFO_LEVEL_6));
>+		*asc=SMB_MALLOC_P(NT_PRINTER_DRIVER_INFO_LEVEL_6);
> 		if(*asc == NULL)
> 			return False;
> 		ZERO_STRUCTP(*asc);
>@@ -5349,7 +5348,7 @@
> 	if (*asc==NULL) {
> 		DEBUGADD(8,("allocating memory\n"));
> 
>-		*asc=(NT_PRINTER_INFO_LEVEL_2 *)malloc(sizeof(NT_PRINTER_INFO_LEVEL_2));
>+		*asc=SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL_2);
> 		if(*asc == NULL)
> 			return False;
> 		ZERO_STRUCTP(*asc);
>@@ -5744,7 +5743,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps) && r_u->valuesize) {
>-		r_u->value = (uint16 *)prs_alloc_mem(ps, r_u->valuesize * 2);
>+		r_u->value = PRS_ALLOC_MEM( ps, uint16, r_u->valuesize );
> 		if (!r_u->value) {
> 			DEBUG(0, ("spoolss_io_r_enumprinterdata: out of memory for printerdata value\n"));
> 			return False;
>@@ -5767,7 +5766,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps) && r_u->datasize) {
>-		r_u->data = (uint8 *)prs_alloc_mem(ps, r_u->datasize);
>+		r_u->data = PRS_ALLOC_MEM( ps, uint8, r_u->datasize );
> 		if (!r_u->data) {
> 			DEBUG(0, ("spoolss_io_r_enumprinterdata: out of memory for printerdata data\n"));
> 			return False;
>@@ -5837,7 +5836,7 @@
> 
> 	init_unistr2(&tmp, data, strlen(data)+1);
> 	q_u->max_len = q_u->real_len = tmp.uni_max_len*2;
>-	q_u->data = talloc(ctx, q_u->real_len);
>+	q_u->data = TALLOC(ctx, q_u->real_len);
> 	memcpy(q_u->data, tmp.buffer, q_u->real_len);
> 	
> 	return True;
>@@ -5874,7 +5873,7 @@
> 		case REG_MULTI_SZ:
>             if (q_u->max_len) {
>                 if (UNMARSHALLING(ps))
>-    				q_u->data=(uint8 *)prs_alloc_mem(ps, q_u->max_len * sizeof(uint8));
>+    				q_u->data= PRS_ALLOC_MEM( ps, uint8, q_u->max_len );
>     			if(q_u->data == NULL)
>     				return False;
>     			if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))
>@@ -5958,7 +5957,7 @@
> 
> 	if (*param == NULL)
> 	{
>-		*param=(NT_PRINTER_PARAM *)malloc(sizeof(NT_PRINTER_PARAM));
>+		*param=SMB_MALLOC_P(NT_PRINTER_PARAM);
> 		if(*param == NULL)
> 			return False;
> 		memset((char *)*param, '\0', sizeof(NT_PRINTER_PARAM));
>@@ -5973,7 +5972,7 @@
> 	(*param)->data_len=len;
> 	
> 	if (len) {
>-		(*param)->data=(uint8 *)malloc(len * sizeof(uint8));
>+		(*param)->data=SMB_MALLOC_ARRAY( uint8, len );
> 		if((*param)->data == NULL)
> 			return False;
> 		memcpy((*param)->data, data, len);
>@@ -6464,7 +6463,7 @@
> 		if (src->size != POINTER) 
> 			continue;
> 		len = src->notify_data.data.length;
>-		s = malloc(sizeof(uint16)*len);
>+		s = SMB_MALLOC_ARRAY(uint16, len );
> 		if (s == NULL) {
> 			DEBUG(0,("copy_spool_notify_info_data: malloc() failed!\n"));
> 			return False;
>@@ -6493,7 +6492,7 @@
> 	
> 	if (dst->count) 
> 	{
>-		dst->data = malloc(dst->count * sizeof(SPOOL_NOTIFY_INFO_DATA));
>+		dst->data = SMB_MALLOC_ARRAY( SPOOL_NOTIFY_INFO_DATA, dst->count );
> 		
> 		DEBUG(10,("copy_spool_notify_info: allocating space for [%d] PRINTER_NOTIFY_INFO_DATA entries\n",
> 			dst->count));
>@@ -6663,7 +6662,7 @@
> 		return False;
> 	
> 	if (UNMARSHALLING(ps) && r_u->size) {
>-		r_u->data = prs_alloc_mem(ps, r_u->size);
>+		r_u->data = PRS_ALLOC_MEM( ps, unsigned char, r_u->size );
> 		if(!r_u->data)
> 			return False;
> 	}
>@@ -6721,7 +6720,7 @@
> 		case 0x7:
> 			if (q_u->max_len) {
> 				if (UNMARSHALLING(ps))
>-    					q_u->data=(uint8 *)prs_alloc_mem(ps, q_u->max_len * sizeof(uint8));
>+    					q_u->data= PRS_ALLOC_MEM( ps, uint8, q_u->max_len );
>     				if(q_u->data == NULL)
>     					return False;
>     				if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))
>@@ -6861,8 +6860,7 @@
> 	/* first loop to write basic enum_value information */
> 	
> 	if (UNMARSHALLING(ps)) {
>-		ctr->values = (PRINTER_ENUM_VALUES *)prs_alloc_mem(
>-			ps, ctr->size_of_array * sizeof(PRINTER_ENUM_VALUES));
>+		ctr->values = PRS_ALLOC_MEM( ps, PRINTER_ENUM_VALUES, ctr->size_of_array );
> 		if (!ctr->values)
> 			return False;
> 	}
>@@ -6902,8 +6900,7 @@
> 			return False;
> 		
> 		if (UNMARSHALLING(ps)) {
>-			ctr->values[i].data = (uint8 *)prs_alloc_mem(
>-				ps, ctr->values[i].data_len);
>+			ctr->values[i].data = PRS_ALLOC_MEM( ps, uint8, ctr->values[i].data_len );
> 			if (!ctr->values[i].data)
> 				return False;
> 		}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_srv.c samba-2.2.12-backport/source/rpc_parse/parse_srv.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_parse/parse_srv.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_parse/parse_srv.c	2004-12-22 15:46:35.000000000 -0500
>@@ -541,7 +541,7 @@
> 		int i;
> 
> 		if (UNMARSHALLING(ps)) {
>-			if (!(info1 = (SRV_SHARE_INFO_1 *)prs_alloc_mem(ps, num_entries * sizeof(SRV_SHARE_INFO_1))))
>+			if (!(info1 = PRS_ALLOC_MEM( ps, SRV_SHARE_INFO_1, num_entries )))
> 				return False;
> 			ctr->share.info1 = info1;
> 		}
>@@ -566,7 +566,7 @@
> 		int i;
> 
> 		if (UNMARSHALLING(ps)) {
>-			if (!(info2 = (SRV_SHARE_INFO_2 *)prs_alloc_mem(ps,num_entries * sizeof(SRV_SHARE_INFO_2))))
>+			if (!(info2 = PRS_ALLOC_MEM( ps, SRV_SHARE_INFO_2, num_entries )))
> 				return False;
> 			ctr->share.info2 = info2;
> 		}
>@@ -591,8 +591,7 @@
> 		int i;
> 
> 		if (UNMARSHALLING(ps)) {
>-			if (!(info501 = (SRV_SHARE_INFO_501 *) prs_alloc_mem(ps, num_entries *
>-					sizeof (SRV_SHARE_INFO_501))))
>+			if (!(info501 = PRS_ALLOC_MEM( ps, SRV_SHARE_INFO_501, num_entries )))
> 				return False;
> 			ctr->share.info501 = info501;
> 		}
>@@ -617,7 +616,7 @@
> 		int i;
> 
> 		if (UNMARSHALLING(ps)) {
>-			if (!(info502 = (SRV_SHARE_INFO_502 *)prs_alloc_mem(ps,num_entries * sizeof(SRV_SHARE_INFO_502))))
>+			if (!(info502 = PRS_ALLOC_MEM( ps, SRV_SHARE_INFO_502, num_entries )))
> 				return False;
> 			ctr->share.info502 = info502;
> 		}
>@@ -1289,7 +1288,7 @@
> 	depth++;
> 
> 	if(UNMARSHALLING(ps)) {
>-		ctr = *pp_ctr = (SRV_SESS_INFO_CTR *)prs_alloc_mem(ps, sizeof(SRV_SESS_INFO_CTR));
>+		ctr = *pp_ctr = PRS_ALLOC_MEM(ps, SRV_SESS_INFO_CTR, 1 );
> 		if (ctr == NULL)
> 			return False;
> 	}
>@@ -1654,7 +1653,7 @@
> 	depth++;
> 
> 	if (UNMARSHALLING(ps)) {
>-		ctr = *pp_ctr = (SRV_CONN_INFO_CTR *)prs_alloc_mem(ps, sizeof(SRV_CONN_INFO_CTR));
>+		ctr = *pp_ctr = PRS_ALLOC_MEM( ps, SRV_CONN_INFO_CTR, 1 );
> 		if (ctr == NULL)
> 			return False;
> 	}
>@@ -1933,7 +1932,7 @@
> 	SRV_FILE_INFO_CTR *ctr = *pp_ctr;
> 
> 	if (UNMARSHALLING(ps)) {
>-		ctr = *pp_ctr = (SRV_FILE_INFO_CTR *)prs_alloc_mem(ps, sizeof(SRV_FILE_INFO_CTR));
>+		ctr = *pp_ctr = PRS_ALLOC_MEM(ps, SRV_FILE_INFO_CTR, 1);
> 		if (ctr == NULL)
> 			return False;
> 	}
>@@ -2407,8 +2406,7 @@
> 		return False;
> 
> 	if (UNMARSHALLING(ps)) {
>-		q_n->ctr = (SRV_INFO_CTR *)
>-			prs_alloc_mem(ps, sizeof(SRV_INFO_CTR));
>+		q_n->ctr = PRS_ALLOC_MEM( ps, SRV_INFO_CTR, 1 );
> 
> 		if (!q_n->ctr)
> 			return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_dfs_nt.c samba-2.2.12-backport/source/rpc_server/srv_dfs_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_dfs_nt.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_dfs_nt.c	2004-12-15 14:43:16.000000000 -0500
>@@ -82,8 +82,7 @@
>   else
>     jn.referral_count = 1;
> 
>-  jn.referral_list = (struct referral*) talloc(p->mem_ctx, jn.referral_count 
>-					       * sizeof(struct referral));
>+  jn.referral_list = TALLOC_ARRAY(p->mem_ctx, struct referral, jn.referral_count );
> 
>   if(jn.referral_list == NULL)
>     {
>@@ -245,8 +244,7 @@
>       dfs3[i].ptr_storages = 1;
>      
>       /* also enumerate the storages */
>-      dfs3[i].storages = (DFS_STORAGE_INFO*) talloc(ctx, j[i].referral_count * 
>-						    sizeof(DFS_STORAGE_INFO));
>+      dfs3[i].storages = TALLOC_ARRAY(ctx, DFS_STORAGE_INFO, j[i].referral_count);
>       if (!dfs3[i].storages)
>         return False;
> 
>@@ -288,7 +286,7 @@
>     case 1:
>       {
> 	DFS_INFO_1* dfs1;
>-	dfs1 = (DFS_INFO_1*) talloc(ctx, num_jn * sizeof(DFS_INFO_1));
>+	dfs1 = TALLOC_ARRAY(ctx, DFS_INFO_1, num_jn);
> 	if (!dfs1)
> 		return WERR_NOMEM;
> 	init_reply_dfs_info_1(jn, dfs1, num_jn);
>@@ -298,7 +296,7 @@
>     case 2:
>       {
> 	DFS_INFO_2* dfs2;
>-	dfs2 = (DFS_INFO_2*) talloc(ctx, num_jn * sizeof(DFS_INFO_2));
>+	dfs2 = TALLOC_ARRAY(ctx, DFS_INFO_2, num_jn);
> 	if (!dfs2)
> 		return WERR_NOMEM;
> 	init_reply_dfs_info_2(jn, dfs2, num_jn);
>@@ -308,7 +306,7 @@
>     case 3:
>       {
> 	DFS_INFO_3* dfs3;
>-	dfs3 = (DFS_INFO_3*) talloc(ctx, num_jn * sizeof(DFS_INFO_3));
>+	dfs3 = TALLOC_ARRAY(ctx, DFS_INFO_3, num_jn);
> 	if (!dfs3)
> 		return WERR_NOMEM;
> 	init_reply_dfs_info_3(ctx, jn, dfs3, num_jn);
>@@ -338,7 +336,7 @@
>   r_u->reshnd.ptr_hnd = 1;
>   r_u->reshnd.handle = num_jn;
>   
>-  r_u->ctr = (DFS_INFO_CTR*)talloc(p->mem_ctx, sizeof(DFS_INFO_CTR));
>+  r_u->ctr = TALLOC_P(p->mem_ctx, DFS_INFO_CTR);
>   if (!r_u->ctr)
>     return WERR_NOMEM;
>   ZERO_STRUCTP(r_u->ctr);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_lsa_hnd.c samba-2.2.12-backport/source/rpc_server/srv_lsa_hnd.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_lsa_hnd.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_lsa_hnd.c	2004-12-15 22:57:40.000000000 -0500
>@@ -68,7 +68,7 @@
> 		 * Create list.
> 		 */
> 
>-		if ((hl = (struct handle_list *)malloc(sizeof(struct handle_list))) == NULL)
>+		if ((hl = SMB_MALLOC_P(struct handle_list)) == NULL)
> 			return False;
> 		ZERO_STRUCTP(hl);
> 
>@@ -110,7 +110,7 @@
> 		return False;
> 	}
> 
>-	pol = (struct policy *)malloc(sizeof(*p));
>+	pol = SMB_MALLOC_P(struct policy);
> 	if (!pol) {
> 		DEBUG(0,("create_policy_hnd: ERROR: out of memory!\n"));
> 		return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_lsa_nt.c samba-2.2.12-backport/source/rpc_server/srv_lsa_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_lsa_nt.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_lsa_nt.c	2004-12-15 22:59:09.000000000 -0500
>@@ -218,14 +218,12 @@
> 	/* Allocate memory for list of names */
> 
> 	if (num_entries > 0) {
>-		if (!(trn->name = (LSA_TRANS_NAME *)talloc(ctx, sizeof(LSA_TRANS_NAME) *
>-							  num_entries))) {
>+		if (!(trn->name = TALLOC_ARRAY(ctx, LSA_TRANS_NAME, num_entries))) {
> 			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
> 			return;
> 		}
> 
>-		if (!(trn->uni_name = (UNISTR2 *)talloc(ctx, sizeof(UNISTR2) * 
>-							num_entries))) {
>+		if (!(trn->uni_name = TALLOC_ARRAY(ctx, UNISTR2, num_entries))) {
> 			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
> 			return;
> 		}
>@@ -385,7 +383,7 @@
> 			info->id2.auditing_enabled = 1;
> 			info->id2.count1 = 7;
> 			info->id2.count2 = 7;
>-			if ((info->id2.auditsettings = (uint32 *)talloc(p->mem_ctx,7*sizeof(uint32))) == NULL)
>+			if ((info->id2.auditsettings = TALLOC_ARRAY(p->mem_ctx,uint32, 7)) == NULL)
> 				return NT_STATUS_NO_MEMORY;
> 			for (i = 0; i < 7; i++)
> 				info->id2.auditsettings[i] = 3;
>@@ -482,8 +480,8 @@
> 	LSA_TRANS_NAME_ENUM *names = NULL;
> 	uint32 mapped_count = 0;
> 
>-	ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
>-	names = (LSA_TRANS_NAME_ENUM *)talloc_zero(p->mem_ctx, sizeof(LSA_TRANS_NAME_ENUM));
>+	ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
>+	names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM);
> 
> 	if (!find_policy_by_hnd(p, &q_u->pol, NULL))
> 		r_u->status = NT_STATUS_INVALID_HANDLE;
>@@ -510,8 +508,8 @@
> 	DOM_RID2 *rids;
> 	uint32 mapped_count = 0;
> 
>-	ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
>-	rids = (DOM_RID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_RID2)*MAX_LOOKUP_SIDS);
>+	ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
>+	rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, MAX_LOOKUP_SIDS);
> 
> 	if (!find_policy_by_hnd(p, &q_u->pol, NULL))
> 		r_u->status = NT_STATUS_INVALID_HANDLE;
>@@ -566,7 +564,7 @@
> 	if (enum_context >= PRIV_ALL_INDEX)
> 		return NT_STATUS_UNABLE_TO_FREE_VM;
> 
>-	entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX-enum_context));
>+	entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, PRIV_ALL_INDEX-enum_context);
> 	if (entries==NULL)
> 		return NT_STATUS_NO_MEMORY;
> 
>@@ -663,7 +661,7 @@
> 		return NT_STATUS_INVALID_HANDLE;
> 
> 	/* associate the user/group SID with the (unique) handle. */
>-	if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
>+	if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(info);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_netlog_nt.c samba-2.2.12-backport/source/rpc_server/srv_netlog_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_netlog_nt.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_netlog_nt.c	2004-12-15 14:43:16.000000000 -0500
>@@ -573,7 +573,7 @@
> 	BOOL ret;
> 	uint16 acct_ctrl;
>    
>-	usr_info = (NET_USER_INFO_3 *)talloc(p->mem_ctx, sizeof(NET_USER_INFO_3));
>+	usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
> 	if (!usr_info)
> 		return NT_STATUS_NO_MEMORY;
> 	ZERO_STRUCTP(usr_info);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_pipe.c samba-2.2.12-backport/source/rpc_server/srv_pipe.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_pipe.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_pipe.c	2004-12-15 23:15:42.000000000 -0500
>@@ -1260,7 +1260,7 @@
> 			p->in_data.data.data_offset;
> 		char *data;
> 
>-		data = malloc(data_len);
>+		data = SMB_MALLOC(data_len);
> 
> 		DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
> 		if (data) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_pipe_hnd.c samba-2.2.12-backport/source/rpc_server/srv_pipe_hnd.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_pipe_hnd.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_pipe_hnd.c	2004-12-15 22:59:09.000000000 -0500
>@@ -169,7 +169,7 @@
> 	for (p = Pipes; p; p = p->next)
> 		DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));  
> 
>-	p = (pipes_struct *)malloc(sizeof(*p));
>+	p = SMB_MALLOC_P(pipes_struct);
> 
> 	if (!p)
> 		return NULL;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_reg_nt.c samba-2.2.12-backport/source/rpc_server/srv_reg_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_reg_nt.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_reg_nt.c	2004-12-15 23:02:04.000000000 -0500
>@@ -92,7 +92,7 @@
> 	    !strequal(name, "System\\CurrentControlSet\\services\\Netlogon\\parameters\\"))
> 			return NT_STATUS_ACCESS_DENIED;
> 
>-	if ((info = (struct reg_info *)malloc(sizeof(struct reg_info))) == NULL)
>+	if ((info = SMB_MALLOC_P(struct reg_info)) == NULL)
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(info);
>@@ -131,8 +131,8 @@
> 
> 	DEBUG(5,("reg_info: checking key: %s\n", name));
> 
>-	uni_key = (UNISTR2 *)talloc_zero(p->mem_ctx, sizeof(UNISTR2));
>-	buf = (BUFFER2 *)talloc_zero(p->mem_ctx, sizeof(BUFFER2));
>+	uni_key = TALLOC_ZERO_P(p->mem_ctx, UNISTR2);
>+	buf = TALLOC_ZERO_P(p->mem_ctx, BUFFER2);
> 
> 	if (!uni_key || !buf)
> 		return NT_STATUS_NO_MEMORY;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_samr_nt.c samba-2.2.12-backport/source/rpc_server/srv_samr_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_samr_nt.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_samr_nt.c	2004-12-16 15:50:23.000000000 -0500
>@@ -64,7 +64,7 @@
> 	struct samr_info *info;
> 	fstring sid_str;
> 
>-	if ((info = (struct samr_info *)malloc(sizeof(struct samr_info))) == NULL)
>+	if ((info = SMB_MALLOC_P(struct samr_info)) == NULL)
> 		return NULL;
> 
> 	ZERO_STRUCTP(info);
>@@ -175,8 +175,8 @@
> 		if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) {
> 		
> 			DEBUG(10,("load_sampwd_entries: allocating more memory\n"));
>-			pwd_array=(DISP_USER_INFO *)Realloc(info->disp_info.disp_user_info, 
>-			                  (info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(DISP_USER_INFO));
>+			pwd_array= SMB_REALLOC_ARRAY(info->disp_info.disp_user_info, DISP_USER_INFO,
>+			                  info->disp_info.num_user_account+MAX_SAM_ENTRIES );
> 
> 			if (pwd_array==NULL)
> 				return NT_STATUS_NO_MEMORY;
>@@ -214,7 +214,7 @@
> 	static BOOL group_map_init;
> 	extern DOM_SID global_sam_sid;
> 
>-	*ret_map = (GROUP_MAP *)malloc(sizeof(GROUP_MAP)*2);
>+	*ret_map = SMB_MALLOC_ARRAY(GROUP_MAP, 2);
> 	if (!ret_map)
> 		return 2;
> 	
>@@ -268,7 +268,7 @@
> 
> 	info->disp_info.num_group_account=group_entries;
> 
>-	grp_array=(DISP_GROUP_INFO *)malloc(info->disp_info.num_group_account*sizeof(DISP_GROUP_INFO));
>+	grp_array=SMB_MALLOC_ARRAY( DISP_GROUP_INFO, info->disp_info.num_group_account );
> 
> 	if (group_entries!=0 && grp_array==NULL) {
> 		return NT_STATUS_NO_MEMORY;
>@@ -278,7 +278,7 @@
> 
> 	for (i=0; i<group_entries; i++) {
> 	
>-		grp_array[i].grp=(DOMAIN_GRP *)malloc(sizeof(DOMAIN_GRP));
>+		grp_array[i].grp=SMB_MALLOC_P(DOMAIN_GRP);
> 	
> 		fstrcpy(grp_array[i].grp->name, map[i].nt_name);
> 		fstrcpy(grp_array[i].grp->comment, map[i].comment);
>@@ -557,9 +557,9 @@
> 	if (num_sam_entries == 0)
> 		return;
> 
>-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
>+	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
> 
>-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
>+	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
> 
> 	if (sam == NULL || uni_name == NULL) {
> 		DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
>@@ -644,9 +644,9 @@
> 	if (num_sam_entries == 0)
> 		return;
> 
>-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
>+	sam = TALLOC_ZERO_ARRAY(ctx,SAM_ENTRY, num_sam_entries);
> 
>-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
>+	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
> 
> 	if (sam == NULL || uni_name == NULL) {
> 		DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
>@@ -982,7 +982,7 @@
> 		DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to only %d entries\n", max_entries));
> 	}
> 
>-	if (!(ctr = (SAM_DISPINFO_CTR *)talloc_zero(p->mem_ctx,sizeof(SAM_DISPINFO_CTR))))
>+	if (!(ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_DISPINFO_CTR)))
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(ctr);
>@@ -991,7 +991,7 @@
> 	switch (q_u->switch_level) {
> 	case 0x1:
> 		if (max_entries) {
>-			if (!(ctr->sam.info1 = (SAM_DISPINFO_1 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_1))))
>+			if (!(ctr->sam.info1 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_1, max_entries)))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context, info->disp_info.disp_user_info);
>@@ -1000,7 +1000,7 @@
> 		break;
> 	case 0x2:
> 		if (max_entries) {
>-			if (!(ctr->sam.info2 = (SAM_DISPINFO_2 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_2))))
>+			if (!(ctr->sam.info2 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_2,max_entries)))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context, info->disp_info.disp_user_info);
>@@ -1009,7 +1009,7 @@
> 		break;
> 	case 0x3:
> 		if (max_entries) {
>-			if (!(ctr->sam.info3 = (SAM_DISPINFO_3 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_3))))
>+			if (!(ctr->sam.info3 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_3,max_entries)))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_3(p->mem_ctx, ctr->sam.info3, max_entries, enum_context, info->disp_info.disp_group_info);
>@@ -1018,7 +1018,7 @@
> 		break;
> 	case 0x4:
> 		if (max_entries) {
>-			if (!(ctr->sam.info4 = (SAM_DISPINFO_4 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_4))))
>+			if (!(ctr->sam.info4 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_4,max_entries)))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_4(p->mem_ctx, ctr->sam.info4, max_entries, enum_context, info->disp_info.disp_user_info);
>@@ -1027,7 +1027,7 @@
> 		break;
> 	case 0x5:
> 		if (max_entries) {
>-			if (!(ctr->sam.info5 = (SAM_DISPINFO_5 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_5))))
>+			if (!(ctr->sam.info5 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_5,max_entries)))
> 				return NT_STATUS_NO_MEMORY;
> 		}
> 		disp_ret = init_sam_dispinfo_5(p->mem_ctx, ctr->sam.info5, max_entries, enum_context, info->disp_info.disp_group_info);
>@@ -1287,11 +1287,11 @@
> 	*pp_hdr_name = NULL;
> 
> 	if (num_names != 0) {
>-		hdr_name = (UNIHDR *)talloc_zero(ctx, sizeof(UNIHDR)*num_names);
>+		hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR,num_names);
> 		if (hdr_name == NULL)
> 			return False;
> 
>-		uni_name = (UNISTR2 *)talloc_zero(ctx,sizeof(UNISTR2)*num_names);
>+		uni_name = TALLOC_ZERO_ARRAY(ctx,UNISTR2,num_names);
> 		if (uni_name == NULL)
> 			return False;
> 	}
>@@ -1337,7 +1337,7 @@
> 	}
> 
> 	if (num_rids) {
>-		if ((group_attrs = (uint32 *)talloc_zero(p->mem_ctx, num_rids * sizeof(uint32))) == NULL)
>+		if ((group_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids)) == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 	}
> 
>@@ -1610,7 +1610,7 @@
> 
> 	DEBUG(5,("_samr_query_userinfo: rid:0x%x\n", rid));
> 
>-	ctr = (SAM_USERINFO_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_USERINFO_CTR));
>+	ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_USERINFO_CTR);
> 	if (!ctr)
> 		return NT_STATUS_NO_MEMORY;
> 
>@@ -1621,7 +1621,7 @@
> 
> 	switch (q_u->switch_value) {
> 	case 0x10:
>-		ctr->info.id10 = (SAM_USER_INFO_10 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_10));
>+		ctr->info.id10 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_10);
> 		if (ctr->info.id10 == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 
>@@ -1639,11 +1639,7 @@
>             expire.low = 0xffffffff;
>             expire.high = 0x7fffffff;
> 
>-            ctr->info.id = (SAM_USER_INFO_11 *)talloc_zero(p->mem_ctx,
>-                                    sizeof
>-                                    (*ctr->
>-                                     info.
>-                                     id11));
>+            ctr->info.id = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_11);
>             init_sam_user_info11(ctr->info.id11, &expire,
>                          "BROOKFIELDS$",    /* name */
>                          0x03ef,    /* user rid */
>@@ -1655,7 +1651,7 @@
> #endif
> 
> 	case 0x12:
>-		ctr->info.id12 = (SAM_USER_INFO_12 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_12));
>+		ctr->info.id12 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_12);
> 		if (ctr->info.id12 == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 
>@@ -1664,7 +1660,7 @@
> 		break;
> 
> 	case 20:
>-		ctr->info.id20 = (SAM_USER_INFO_20 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_20));
>+		ctr->info.id20 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_20);
> 		if (ctr->info.id20 == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 		if (!get_user_info_20(ctr->info.id20, rid))
>@@ -1672,7 +1668,7 @@
> 		break;
> 
> 	case 21:
>-		ctr->info.id21 = (SAM_USER_INFO_21 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_21));
>+		ctr->info.id21 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_21);
> 		if (ctr->info.id21 == NULL)
> 			return NT_STATUS_NO_MEMORY;
> 		if (!get_user_info_21(ctr->info.id21, rid))
>@@ -1764,7 +1760,7 @@
> 
> 	uint32 num_users=0, num_groups=0, num_aliases=0;
> 
>-	if ((ctr = (SAM_UNK_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_UNK_CTR))) == NULL)
>+	if ((ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_UNK_CTR)) == NULL)
> 		return NT_STATUS_NO_MEMORY;
> 
> 	ZERO_STRUCTP(ctr);
>@@ -2073,8 +2069,8 @@
> 	if (num_sam_entries == 0)
> 		return True;
> 
>-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
>-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
>+	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
>+	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
> 
> 	if (sam == NULL || uni_name == NULL)
> 		return False;
>@@ -2603,7 +2599,7 @@
> 	int num_rids;
> 
> 	num_rids = 1;
>-	rid=(uint32 *)talloc_zero(p->mem_ctx, num_rids*sizeof(uint32));
>+	rid=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
> 	if (rid == NULL)
> 		return NT_STATUS_NO_MEMORY;
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_spoolss_nt.c samba-2.2.12-backport/source/rpc_server/srv_spoolss_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_spoolss_nt.c	2004-08-12 14:31:57.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_spoolss_nt.c	2004-12-16 15:50:23.000000000 -0500
>@@ -233,7 +233,7 @@
> 	if (!sp)
> 		return NULL;
> 
>-	new_sp = (SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION));
>+	new_sp = SMB_MALLOC_P(SPOOL_NOTIFY_OPTION);
> 	if (!new_sp)
> 		return NULL;
> 
>@@ -494,7 +494,7 @@
> 
> 	DEBUG(10,("open_printer_hnd: name [%s]\n", name));
> 
>-	if((new_printer=(Printer_entry *)malloc(sizeof(Printer_entry))) == NULL)
>+	if((new_printer=SMB_MALLOC_P(Printer_entry)) == NULL)
> 		return False;
> 
> 	ZERO_STRUCTP(new_printer);
>@@ -872,7 +872,7 @@
> 	
> 	/* bulk copy first */
> 	
>-	d = talloc_memdup(ctx, devmode, sizeof(DEVICEMODE));
>+	d = TALLOC_MEMDUP(ctx, devmode, sizeof(DEVICEMODE));
> 	if (!d)
> 		return NULL;
> 		
>@@ -880,7 +880,7 @@
> 	
> 	len = unistrlen(devmode->devicename.buffer);
> 	if (len != -1) {
>-		d->devicename.buffer = talloc(ctx, len*2);
>+		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
> 		if (unistrcpy(d->devicename.buffer, devmode->devicename.buffer) != len)
> 			return NULL;
> 	}
>@@ -888,12 +888,12 @@
> 
> 	len = unistrlen(devmode->formname.buffer);
> 	if (len != -1) {
>-		d->devicename.buffer = talloc(ctx, len*2);
>+		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
> 		if (unistrcpy(d->formname.buffer, devmode->formname.buffer) != len)
> 			return NULL;
> 	}
> 
>-	d->private = talloc_memdup(ctx, devmode->private, devmode->driverextra);
>+	d->private = TALLOC_MEMDUP(ctx, devmode->private, devmode->driverextra);
> 	
> 	return d;
> }
>@@ -1305,7 +1305,7 @@
> 	if ((devmode->driverextra != 0) && (devmode->private != NULL)) {
> 		SAFE_FREE(nt_devmode->private);
> 		nt_devmode->driverextra=devmode->driverextra;
>-		if((nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8))) == NULL)
>+		if((nt_devmode->private=SMB_MALLOC_ARRAY(uint8, nt_devmode->driverextra)) == NULL)
> 			return False;
> 		memcpy(nt_devmode->private, devmode->private, nt_devmode->driverextra);
> 	}
>@@ -1521,7 +1521,7 @@
> 		
> 	if (!strcmp(value, "W3SvcInstalled")) {
> 		*type = 0x4;
>-		if((*data = (uint8 *)talloc_zero(ctx, 4*sizeof(uint8) )) == NULL)
>+		if((*data = (uint8 *)TALLOC_ZERO(ctx, 4*sizeof(uint8) )) == NULL)
> 			return False;
> 		*needed = 0x4;			
> 		return True;
>@@ -1529,7 +1529,7 @@
> 
> 	if (!strcmp(value, "BeepEnabled")) {
> 		*type = 0x4;
>-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
>+		if((*data = (uint8 *)TALLOC(ctx, 4*sizeof(uint8) )) == NULL)
> 			return False;
> 		SIVAL(*data, 0, 0x00);
> 		*needed = 0x4;			
>@@ -1538,7 +1538,7 @@
> 
> 	if (!strcmp(value, "EventLog")) {
> 		*type = 0x4;
>-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
>+		if((*data = (uint8 *)TALLOC(ctx, 4*sizeof(uint8) )) == NULL)
> 			return False;
> 		/* formally was 0x1b */
> 		SIVAL(*data, 0, 0x0);
>@@ -1548,7 +1548,7 @@
> 
> 	if (!strcmp(value, "NetPopup")) {
> 		*type = 0x4;
>-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
>+		if((*data = (uint8 *)TALLOC(ctx, 4*sizeof(uint8) )) == NULL)
> 			return False;
> 		SIVAL(*data, 0, 0x00);
> 		*needed = 0x4;
>@@ -1557,7 +1557,7 @@
> 
> 	if (!strcmp(value, "MajorVersion")) {
> 		*type = 0x4;
>-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
>+		if((*data = (uint8 *)TALLOC(ctx, 4*sizeof(uint8) )) == NULL)
> 			return False;
> #ifndef EMULATE_WIN2K_HACK /* JERRY */
> 		SIVAL(*data, 0, 2);
>@@ -1574,7 +1574,7 @@
> 		fstrcpy(string, string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH));
> 		*type = 0x1;			
> 		*needed = 2*(strlen(string)+1);		
>-		if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
>+		if((*data  = (uint8 *)TALLOC(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
> 			return False;
> 		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
> 		
>@@ -1590,7 +1590,7 @@
> 		pstring string="Windows NT x86";
> 		*type = 0x1;			
> 		*needed = 2*(strlen(string)+1);	
>-		if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
>+		if((*data  = (uint8 *)TALLOC(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
> 			return False;
> 		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
> 		for (i=0; i<strlen(string); i++) {
>@@ -1640,7 +1640,7 @@
> 	DEBUG(5,("getprinterdata_printer:allocating %d\n", in_size));
> 
> 	if (in_size) {
>-		if((*data  = (uint8 *)talloc(ctx, in_size *sizeof(uint8) )) == NULL) {
>+		if((*data  = TALLOC_ARRAY(ctx, uint8, in_size )) == NULL) {
> 			return False;
> 		}
> 
>@@ -1694,7 +1694,7 @@
> 	DEBUG(4,("_spoolss_getprinterdata\n"));
> 	
> 	if (!Printer) {
>-		if((*data=(uint8 *)talloc_zero(p->mem_ctx, 4*sizeof(uint8))) == NULL)
>+		if((*data=TALLOC_ZERO_ARRAY(p->mem_ctx, uint8, 4)) == NULL)
> 			return WERR_NOMEM;
> 		DEBUG(2,("_spoolss_getprinterdata: Invalid handle (%s:%u:%u).\n", OUR_HANDLE(handle)));
> 		return WERR_BADFID;
>@@ -1711,7 +1711,7 @@
> 		DEBUG(5, ("value not found, allocating %d\n", *out_size));
> 		/* reply this param doesn't exist */
> 		if (*out_size) {
>-			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
>+			if((*data=TALLOC_ZERO_ARRAY(p->mem_ctx, uint8, *out_size)) == NULL)
> 				return WERR_NOMEM;
> 		} else {
> 			*data = NULL;
>@@ -1837,7 +1837,7 @@
> 	len = (uint32)dos_PutUniCode(temp, temp_name, sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -1872,7 +1872,7 @@
> 	len = (uint32)dos_PutUniCode(temp, p, sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -1899,7 +1899,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -1928,7 +1928,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -1956,7 +1956,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -1987,7 +1987,7 @@
> 					     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2015,7 +2015,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2055,7 +2055,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2083,7 +2083,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2111,7 +2111,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2139,7 +2139,7 @@
> 				     sizeof(pstring) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2300,7 +2300,7 @@
> 				     sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2341,7 +2341,7 @@
> 				     True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2391,7 +2391,7 @@
> 	len = (uint32)dos_PutUniCode(temp, p, sizeof(temp) - 2, True);
> 
> 	data->notify_data.data.length = len / 2 - 1;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 	
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2489,7 +2489,7 @@
> 	len = sizeof(SYSTEMTIME);
> 
> 	data->notify_data.data.length = len;
>-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
>+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
> 
> 	if (!data->notify_data.data.string) {
> 		data->notify_data.data.length = 0;
>@@ -2704,7 +2704,7 @@
> 		if (!search_notify(type, field, &j) )
> 			continue;
> 
>-		if((tid=(SPOOL_NOTIFY_INFO_DATA *)Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
>+		if((tid=SMB_REALLOC_ARRAY( info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1 )) == NULL) {
> 			DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n"));
> 			return False;
> 		}
>@@ -2760,7 +2760,7 @@
> 		if (!search_notify(type, field, &j) )
> 			continue;
> 
>-		if((tid=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
>+		if((tid=SMB_REALLOC_ARRAY( info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1 )) == NULL) {
> 			DEBUG(2,("construct_notify_jobs_info: failed to enlarg buffer info->data!\n"));
> 			return False;
> 		}
>@@ -3040,7 +3040,7 @@
> 
> 	/* it's the first time, add it to the list */
> 	if (session_counter==NULL) {
>-		if((session_counter=(counter_printer_0 *)malloc(sizeof(counter_printer_0))) == NULL) {
>+		if((session_counter=SMB_MALLOC_P(counter_printer_0)) == NULL) {
> 			free_a_printer(&ntprinter, 2);
> 			return False;
> 		}
>@@ -3184,7 +3184,7 @@
> 	
> 	DEBUGADD(8,("getting printer characteristics\n"));
> 
>-	if ((devmode = (DEVICEMODE *)malloc(sizeof(DEVICEMODE))) == NULL) {
>+	if ((devmode = SMB_MALLOC_P(DEVICEMODE)) == NULL) {
> 		DEBUG(2,("construct_dev_mode: malloc fail.\n"));
> 		return NULL;
> 	}
>@@ -3330,7 +3330,7 @@
> 		return False;
> 
> 	*pp_printer = NULL;
>-	if ((printer = (PRINTER_INFO_3 *)malloc(sizeof(PRINTER_INFO_3))) == NULL) {
>+	if ((printer = SMB_MALLOC_P(PRINTER_INFO_3)) == NULL) {
> 		DEBUG(2,("construct_printer_info_3: malloc fail.\n"));
> 		return False;
> 	}
>@@ -3432,7 +3432,7 @@
> 			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
> 
> 			if (construct_printer_info_1(flags, &current_prt, snum)) {
>-				if((tp=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_1))) == NULL) {
>+				if((tp=SMB_REALLOC_ARRAY( printers, PRINTER_INFO_1, *returned +1 )) == NULL) {
> 					DEBUG(2,("enum_all_printers_info_1: failed to enlarge printers buffer!\n"));
> 					SAFE_FREE(printers);
> 					*returned=0;
>@@ -3519,7 +3519,7 @@
> 	 * We should have a TDB here. The registration is done thru an undocumented RPC call.
> 	 */
> 	
>-	if((printer=(PRINTER_INFO_1 *)malloc(sizeof(PRINTER_INFO_1))) == NULL)
>+	if((printer=SMB_MALLOC_P(PRINTER_INFO_1)) == NULL)
> 		return WERR_NOMEM;
> 
> 	*returned=1;
>@@ -3601,7 +3601,7 @@
> 			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
> 				
> 			if (construct_printer_info_2(&current_prt, snum)) {
>-				if((tp=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_2))) == NULL) {
>+				if((tp=SMB_REALLOC_ARRAY( printers, PRINTER_INFO_2, *returned +1 )) == NULL) {
> 					DEBUG(2,("enum_all_printers_info_2: failed to enlarge printers buffer!\n"));
> 					SAFE_FREE(printers);
> 					*returned = 0;
>@@ -3775,7 +3775,7 @@
> {
> 	PRINTER_INFO_0 *printer=NULL;
> 
>-	if((printer=(PRINTER_INFO_0*)malloc(sizeof(PRINTER_INFO_0))) == NULL)
>+	if((printer=SMB_MALLOC_P(PRINTER_INFO_0)) == NULL)
> 		return WERR_NOMEM;
> 
> 	construct_printer_info_0(printer, snum);
>@@ -3808,7 +3808,7 @@
> {
> 	PRINTER_INFO_1 *printer=NULL;
> 
>-	if((printer=(PRINTER_INFO_1*)malloc(sizeof(PRINTER_INFO_1))) == NULL)
>+	if((printer=SMB_MALLOC_P(PRINTER_INFO_1)) == NULL)
> 		return WERR_NOMEM;
> 
> 	construct_printer_info_1(PRINTER_ENUM_ICON8, printer, snum);
>@@ -3841,7 +3841,7 @@
> {
> 	PRINTER_INFO_2 *printer=NULL;
> 
>-	if((printer=(PRINTER_INFO_2*)malloc(sizeof(PRINTER_INFO_2)))==NULL)
>+	if((printer=SMB_MALLOC_P(PRINTER_INFO_2))==NULL)
> 		return WERR_NOMEM;
> 	
> 	construct_printer_info_2(printer, snum);
>@@ -3908,7 +3908,7 @@
> {
> 	PRINTER_INFO_4 *printer=NULL;
> 
>-	if((printer=(PRINTER_INFO_4*)malloc(sizeof(PRINTER_INFO_4)))==NULL)
>+	if((printer=SMB_MALLOC_P(PRINTER_INFO_4))==NULL)
> 		return WERR_NOMEM;
> 
> 	if (!construct_printer_info_4(printer, snum))
>@@ -3942,7 +3942,7 @@
> {
> 	PRINTER_INFO_5 *printer=NULL;
> 
>-	if((printer=(PRINTER_INFO_5*)malloc(sizeof(PRINTER_INFO_5)))==NULL)
>+	if((printer=SMB_MALLOC_P(PRINTER_INFO_5))==NULL)
> 		return WERR_NOMEM;
> 
> 	if (!construct_printer_info_5(printer, snum))
>@@ -4128,7 +4128,7 @@
> 		if (strlen(v) == 0) break;
> 		slprintf(line, sizeof(line)-1, "\\\\%s%s", servername, v);
> 		DEBUGADD(6,("%d:%s:%d\n", i, line, strlen(line)));
>-		if((tuary=Realloc(*uni_array, (j+strlen(line)+2)*sizeof(uint16))) == NULL) {
>+		if((tuary= SMB_REALLOC_ARRAY( *uni_array, uint16, j+strlen(line)+2 )) == NULL) {
> 			DEBUG(2,("init_unistr_array: Realloc error\n" ));
> 			return;
> 		} else
>@@ -4385,7 +4385,7 @@
> 	DRIVER_INFO_1 *info=NULL;
> 	WERROR status;
> 	
>-	if((info=(DRIVER_INFO_1 *)malloc(sizeof(DRIVER_INFO_1))) == NULL)
>+	if((info=SMB_MALLOC_P(DRIVER_INFO_1)) == NULL)
> 		return WERR_NOMEM;
> 	
> 	status=construct_printer_driver_info_1(info, snum, servername, architecture, version);
>@@ -4422,7 +4422,7 @@
> 	DRIVER_INFO_2 *info=NULL;
> 	WERROR status;
> 	
>-	if((info=(DRIVER_INFO_2 *)malloc(sizeof(DRIVER_INFO_2))) == NULL)
>+	if((info=SMB_MALLOC_P(DRIVER_INFO_2)) == NULL)
> 		return WERR_NOMEM;
> 	
> 	status=construct_printer_driver_info_2(info, snum, servername, architecture, version);
>@@ -5541,7 +5541,7 @@
> 	JOB_INFO_1 *info;
> 	int i;
> 	
>-	info=(JOB_INFO_1 *)malloc(*returned*sizeof(JOB_INFO_1));
>+	info=SMB_MALLOC_ARRAY(JOB_INFO_1, *returned);
> 	if (info==NULL) {
> 		SAFE_FREE(queue);
> 		*returned=0;
>@@ -5591,7 +5591,7 @@
> 	WERROR result;
> 	DEVICEMODE *devmode = NULL;
> 	
>-	info=(JOB_INFO_2 *)malloc(*returned*sizeof(JOB_INFO_2));
>+	info=SMB_MALLOC_ARRAY(JOB_INFO_2, *returned );
> 	if (info==NULL) {
> 		*returned=0;
> 		result = WERR_NOMEM;
>@@ -5783,7 +5783,7 @@
> 			return WERR_NOMEM;
> 
> 		if(ndrivers != 0) {
>-			if((tdi1=(DRIVER_INFO_1 *)Realloc(driver_info_1, (*returned+ndrivers) * sizeof(DRIVER_INFO_1))) == NULL) {
>+			if((tdi1=SMB_REALLOC_ARRAY(driver_info_1, DRIVER_INFO_1, *returned+ndrivers )) == NULL) {
> 				DEBUG(0,("enumprinterdrivers_level1: failed to enlarge driver info buffer!\n"));
> 				SAFE_FREE(driver_info_1);
> 				SAFE_FREE(list);
>@@ -5864,7 +5864,7 @@
> 			return WERR_NOMEM;
> 
> 		if(ndrivers != 0) {
>-			if((tdi2=(DRIVER_INFO_2 *)Realloc(driver_info_2, (*returned+ndrivers) * sizeof(DRIVER_INFO_2))) == NULL) {
>+			if((tdi2= SMB_REALLOC_ARRAY( driver_info_2, DRIVER_INFO_2, *returned+ndrivers )) == NULL) {
> 				DEBUG(0,("enumprinterdrivers_level2: failed to enlarge driver info buffer!\n"));
> 				SAFE_FREE(driver_info_2);
> 				SAFE_FREE(list);
>@@ -5946,7 +5946,7 @@
> 			return WERR_NOMEM;
> 
> 		if(ndrivers != 0) {
>-			if((tdi3=(DRIVER_INFO_3 *)Realloc(driver_info_3, (*returned+ndrivers) * sizeof(DRIVER_INFO_3))) == NULL) {
>+			if((tdi3=SMB_REALLOC_ARRAY( driver_info_3, DRIVER_INFO_3, *returned+ndrivers )) == NULL) {
> 				DEBUG(0,("enumprinterdrivers_level3: failed to enlarge driver info buffer!\n"));
> 				SAFE_FREE(driver_info_3);
> 				SAFE_FREE(list);
>@@ -6099,7 +6099,7 @@
> 
> 	switch (level) {
> 	case 1:
>-		if ((forms_1=(FORM_1 *)malloc(*numofforms * sizeof(FORM_1))) == NULL) {
>+		if ((forms_1=SMB_MALLOC_ARRAY(FORM_1, *numofforms)) == NULL) {
> 			*numofforms=0;
> 			return WERR_NOMEM;
> 		}
>@@ -6305,7 +6305,7 @@
> 		close(fd);
> 
> 		if(numlines) {
>-			if((ports=(PORT_INFO_1 *)malloc( numlines * sizeof(PORT_INFO_1) )) == NULL) {
>+			if((ports=SMB_MALLOC_ARRAY( PORT_INFO_1, numlines )) == NULL) {
> 				DEBUG(10,("Returning WERR_NOMEM [%s]\n", 
> 					  dos_errstr(WERR_NOMEM)));
> 				file_lines_free(qlines);
>@@ -6325,7 +6325,7 @@
> 	} else {
> 		*returned = 1; /* Sole Samba port returned. */
> 
>-		if((ports=(PORT_INFO_1 *)malloc( sizeof(PORT_INFO_1) )) == NULL)
>+		if((ports=SMB_MALLOC_P(PORT_INFO_1)) == NULL)
> 			return WERR_NOMEM;
> 	
> 		DEBUG(10,("enumports_level_1: port name %s\n", SAMBA_PRINTER_PORT_NAME));
>@@ -6404,7 +6404,7 @@
> 		close(fd);
> 
> 		if(numlines) {
>-			if((ports=(PORT_INFO_2 *)malloc( numlines * sizeof(PORT_INFO_2) )) == NULL) {
>+			if((ports=SMB_MALLOC_ARRAY( PORT_INFO_2, numlines )) == NULL) {
> 				file_lines_free(qlines);
> 				return WERR_NOMEM;
> 			}
>@@ -6423,7 +6423,7 @@
> 
> 		*returned = 1;
> 
>-		if((ports=(PORT_INFO_2 *)malloc( sizeof(PORT_INFO_2) )) == NULL)
>+		if((ports=SMB_MALLOC_P(PORT_INFO_2)) == NULL)
> 			return WERR_NOMEM;
> 	
> 		DEBUG(10,("enumports_level_2: port name %s\n", SAMBA_PRINTER_PORT_NAME));
>@@ -6504,7 +6504,7 @@
> 	int	snum;
> 	WERROR err = WERR_OK;
> 
>-	if ((printer = (NT_PRINTER_INFO_LEVEL *)malloc(sizeof(NT_PRINTER_INFO_LEVEL))) == NULL) {
>+	if ((printer = SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL)) == NULL) {
> 		DEBUG(0,("spoolss_addprinterex_level_2: malloc fail.\n"));
> 		return WERR_NOMEM;
> 	}
>@@ -6787,7 +6787,7 @@
> 	if (get_short_archi(short_archi, long_archi)==False)
> 		return WERR_INVALID_ENVIRONMENT;
> 
>-	if((info=(DRIVER_DIRECTORY_1 *)malloc(sizeof(DRIVER_DIRECTORY_1))) == NULL)
>+	if((info=SMB_MALLOC_P(DRIVER_DIRECTORY_1)) == NULL)
> 		return WERR_NOMEM;
> 
> 	slprintf(path, sizeof(path)-1, "\\\\%s\\print$\\%s", get_called_name(), short_archi);
>@@ -6942,7 +6942,7 @@
> 		   problems unmarshalling the response */
> 
> 		*out_max_value_len=(in_value_len/sizeof(uint16));
>-		if((*out_value=(uint16 *)talloc_zero(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL)
>+		if((*out_value=(uint16 *)TALLOC_ZERO(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL)
> 			return WERR_NOMEM;
> 
> 		*out_value_len = (uint32)dos_PutUniCode((char *)*out_value, "", in_value_len, True);
>@@ -6950,7 +6950,7 @@
> 		/* the data is counted in bytes */
> 		*out_max_data_len = in_data_len;
> 		*out_data_len = in_data_len;
>-		if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL)
>+		if((*data_out=(uint8 *)TALLOC_ZERO(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL)
> 			return WERR_NOMEM;
> 
> 		return WERR_NO_MORE_ITEMS;
>@@ -6968,7 +6968,7 @@
> 	 */
> 	
> 	*out_max_value_len=(in_value_len/sizeof(uint16));
>-	if((*out_value=(uint16 *)talloc_zero(p->mem_ctx,in_value_len*sizeof(uint8))) == NULL) {
>+	if((*out_value=(uint16 *)TALLOC_ZERO(p->mem_ctx,in_value_len*sizeof(uint8))) == NULL) {
> 		SAFE_FREE(data);
> 		return WERR_NOMEM;
> 	}
>@@ -6979,7 +6979,7 @@
> 
> 	/* the data is counted in bytes */
> 	*out_max_data_len=in_data_len;
>-	if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) {
>+	if((*data_out=(uint8 *)TALLOC_ZERO(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) {
> 		SAFE_FREE(data);
> 		return WERR_NOMEM;
> 	}
>@@ -7366,7 +7366,7 @@
> {
> 	PRINTPROCESSOR_1 *info_1=NULL;
> 	
>-	if((info_1 = (PRINTPROCESSOR_1 *)malloc(sizeof(PRINTPROCESSOR_1))) == NULL)
>+	if((info_1 = SMB_MALLOC_P(PRINTPROCESSOR_1)) == NULL)
> 		return WERR_NOMEM;
> 
> 	(*returned) = 0x1;
>@@ -7435,7 +7435,7 @@
> {
> 	PRINTPROCDATATYPE_1 *info_1=NULL;
> 	
>-	if((info_1 = (PRINTPROCDATATYPE_1 *)malloc(sizeof(PRINTPROCDATATYPE_1))) == NULL)
>+	if((info_1 = SMB_MALLOC_P(PRINTPROCDATATYPE_1)) == NULL)
> 		return WERR_NOMEM;
> 
> 	(*returned) = 0x1;
>@@ -7497,7 +7497,7 @@
> {
> 	PRINTMONITOR_1 *info_1=NULL;
> 	
>-	if((info_1 = (PRINTMONITOR_1 *)malloc(sizeof(PRINTMONITOR_1))) == NULL)
>+	if((info_1 = SMB_MALLOC_P(PRINTMONITOR_1)) == NULL)
> 		return WERR_NOMEM;
> 
> 	(*returned) = 0x1;
>@@ -7529,7 +7529,7 @@
> {
> 	PRINTMONITOR_2 *info_2=NULL;
> 	
>-	if((info_2 = (PRINTMONITOR_2 *)malloc(sizeof(PRINTMONITOR_2))) == NULL)
>+	if((info_2 = SMB_MALLOC_P(PRINTMONITOR_2)) == NULL)
> 		return WERR_NOMEM;
> 
> 	(*returned) = 0x1;
>@@ -7602,7 +7602,7 @@
> 	BOOL found=False;
> 	JOB_INFO_1 *info_1=NULL;
> 
>-	info_1=(JOB_INFO_1 *)malloc(sizeof(JOB_INFO_1));
>+	info_1=SMB_MALLOC_P(JOB_INFO_1);
> 
> 	if (info_1 == NULL) {
> 		SAFE_FREE(queue);
>@@ -7654,7 +7654,7 @@
> 	WERROR ret;
> 	DEVICEMODE *devmode = NULL;
> 
>-	info_2=(JOB_INFO_2 *)malloc(sizeof(JOB_INFO_2));
>+	info_2=SMB_MALLOC_P(JOB_INFO_2);
> 
> 	ZERO_STRUCTP(info_2);
> 
>@@ -7785,7 +7785,7 @@
> 
> 		
> 	if (!Printer) {
>-		if((*data=(uint8 *)talloc_zero(p->mem_ctx, 4*sizeof(uint8))) == NULL)
>+		if((*data=(uint8 *)TALLOC_ZERO(p->mem_ctx, 4*sizeof(uint8))) == NULL)
> 			return WERR_NOMEM;
> 		DEBUG(2,("_spoolss_getprinterdata: Invalid handle (%s:%u:%u).\n", OUR_HANDLE(handle)));
> 		return WERR_BADFID;
>@@ -7824,7 +7824,7 @@
> 		
> 		/* reply this param doesn't exist */
> 		if (*out_size) {
>-			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
>+			if((*data=TALLOC_ZERO_ARRAY(p->mem_ctx, uint8, *out_size)) == NULL)
> 				return WERR_NOMEM;
> 		} else {
> 			*data = NULL;
>@@ -8008,7 +8008,7 @@
> 
> 		DEBUG(10,("retrieved value number [%d] [%s]\n", num_entries, value));
> 
>-		if ((ptr=talloc_realloc(p->mem_ctx, enum_values, (num_entries+1) * sizeof(PRINTER_ENUM_VALUES))) == NULL)
>+		if ((ptr=TALLOC_REALLOC_ARRAY(p->mem_ctx, enum_values, PRINTER_ENUM_VALUES, num_entries+1)) == NULL)
> 		{
> 			DEBUG(0,("talloc_realloc failed to allocate more memory!\n"));
> 			result = WERR_NOMEM;
>@@ -8026,7 +8026,7 @@
> 		
> 		if ( data_len )
> 		{
>-			if ( !(enum_values[num_entries].data = talloc_zero(p->mem_ctx, data_len)) ) {
>+			if ( !(enum_values[num_entries].data = TALLOC_ZERO(p->mem_ctx, data_len)) ) {
> 				DEBUG(0,("talloc_realloc failed to allocate more memory [data_len=%d] for data!\n", data_len ));
> 				result = WERR_NOMEM;
> 				goto done;
>@@ -8090,7 +8090,7 @@
> 	if (get_short_archi(short_archi, long_archi)==False)
> 		return WERR_INVALID_ENVIRONMENT;
> 
>-	if((info=(PRINTPROCESSOR_DIRECTORY_1 *)malloc(sizeof(PRINTPROCESSOR_DIRECTORY_1))) == NULL)
>+	if((info=SMB_MALLOC_P(PRINTPROCESSOR_DIRECTORY_1)) == NULL)
> 		return WERR_NOMEM;
> 
> 	pstrcpy(path, "C:\\WINNT\\System32\\spool\\PRTPROCS\\W32X86");
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_srvsvc_nt.c samba-2.2.12-backport/source/rpc_server/srv_srvsvc_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_srvsvc_nt.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_srvsvc_nt.c	2004-12-15 14:43:16.000000000 -0500
>@@ -494,7 +494,7 @@
> 		SRV_SHARE_INFO_1 *info1;
> 		int i = 0;
> 
>-		info1 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1));
>+		info1 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1, num_entries);
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>@@ -511,7 +511,7 @@
> 		SRV_SHARE_INFO_2 *info2;
> 		int i = 0;
> 
>-		info2 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_2));
>+		info2 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_2, num_entries);
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>@@ -528,7 +528,7 @@
> 		SRV_SHARE_INFO_501 *info501;
> 		int i = 0;
> 	
>-		info501 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_501));
>+		info501 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_501, num_entries);
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>@@ -545,7 +545,7 @@
> 		SRV_SHARE_INFO_502 *info502;
> 		int i = 0;
> 
>-		info502 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_502));
>+		info502 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_502, num_entries);
> 
> 		for (snum = *resume_hnd; snum < num_services; snum++) {
> 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_admin_share(snum)) ) {
>@@ -1052,7 +1052,7 @@
> WERROR _srv_net_srv_get_info(pipes_struct *p, SRV_Q_NET_SRV_GET_INFO *q_u, SRV_R_NET_SRV_GET_INFO *r_u)
> {
> 	WERROR status = WERR_OK;
>-	SRV_INFO_CTR *ctr = (SRV_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_INFO_CTR));
>+	SRV_INFO_CTR *ctr = TALLOC_P(p->mem_ctx, SRV_INFO_CTR);
> 
> 	if (!ctr)
> 		return WERR_NOMEM;
>@@ -1124,7 +1124,7 @@
> 
> WERROR _srv_net_file_enum(pipes_struct *p, SRV_Q_NET_FILE_ENUM *q_u, SRV_R_NET_FILE_ENUM *r_u)
> {
>-	r_u->ctr = (SRV_FILE_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_FILE_INFO_CTR));
>+	r_u->ctr = TALLOC_P(p->mem_ctx, SRV_FILE_INFO_CTR);
> 	if (!r_u->ctr)
> 		return WERR_NOMEM;
> 
>@@ -1151,7 +1151,7 @@
> {
> 	DEBUG(5,("srv_net_conn_enum: %d\n", __LINE__));
> 
>-	r_u->ctr = (SRV_CONN_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_CONN_INFO_CTR));
>+	r_u->ctr = TALLOC_P(p->mem_ctx, SRV_CONN_INFO_CTR);
> 	if (!r_u->ctr)
> 		return WERR_NOMEM;
> 
>@@ -1176,7 +1176,7 @@
> {
> 	DEBUG(5,("_srv_net_sess_enum: %d\n", __LINE__));
> 
>-	r_u->ctr = (SRV_SESS_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_SESS_INFO_CTR));
>+	r_u->ctr = TALLOC_P(p->mem_ctx, SRV_SESS_INFO_CTR);
> 	if (!r_u->ctr)
> 		return WERR_NOMEM;
> 
>@@ -1595,7 +1595,7 @@
> 	struct tm *t;
> 	time_t unixdate = time(NULL);
> 
>-	tod = (TIME_OF_DAY_INFO *)talloc(p->mem_ctx, sizeof(TIME_OF_DAY_INFO));
>+	tod = TALLOC_P(p->mem_ctx, TIME_OF_DAY_INFO);
> 	if (!tod)
> 		return WERR_NOMEM;
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_util.c samba-2.2.12-backport/source/rpc_server/srv_util.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_util.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_util.c	2004-12-15 14:43:16.000000000 -0500
>@@ -97,7 +97,7 @@
>        count++)
>     ;
> 
>-  gids = (DOM_GID *)talloc(ctx, sizeof(DOM_GID) * count );
>+  gids = TALLOC_ARRAY(ctx, DOM_GID, count );
>   if(!gids)
>   {
>     DEBUG(0,("make_dom_gids: talloc fail !\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_wkssvc_nt.c samba-2.2.12-backport/source/rpc_server/srv_wkssvc_nt.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpc_server/srv_wkssvc_nt.c	2004-08-12 14:24:26.000000000 -0400
>+++ samba-2.2.12-backport/source/rpc_server/srv_wkssvc_nt.c	2004-12-15 14:43:16.000000000 -0500
>@@ -65,7 +65,7 @@
> 
> 	DEBUG(5,("_wks_query_info: %d\n", __LINE__));
> 
>-	wks100 = (WKS_INFO_100 *)talloc_zero(p->mem_ctx, sizeof(WKS_INFO_100));
>+	wks100 = TALLOC_ZERO_P(p->mem_ctx, WKS_INFO_100);
> 
> 	if (!wks100)
> 		return NT_STATUS_NO_MEMORY;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/cmd_lsarpc.c samba-2.2.12-backport/source/rpcclient/cmd_lsarpc.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/cmd_lsarpc.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/rpcclient/cmd_lsarpc.c	2004-12-15 14:43:16.000000000 -0500
>@@ -142,7 +142,7 @@
> 
> 	/* Convert arguments to sids */
> 
>-	sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * (argc - 1));
>+	sids = TALLOC_ARRAY(mem_ctx, DOM_SID, argc - 1);
> 
> 	if (!sids) {
> 		printf("could not allocate memory for %d sids\n", argc - 1);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/cmd_samr.c samba-2.2.12-backport/source/rpcclient/cmd_samr.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/cmd_samr.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/rpcclient/cmd_samr.c	2004-12-15 14:43:16.000000000 -0500
>@@ -1045,7 +1045,7 @@
> 	/* Look up names */
> 
> 	num_names = argc - 2;
>-	names = (const char **)talloc(mem_ctx, sizeof(char *) * num_names);
>+	names = (const char **)TALLOC_ARRAY(mem_ctx, char *, num_names);
> 
> 	for (i = 0; i < argc - 2; i++)
> 		names[i] = argv[i + 2];
>@@ -1106,7 +1106,7 @@
> 	/* Look up rids */
> 
> 	num_rids = argc - 1;
>-	rids = (uint32 *)talloc(mem_ctx, sizeof(uint32) * num_rids);
>+	rids = TALLOC_ARRAY(mem_ctx, uint32, num_rids);
> 
> 	for (i = 0; i < argc - 1; i++)
>                 sscanf(argv[i + 1], "%i", &rids[i]);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/cmd_spoolss.c samba-2.2.12-backport/source/rpcclient/cmd_spoolss.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/cmd_spoolss.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/rpcclient/cmd_spoolss.c	2004-12-15 14:43:16.000000000 -0500
>@@ -1031,7 +1031,7 @@
> 	/* allocate the space; add one extra slot for a terminating NULL.
> 	   Each filename is NULL terminated and the end contains a double
> 	   NULL */
>-	if ((info->dependentfiles=(uint16*)talloc(mem_ctx, (len+1)*sizeof(uint16))) == NULL)
>+	if ((info->dependentfiles=TALLOC_ARRAY(mem_ctx, uint16, len+1)) == NULL)
> 	{
> 		DEBUG(0,("init_drv_info_3_members: Unable to malloc memory for dependenfiles\n"));
> 		return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/rpcclient.c samba-2.2.12-backport/source/rpcclient/rpcclient.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/rpcclient/rpcclient.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/rpcclient/rpcclient.c	2004-12-16 15:11:49.000000000 -0500
>@@ -54,10 +54,10 @@
> 	if (!commands) 
> 		return NULL;
> 
>-	matches = (char **)malloc(sizeof(matches[0])*MAX_COMPLETIONS);
>+	matches = SMB_MALLOC_ARRAY( char *, MAX_COMPLETIONS );
> 	if (!matches) return NULL;
> 
>-	matches[count++] = strdup(text);
>+	matches[count++] = SMB_STRDUP(text);
> 	if (!matches[0]) return NULL;
> 
> 	while (commands && count < MAX_COMPLETIONS-1) 
>@@ -70,7 +70,7 @@
> 			if ((strncmp(text, commands->cmd_set[i].name, strlen(text)) == 0) &&
> 				commands->cmd_set[i].fn) 
> 			{
>-				matches[count] = strdup(commands->cmd_set[i].name);
>+				matches[count] = SMB_STRDUP(commands->cmd_set[i].name);
> 				if (!matches[count]) 
> 					return NULL;
> 				count++;
>@@ -83,7 +83,7 @@
> 
> 	if (count == 2) {
> 		SAFE_FREE(matches[0]);
>-		matches[0] = strdup(matches[1]);
>+		matches[0] = SMB_STRDUP(matches[1]);
> 	}
> 	matches[count] = NULL;
> 	return matches;
>@@ -427,7 +427,7 @@
> {
> 	struct cmd_list *entry;
> 
>-	if (!(entry = (struct cmd_list *)malloc(sizeof(struct cmd_list)))) {
>+	if (!(entry = SMB_MALLOC_P(struct cmd_list))) {
> 		DEBUG(0, ("out of memory\n"));
> 		return;
> 	}
>@@ -453,7 +453,7 @@
>  again:
> 	while(next_token(&p, buf, " ", sizeof(buf))) {
> 		if (argv) {
>-			argv[argc] = strdup(buf);
>+			argv[argc] = SMB_STRDUP(buf);
> 		}
> 		
> 		argc++;
>@@ -463,7 +463,7 @@
> 
> 		/* Create argument list */
> 
>-		argv = (char **)malloc(sizeof(char *) * argc);
>+		argv = SMB_MALLOC_ARRAY( char *, argc );
>                 memset(argv, 0, sizeof(char *) * argc);
> 
> 		if (!argv) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/blocking.c samba-2.2.12-backport/source/smbd/blocking.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/blocking.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/blocking.c	2004-12-15 17:17:39.000000000 -0500
>@@ -103,12 +103,12 @@
>    * the expiration time here.
>    */
> 
>-  if((blr = (blocking_lock_record *)malloc(sizeof(blocking_lock_record))) == NULL) {
>+  if((blr = SMB_MALLOC_P(blocking_lock_record)) == NULL) {
>     DEBUG(0,("push_blocking_lock_request: Malloc fail !\n" ));
>     return False;
>   }
> 
>-  if((blr->inbuf = (char *)malloc(length)) == NULL) {
>+  if((blr->inbuf = (char *)SMB_MALLOC(length)) == NULL) {
>     DEBUG(0,("push_blocking_lock_request: Malloc fail (2)!\n" ));
>     SAFE_FREE(blr);
>     return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/conn.c samba-2.2.12-backport/source/smbd/conn.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/conn.c	2004-12-16 11:53:56.000000000 -0500
>+++ samba-2.2.12-backport/source/smbd/conn.c	2004-12-15 17:06:28.000000000 -0500
>@@ -126,7 +126,7 @@
>                 goto find_again;
> 	}
> 
>-	conn = (connection_struct *)malloc(sizeof(*conn));
>+	conn = SMB_MALLOC_P(connection_struct);
> 	if (!conn) return NULL;
> 
> 	ZERO_STRUCTP(conn);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/dir.c samba-2.2.12-backport/source/smbd/dir.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/dir.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/dir.c	2004-12-15 16:48:24.000000000 -0500
>@@ -407,7 +407,7 @@
>   if (dptrs_open >= MAX_OPEN_DIRECTORIES)
>     dptr_idleoldest();
> 
>-  dptr = (dptr_struct *)malloc(sizeof(dptr_struct));
>+  dptr = SMB_MALLOC_P(dptr_struct);
>   if(!dptr) {
>     DEBUG(0,("malloc fail in dptr_create.\n"));
>     return -1;
>@@ -752,7 +752,7 @@
>   
> 	if (!p)
> 		return(NULL);
>-	dirp = (Dir *)malloc(sizeof(Dir));
>+	dirp = SMB_MALLOC_P(Dir);
> 	if (!dirp) {
> 		DEBUG(0,("Out of memory in OpenDir\n"));
> 		conn->vfs_ops.closedir(conn,p);
>@@ -806,7 +806,7 @@
> 		if (used + l > dirp->mallocsize) {
> 			int s = MAX(used+l,used+2000);
> 			char *r;
>-			r = (char *)Realloc(dirp->data,s);
>+			r = (char *)SMB_REALLOC(dirp->data,s);
> 			if (!r) {
> 				DEBUG(0,("Out of memory in OpenDir\n"));
> 				break;
>@@ -924,7 +924,7 @@
>    */
>   pathlen = strlen( path ) +1;  /* Bytes required to store path (with nul). */
>   namelen = strlen( name ) +1;  /* Bytes required to store name (with nul). */
>-  entry = (dir_cache_entry *)malloc( sizeof( dir_cache_entry )
>+  entry = (dir_cache_entry *)SMB_MALLOC( sizeof( dir_cache_entry )
>                                    + pathlen
>                                    + namelen
>                                    + strlen( dname ) +1 );
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/fileio.c samba-2.2.12-backport/source/smbd/fileio.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/fileio.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/fileio.c	2004-12-15 17:59:02.000000000 -0500
>@@ -660,7 +660,7 @@
> 	if(alloc_size == 0 || fsp->wcp)
> 		return False;
> 
>-	if((wcp = (write_cache *)malloc(sizeof(write_cache))) == NULL) {
>+	if((wcp = SMB_MALLOC_P(write_cache)) == NULL) {
> 		DEBUG(0,("setup_write_cache: malloc fail.\n"));
> 		return False;
> 	}
>@@ -669,7 +669,7 @@
> 	wcp->offset = 0;
> 	wcp->alloc_size = alloc_size;
> 	wcp->data_size = 0;
>-	if((wcp->data = malloc(wcp->alloc_size)) == NULL) {
>+	if((wcp->data = SMB_MALLOC(wcp->alloc_size)) == NULL) {
> 		DEBUG(0,("setup_write_cache: malloc fail for buffer size %u.\n",
> 			(unsigned int)wcp->alloc_size ));
> 		SAFE_FREE(wcp);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/files.c samba-2.2.12-backport/source/smbd/files.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/files.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/files.c	2004-12-15 16:43:55.000000000 -0500
>@@ -94,7 +94,7 @@
> 		return NULL;
> 	}
> 
>-	fsp = (files_struct *)malloc(sizeof(*fsp));
>+	fsp = SMB_MALLOC_P(files_struct);
> 	if (!fsp) {
> 		unix_ERR_class = ERRSRV;
> 		unix_ERR_code = ERRnofids;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/ipc.c samba-2.2.12-backport/source/smbd/ipc.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/ipc.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/ipc.c	2004-12-15 17:59:02.000000000 -0500
>@@ -174,7 +174,7 @@
> 
> static BOOL api_rpc_trans_reply(char *outbuf, pipes_struct *p)
> {
>-	char *rdata = malloc(p->max_trans_reply);
>+	char *rdata = SMB_MALLOC(p->max_trans_reply);
> 	int data_len;
> 
> 	if(rdata == NULL) {
>@@ -389,7 +389,7 @@
> 		goto bad_param;
>   
> 	if (tdscnt)  {
>-		if((data = (char *)malloc(tdscnt)) == NULL) {
>+		if((data = (char *)SMB_MALLOC(tdscnt)) == NULL) {
> 			DEBUG(0,("reply_trans: data malloc fail for %u bytes !\n", tdscnt));
> 			END_PROFILE(SMBtrans);
> 			return(ERROR_DOS(ERRDOS,ERRnomem));
>@@ -403,7 +403,7 @@
> 	}
> 
> 	if (tpscnt) {
>-		if((params = (char *)malloc(tpscnt)) == NULL) {
>+		if((params = (char *)SMB_MALLOC(tpscnt)) == NULL) {
> 			DEBUG(0,("reply_trans: param malloc fail for %u bytes !\n", tpscnt));
> 			SAFE_FREE(data);
> 			END_PROFILE(SMBtrans);
>@@ -419,7 +419,7 @@
> 
> 	if (suwcnt) {
> 		int i;
>-		if((setup = (uint16 *)malloc(suwcnt*sizeof(uint16))) == NULL) {
>+		if((setup = SMB_MALLOC_ARRAY(uint16, suwcnt)) == NULL) {
> 			DEBUG(0,("reply_trans: setup malloc fail for %u bytes !\n", (unsigned int)(suwcnt * sizeof(uint16))));
> 			SAFE_FREE(data);
> 			SAFE_FREE(params);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/lanman.c samba-2.2.12-backport/source/smbd/lanman.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/lanman.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/lanman.c	2004-12-15 17:59:02.000000000 -0500
>@@ -894,7 +894,7 @@
> 		 */
> 		*rdata_len = 0;
> 		*rparam_len = 6;
>-		*rparam = REALLOC(*rparam,*rparam_len);
>+		*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 		SSVALS(*rparam,0,ERRunknownlevel);
> 		SSVAL(*rparam,2,0);
> 		SSVAL(*rparam,4,0);
>@@ -921,7 +921,7 @@
> 	}
> 
> 	if (mdrcnt > 0) {
>-		*rdata = REALLOC(*rdata,mdrcnt);
>+		*rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
> 		desc.base = *rdata;
> 		desc.buflen = mdrcnt;
> 	} else {
>@@ -930,7 +930,7 @@
> 		 * init_package will return wrong size if buflen=0
> 		 */
> 		desc.buflen = getlen(desc.format);
>-		desc.base = tmpdata = (char *) malloc (desc.buflen);
>+		desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
> 	}
> 
> 	if (init_package(&desc,1,count)) {
>@@ -949,7 +949,7 @@
> 	*rdata_len = desc.usedlen;
>   
> 	*rparam_len = 6;
>-	*rparam = REALLOC(*rparam,*rparam_len);
>+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 	SSVALS(*rparam,0,desc.errcode);
> 	SSVAL(*rparam,2,0);
> 	SSVAL(*rparam,4,desc.neededlen);
>@@ -997,7 +997,7 @@
>      */
>     *rdata_len = 0;
>     *rparam_len = 6;
>-    *rparam = REALLOC(*rparam,*rparam_len);
>+    *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>     SSVALS(*rparam,0,ERRunknownlevel);
>     SSVAL(*rparam,2,0);
>     SSVAL(*rparam,4,0);
>@@ -1009,17 +1009,17 @@
>     if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i))
>       queuecnt++;
>   if (uLevel > 0) {
>-    if((queue = (print_queue_struct**)malloc(queuecnt*sizeof(print_queue_struct*))) == NULL) {
>+    if((queue = SMB_MALLOC_ARRAY(print_queue_struct *, queuecnt)) == NULL) {
>       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
>       return False;
>     }
>     memset(queue,0,queuecnt*sizeof(print_queue_struct*));
>-    if((status = (print_status_struct*)malloc(queuecnt*sizeof(print_status_struct))) == NULL) {
>+    if((status = SMB_MALLOC_ARRAY(print_status_struct, queuecnt)) == NULL) {
>       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
>       return False;
>     }
>     memset(status,0,queuecnt*sizeof(print_status_struct));
>-    if((subcntarr = (int*)malloc(queuecnt*sizeof(int))) == NULL) {
>+    if((subcntarr = SMB_MALLOC_ARRAY(int, queuecnt)) == NULL) {
>       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
>       return False;
>     }
>@@ -1032,7 +1032,7 @@
>  	n++;
>       }
>   }
>-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
>+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   desc.base = *rdata;
>   desc.buflen = mdrcnt;
> 
>@@ -1051,7 +1051,7 @@
>  
>   *rdata_len = desc.usedlen;
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,succnt);
>@@ -1135,8 +1135,7 @@
>       struct srv_info_struct *ts;
> 
>       alloced += 10;
>-      ts = (struct srv_info_struct *)
>-	Realloc(*servers,sizeof(**servers)*alloced);
>+      ts = SMB_REALLOC_ARRAY(*servers, struct srv_info_struct, alloced);
>       if (!ts) {
>         DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
>         return(0);
>@@ -1382,7 +1381,7 @@
>   }
> 
>   *rdata_len = fixed_len + string_len;
>-  *rdata = REALLOC(*rdata,*rdata_len);
>+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
>   memset(*rdata,'\0',*rdata_len);
>   
>   p2 = (*rdata) + fixed_len;	/* auxilliary data (strings) will go here */
>@@ -1406,7 +1405,7 @@
>   }
>   
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,counted);
>@@ -1443,7 +1442,7 @@
>   *rdata_len = 0;
>   
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   SSVAL(*rparam,0,0x08AC); /* informational warning message */
>   SSVAL(*rparam,2,0);
>@@ -1589,13 +1588,13 @@
>   if (!prefix_ok(str1,"zWrLh")) return False;
>   if (!check_share_info(uLevel,str2)) return False;
>  
>-  *rdata = REALLOC(*rdata,mdrcnt);
>+  *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   p = *rdata;
>   *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
>   if (*rdata_len < 0) return False;
>  
>   *rparam_len = 6;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVAL(*rparam,0,NERR_Success);
>   SSVAL(*rparam,2,0);		/* converter word */
>   SSVAL(*rparam,4,*rdata_len);
>@@ -1643,7 +1642,7 @@
>         missed = True;
>     }
>   *rdata_len = fixed_len + string_len;
>-  *rdata = REALLOC(*rdata,*rdata_len);
>+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
>   memset(*rdata,0,*rdata_len);
>   
>   p2 = (*rdata) + fixed_len;	/* auxillery data (strings) will go here */
>@@ -1656,7 +1655,7 @@
>  	break;
>   
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,counted);
>@@ -1680,10 +1679,10 @@
> {
>   char *p;
>   *rparam_len = 4;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   *rdata_len = 21;
>-  *rdata = REALLOC(*rdata,*rdata_len);
>+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
> 
>   SSVAL(*rparam,0,NERR_Success);
>   SSVAL(*rparam,2,0);		/* converter word */
>@@ -1742,7 +1741,7 @@
>   memcpy(pass2,p+16,16);
> 
>   *rparam_len = 4;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   *rdata_len = 0;
> 
>@@ -1852,7 +1851,7 @@
>   fstring user;
>   char *p = param + 2;
>   *rparam_len = 2;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   *rdata_len = 0;
> 
>@@ -1922,7 +1921,7 @@
> 		return(False);
> 
> 	*rparam_len = 4;
>-	*rparam = REALLOC(*rparam,*rparam_len);	
>+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);	
> 	*rdata_len = 0;
> 
> 	if (!print_job_exists(jobid)) {
>@@ -1979,7 +1978,7 @@
> 		return(False);
> 
> 	*rparam_len = 4;
>-	*rparam = REALLOC(*rparam,*rparam_len);
>+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 	*rdata_len = 0;
> 
> 	snum = print_queue_snum(QueueName);
>@@ -2049,7 +2048,7 @@
> 
> 	jobid = SVAL(p,0);
> 	*rparam_len = 4;
>-	*rparam = REALLOC(*rparam,*rparam_len);
>+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   
> 	*rdata_len = 0;
> 	
>@@ -2144,7 +2143,7 @@
>   }
> 
>   *rdata_len = mdrcnt;
>-  *rdata = REALLOC(*rdata,*rdata_len);
>+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
> 
>   p = *rdata;
>   p2 = p + struct_len;
>@@ -2193,7 +2192,7 @@
>   *rdata_len = PTR_DIFF(p2,*rdata);
> 
>   *rparam_len = 6;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVAL(*rparam,0,NERR_Success);
>   SSVAL(*rparam,2,0);		/* converter word */
>   SSVAL(*rparam,4,*rdata_len);
>@@ -2220,14 +2219,14 @@
>   DEBUG(4,("NetWkstaGetInfo level %d\n",level));
> 
>   *rparam_len = 6;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   /* check it's a supported varient */
>   if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz")))
>     return(False);
> 
>   *rdata_len = mdrcnt + 1024;
>-  *rdata = REALLOC(*rdata,*rdata_len);
>+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
> 
>   SSVAL(*rparam,0,NERR_Success);
>   SSVAL(*rparam,2,0);		/* converter word */
>@@ -2466,7 +2465,7 @@
> 	       vuser->user.unix_name));
> 
>     *rparam_len = 6;
>-    *rparam = REALLOC(*rparam,*rparam_len);
>+    *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>     DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
>   
>@@ -2485,7 +2484,7 @@
> 	if (strcmp(level_string,str2) != 0) return False;
> 
> 	*rdata_len = mdrcnt + 1024;
>-	*rdata = REALLOC(*rdata,*rdata_len);
>+	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
> 
> 	SSVAL(*rparam,0,NERR_Success);
> 	SSVAL(*rparam,2,0);		/* converter word */
>@@ -2624,7 +2623,7 @@
>   int count=0;
> 
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   /* check it's a supported varient */
>   if (strcmp(str1,"zWrLeh") != 0) return False;
>@@ -2635,7 +2634,7 @@
>   if (strcmp(level_string,str2) != 0) return False;
> 
>   *rdata_len = mdrcnt + 1024;
>-  *rdata = REALLOC(*rdata,*rdata_len);
>+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
> 
>   SSVAL(*rparam,0,NERR_Success);
>   SSVAL(*rparam,2,0);		/* converter word */
>@@ -2679,7 +2678,7 @@
>   /* check it's a supported varient */
>   if (strcmp(str1,"OOWb54WrLh") != 0) return False;
>   if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) return False;
>-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
>+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   desc.base = *rdata;
>   desc.buflen = mdrcnt;
>   desc.subformat = NULL;
>@@ -2726,7 +2725,7 @@
> 
>   *rdata_len = desc.usedlen;
>   *rparam_len = 6;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,desc.neededlen);
>@@ -2756,7 +2755,7 @@
>   if (strcmp(str2,"") != 0) return False;
> 
>   *rparam_len = 6;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,0);		/* errorcode */
>   SSVAL(*rparam,2,0);		/* converter word */
>   SSVAL(*rparam,4,0x7f);	/* permission flags */
>@@ -2807,7 +2806,7 @@
>   }
> 
>   if (mdrcnt > 0) {
>-    *rdata = REALLOC(*rdata,mdrcnt);
>+    *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>     desc.base = *rdata;
>     desc.buflen = mdrcnt;
>   } else {
>@@ -2816,7 +2815,7 @@
>      *  init_package will return wrong size if buflen=0
>      */
>     desc.buflen = getlen(desc.format);
>-    desc.base = tmpdata = (char *)malloc ( desc.buflen );
>+    desc.base = tmpdata = (char *)SMB_MALLOC ( desc.buflen );
>   }
> 
>   if (init_package(&desc,1,0)) {
>@@ -2831,7 +2830,7 @@
>   }
> 
>   *rparam_len = 6;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,desc.neededlen);
>@@ -2885,7 +2884,7 @@
>   if (snum < 0 || !VALID_SNUM(snum)) return(False);
> 
>   count = print_queue_status(snum,&queue,&status);
>-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
>+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   desc.base = *rdata;
>   desc.buflen = mdrcnt;
> 
>@@ -2900,7 +2899,7 @@
>   *rdata_len = desc.usedlen;
> 
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,succnt);
>@@ -3001,7 +3000,7 @@
>   }
>   else {
>     if (mdrcnt > 0) {
>-      *rdata = REALLOC(*rdata,mdrcnt);
>+      *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>       desc.base = *rdata;
>       desc.buflen = mdrcnt;
>     } else {
>@@ -3010,7 +3009,7 @@
>        *  init_package will return wrong size if buflen=0
>        */
>       desc.buflen = getlen(desc.format);
>-      desc.base = tmpdata = (char *)malloc ( desc.buflen );
>+      desc.base = tmpdata = (char *)SMB_MALLOC ( desc.buflen );
>     }
>     if (init_package(&desc,1,0)) {
>       fill_printdest_info(conn,snum,uLevel,&desc);
>@@ -3019,7 +3018,7 @@
>   }
> 
>   *rparam_len = 6;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,desc.neededlen);
>@@ -3058,7 +3057,7 @@
>     if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i))
>       queuecnt++;
> 
>-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
>+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   desc.base = *rdata;
>   desc.buflen = mdrcnt;
>   if (init_package(&desc,queuecnt,0)) {    
>@@ -3076,7 +3075,7 @@
>   *rdata_len = desc.usedlen;
> 
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,succnt);
>@@ -3108,7 +3107,7 @@
>   if (strcmp(str1,"WrLeh") != 0) return False;
>   if (uLevel != 0 || strcmp(str2,"B41") != 0) return False;
> 
>-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
>+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   desc.base = *rdata;
>   desc.buflen = mdrcnt;
>   if (init_package(&desc,1,0)) {
>@@ -3120,7 +3119,7 @@
>   *rdata_len = desc.usedlen;
> 
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,succnt);
>@@ -3152,7 +3151,7 @@
>   if (strcmp(str1,"WrLeh") != 0) return False;
>   if (uLevel != 0 || strcmp(str2,"B13") != 0) return False;
> 
>-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
>+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   desc.base = *rdata;
>   desc.buflen = mdrcnt;
>   desc.format = str2;
>@@ -3165,7 +3164,7 @@
>   *rdata_len = desc.usedlen;
> 
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,succnt);
>@@ -3197,7 +3196,7 @@
>   if (strcmp(str1,"WrLeh") != 0) return False;
>   if (uLevel != 0 || strcmp(str2,"B9") != 0) return False;
> 
>-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
>+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
>   memset((char *)&desc,'\0',sizeof(desc));
>   desc.base = *rdata;
>   desc.buflen = mdrcnt;
>@@ -3211,7 +3210,7 @@
>   *rdata_len = desc.usedlen;
> 
>   *rparam_len = 8;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
>   SSVALS(*rparam,0,desc.errcode);
>   SSVAL(*rparam,2,0);
>   SSVAL(*rparam,4,succnt);
>@@ -3231,7 +3230,7 @@
> 			 int *rdata_len,int *rparam_len)
> {
>   *rparam_len = MIN(*rparam_len,mprcnt);
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   *rdata_len = 0;
> 
>@@ -3253,7 +3252,7 @@
> 			    int *rdata_len,int *rparam_len)
> {
>   *rparam_len = 4;
>-  *rparam = REALLOC(*rparam,*rparam_len);
>+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
> 
>   *rdata_len = 0;
> 
>@@ -3352,11 +3351,11 @@
>     }
>   }
> 
>-  rdata = (char *)malloc(1024);
>+  rdata = (char *)SMB_MALLOC(1024);
>   if (rdata)
>     memset(rdata,'\0',1024);
> 
>-  rparam = (char *)malloc(1024);
>+  rparam = (char *)SMB_MALLOC(1024);
>   if (rparam)
>     memset(rparam,'\0',1024);
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/mangle_hash.c samba-2.2.12-backport/source/smbd/mangle_hash.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/mangle_hash.c	2004-08-12 14:25:49.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/mangle_hash.c	2004-12-15 17:06:28.000000000 -0500
>@@ -589,7 +589,7 @@
> 
>   /* Allocate a new cache entry.  If the allocation fails, just return. */
>   i = sizeof( ubi_cacheEntry ) + mangled_len + raw_len + 2;
>-  new_entry = malloc( i );
>+  new_entry = SMB_MALLOC( i );
>   if( !new_entry )
>     return;
> 
>@@ -635,7 +635,7 @@
>     ext_start = strrchr( s, '.' );
>     if( ext_start )
>     {
>-      if((saved_ext = strdup(ext_start)) == NULL)
>+      if((saved_ext = SMB_STRDUP(ext_start)) == NULL)
>         return False;
> 
>       *ext_start = '\0';
>@@ -847,7 +847,7 @@
> 
> 		/* mangle it into 8.3 */
> 		if (cache83)
>-			tmp = strdup(OutName);
>+			tmp = SMB_STRDUP(OutName);
> 
> 		mangle_name_83(OutName);
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/mangle_hash2.c samba-2.2.12-backport/source/smbd/mangle_hash2.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/mangle_hash2.c	2004-08-12 14:25:49.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/mangle_hash2.c	2004-12-15 18:00:20.000000000 -0500
>@@ -141,10 +141,10 @@
> {
> 	if (prefix_cache) return True;
> 
>-	prefix_cache = calloc(MANGLE_CACHE_SIZE, sizeof(char *));
>+	prefix_cache = SMB_CALLOC_ARRAY(char *, MANGLE_CACHE_SIZE);
> 	if (!prefix_cache) return False;
> 
>-	prefix_cache_hashes = calloc(MANGLE_CACHE_SIZE, sizeof(u32));
>+	prefix_cache_hashes = SMB_CALLOC_ARRAY(u32, MANGLE_CACHE_SIZE);
> 	if (!prefix_cache_hashes) return False;
> 
> 	return True;
>@@ -161,7 +161,7 @@
> 		free(prefix_cache[i]);
> 	}
> 
>-	prefix_cache[i] = strndup(prefix, length);
>+	prefix_cache[i] = SMB_STRNDUP(prefix, length);
> 	prefix_cache_hashes[i] = hash;
> }
> 
>@@ -252,7 +252,7 @@
> 	DEBUG(10,("is_mangled %s ?\n", name));
> 
> 	for (s=name; (p=strchr(s, '/')); s=p+1) {
>-		char *component = strndup(s, PTR_DIFF(p, s));
>+		char *component = SMB_STRNDUP(s, PTR_DIFF(p, s));
> 		if (is_mangled_component(component)) {
> 			free(component);
> 			return True;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/notify.c samba-2.2.12-backport/source/smbd/notify.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/notify.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/notify.c	2004-12-15 23:48:20.000000000 -0500
>@@ -178,7 +178,7 @@
> {
> 	struct change_notify *cnbp;
> 
>-	if((cnbp = (struct change_notify *)malloc(sizeof(*cnbp))) == NULL) {
>+	if((cnbp = SMB_MALLOC_P(struct change_notify)) == NULL) {
> 		DEBUG(0,("call_nt_transact_notify_change: malloc fail !\n" ));
> 		return -1;
> 	}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/nttrans.c samba-2.2.12-backport/source/smbd/nttrans.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/nttrans.c	2004-12-16 11:53:56.000000000 -0500
>+++ samba-2.2.12-backport/source/smbd/nttrans.c	2004-12-17 15:28:26.000000000 -0500
>@@ -1034,7 +1034,7 @@
> 		return ret;
> 
> 	/* Realloc the size of parameters and data we will return */
>-	params = Realloc(*ppparams, 69);
>+	params = SMB_REALLOC(*ppparams, 69);
> 	if(params == NULL)
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 
>@@ -1445,7 +1445,7 @@
> 	}
> 
> 	/* Realloc the size of parameters and data we will return */
>-	params = Realloc(*ppparams, 69);
>+	params = SMB_REALLOC(*ppparams, 69);
> 	if(params == NULL)
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 
>@@ -1659,7 +1659,7 @@
> 
>   DEBUG(3,("call_nt_transact_query_security_desc: file = %s\n", fsp->fsp_name ));
> 
>-  params = Realloc(*ppparams, 4);
>+  params = SMB_REALLOC(*ppparams, 4);
>   if(params == NULL)
>     return ERROR_DOS(ERRDOS,ERRnomem);
> 
>@@ -1700,7 +1700,7 @@
>    * Allocate the data we will point this at.
>    */
> 
>-  data = Realloc(*ppdata, sd_size);
>+  data = SMB_REALLOC(*ppdata, sd_size);
>   if(data == NULL) {
>     talloc_destroy(mem_ctx);
>     return ERROR_DOS(ERRDOS,ERRnomem);
>@@ -1896,11 +1896,11 @@
> 	/* Allocate the space for the setup, the maximum needed parameters and data */
> 
> 	if(setup_count > 0)
>-		setup = (char *)malloc(setup_count);
>+		setup = (char *)SMB_MALLOC(setup_count);
> 	if (total_parameter_count > 0)
>-		params = (char *)malloc(total_parameter_count);
>+		params = (char *)SMB_MALLOC(total_parameter_count);
> 	if (total_data_count > 0)
>-		data = (char *)malloc(total_data_count);
>+		data = (char *)SMB_MALLOC(total_data_count);
>  
> 	if ((total_parameter_count && !params)  || (total_data_count && !data) ||
> 				(setup_count && !setup)) {
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/oplock.c samba-2.2.12-backport/source/smbd/oplock.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/oplock.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/oplock.c	2004-12-15 23:48:20.000000000 -0500
>@@ -709,12 +709,12 @@
> 	 * messages crossing on the wire.
> 	 */
> 
>-	if((inbuf = (char *)malloc(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN))==NULL) {
>+	if((inbuf = (char *)SMB_MALLOC(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN))==NULL) {
> 		DEBUG(0,("oplock_break: malloc fail for input buffer.\n"));
> 		return False;
> 	}
> 
>-	if((outbuf = (char *)malloc(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN))==NULL) {
>+	if((outbuf = (char *)SMB_MALLOC(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN))==NULL) {
> 		DEBUG(0,("oplock_break: malloc fail for output buffer.\n"));
> 		SAFE_FREE(inbuf);
> 		return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/password.c samba-2.2.12-backport/source/smbd/password.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/password.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/password.c	2004-12-15 17:56:01.000000000 -0500
>@@ -184,7 +184,7 @@
> 	size_t num_sids = 0;
> 	fstring sid_str;
> 
>-	if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
>+	if ((token = SMB_MALLOC_P(NT_USER_TOKEN ) ) == NULL)
> 		return NULL;
> 
> 	ZERO_STRUCTP(token);
>@@ -195,7 +195,7 @@
> 	if (sup_tok && sup_tok->num_sids)
> 		num_sids += sup_tok->num_sids;
> 
>-	if ((token->user_sids = (DOM_SID *)malloc( num_sids*sizeof(DOM_SID))) == NULL) {
>+	if ((token->user_sids = SMB_MALLOC_ARRAY( DOM_SID, num_sids)) == NULL) {
> 		SAFE_FREE(token);
> 		return NULL;
> 	}
>@@ -277,7 +277,7 @@
> 	if (num_validated_vuids >= 0xFFFF-VUID_OFFSET)
> 		return UID_FIELD_INVALID;
> 
>-	if((vuser = (user_struct *)malloc( sizeof(user_struct) )) == NULL) {
>+	if((vuser = SMB_MALLOC_P(user_struct)) == NULL) {
> 		DEBUG(0,("Failed to malloc users struct!\n"));
> 		return UID_FIELD_INVALID;
> 	}
>@@ -773,7 +773,7 @@
> 		/* now check the list of session users */
> 		if (!ok) {
> 			char *auser;
>-			char *user_list = strdup(session_users);
>+			char *user_list = SMB_STRDUP(session_users);
> 			if (!user_list)
> 				return(False);
> 
>@@ -1025,7 +1025,7 @@
> 	if (!cli_initialise(cli))
> 		return NULL;
> 
>-	pserver = strdup(lp_passwordserver());
>+	pserver = SMB_STRDUP(lp_passwordserver());
> 	p = pserver;
> 
> 	while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
>@@ -1193,7 +1193,7 @@
> 
> static BOOL grab_server_mutex(const char *name)
> {
>-	mutex_server_name = strdup(name);
>+	mutex_server_name = SMB_STRDUP(name);
> 	if (!mutex_server_name) {
> 		DEBUG(0,("grab_server_mutex: malloc failed for %s\n", name));
> 		return False;
>@@ -1645,14 +1645,14 @@
>  
> 		*pptoken = NULL;
>  
>-		if ((ptok = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {
>+		if ((ptok = SMB_MALLOC_P(NT_USER_TOKEN) ) == NULL) {
> 			DEBUG(0, ("domain_client_validate: Out of memory allocating NT_USER_TOKEN\n"));
> 			release_server_mutex();
> 			return False;
> 		}
>  
> 		ptok->num_sids = (size_t)info3.num_groups2 + info3.num_other_sids;
>-		if ((ptok->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptok->num_sids )) == NULL) {
>+		if ((ptok->user_sids = SMB_MALLOC_ARRAY( DOM_SID, ptok->num_sids )) == NULL) {
> 			DEBUG(0, ("domain_client_validate: Out of memory allocating group SIDS\n"));
> 			SAFE_FREE(ptok);
> 			release_server_mutex();
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/posix_acls.c samba-2.2.12-backport/source/smbd/posix_acls.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/posix_acls.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/posix_acls.c	2004-12-15 17:17:39.000000000 -0500
>@@ -84,7 +84,7 @@
> 
> static canon_ace *dup_canon_ace( canon_ace *src_ace)
> {
>-	canon_ace *dst_ace = (canon_ace *)malloc(sizeof(canon_ace));
>+	canon_ace *dst_ace = SMB_MALLOC_P(canon_ace);
> 
> 	if (dst_ace == NULL)
> 		return NULL;
>@@ -703,7 +703,7 @@
> 	}
> 
> 	if (!got_user) {
>-		if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
>+		if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
> 			DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
> 			return False;
> 		}
>@@ -738,7 +738,7 @@
> 	}
> 
> 	if (!got_grp) {
>-		if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
>+		if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
> 			DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
> 			return False;
> 		}
>@@ -768,7 +768,7 @@
> 	}
> 
> 	if (!got_other) {
>-		if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
>+		if ((pace = SMB_MALLOC_P(canon_ace)) == NULL) {
> 			DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n"));
> 			return False;
> 		}
>@@ -956,7 +956,7 @@
> 		 * Create a cannon_ace entry representing this NT DACL ACE.
> 		 */
> 
>-		if ((current_ace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) {
>+		if ((current_ace = SMB_MALLOC_P(canon_ace)) == NULL) {
> 			free_canon_ace_list(file_ace);
> 			free_canon_ace_list(dir_ace);
> 			DEBUG(0,("create_canon_ace_lists: malloc fail.\n"));
>@@ -1743,7 +1743,7 @@
> 		 * Add this entry to the list.
> 		 */
> 
>-		if ((ace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL)
>+		if ((ace = SMB_MALLOC_P(canon_ace)) == NULL)
> 			goto fail;
> 
> 		ZERO_STRUCTP(ace);
>@@ -2387,7 +2387,7 @@
> 		num_dir_acls = count_canon_ace_list(dir_ace);
> 
> 		/* Allocate the ace list. */
>-		if ((nt_ace_list = (SEC_ACE *)malloc((num_acls + num_profile_acls + num_dir_acls)* sizeof(SEC_ACE))) == NULL) {
>+		if ((nt_ace_list = SMB_MALLOC_ARRAY(SEC_ACE, num_acls + num_profile_acls + num_dir_acls)) == NULL) {
> 			DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n"));
> 			goto done;
> 		}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/process.c samba-2.2.12-backport/source/smbd/process.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/process.c	2004-08-12 14:24:20.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/process.c	2004-12-15 17:17:39.000000000 -0500
>@@ -73,8 +73,7 @@
> 
> static BOOL push_message(ubi_slList *list_head, char *buf, int msg_len)
> {
>-  pending_message_list *msg = (pending_message_list *)
>-                               malloc(sizeof(pending_message_list));
>+  pending_message_list *msg = SMB_MALLOC_P(pending_message_list);
> 
>   if(msg == NULL)
>   {
>@@ -82,7 +81,7 @@
>     return False;
>   }
> 
>-  msg->msg_buf = (char *)malloc(msg_len);
>+  msg->msg_buf = (char *)SMB_MALLOC(msg_len);
>   if(msg->msg_buf == NULL)
>   {
>     DEBUG(0,("push_message: malloc fail (2)\n"));
>@@ -1212,8 +1211,8 @@
> 	time_t last_timeout_processing_time = time(NULL);
> 	unsigned int num_smbs = 0;
> 
>-	InBuffer = (char *)malloc(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
>-	OutBuffer = (char *)malloc(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
>+	InBuffer = (char *)SMB_MALLOC(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
>+	OutBuffer = (char *)SMB_MALLOC(BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
> 	if ((InBuffer == NULL) || (OutBuffer == NULL)) 
> 		return;
> 
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/reply.c samba-2.2.12-backport/source/smbd/reply.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/reply.c	2004-08-12 14:25:49.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/reply.c	2004-12-16 00:16:14.000000000 -0500
>@@ -1470,7 +1470,7 @@
> 		END_PROFILE(SMBsearch);
>         return ERROR_DOS(ERRDOS,ERRnofids);
>       }
>-      dptr_set_wcard(dptr_num, strdup(mask));
>+      dptr_set_wcard(dptr_num, SMB_STRDUP(mask));
>       dptr_set_attr(dptr_num, dirtype);
>     } else {
>       dirtype = dptr_attr(dptr_num);
>@@ -4990,7 +4990,7 @@
> 		if(fsp->wbmpx_ptr != NULL)
> 			wbms = fsp->wbmpx_ptr; /* Use an existing struct */
> 		else
>-			wbms = (write_bmpx_struct *)malloc(sizeof(write_bmpx_struct));
>+			wbms = SMB_MALLOC_P(write_bmpx_struct);
> 
> 		if(!wbms) {
> 			DEBUG(0,("Out of memory in reply_readmpx\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/sec_ctx.c samba-2.2.12-backport/source/smbd/sec_ctx.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/sec_ctx.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/sec_ctx.c	2004-12-16 00:17:34.000000000 -0500
>@@ -155,7 +155,7 @@
> 		goto fail;
> 	}
> 
>-	if((groups = (gid_t *)malloc(sizeof(gid_t)*(ngroups+1))) == NULL) {
>+	if((groups = SMB_MALLOC_ARRAY(gid_t, ngroups+1)) == NULL) {
> 		DEBUG(0,("setup_groups malloc fail !\n"));
> 		goto fail;
> 	}
>@@ -208,7 +208,7 @@
> 	if (!ptoken)
> 		return NULL;
> 
>-    if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
>+    if ((token = SMB_MALLOC_P(NT_USER_TOKEN) ) == NULL)
>         return NULL;
> 
>     ZERO_STRUCTP(token);
>@@ -301,7 +301,7 @@
> 	ctx_p->ngroups = sys_getgroups(0, NULL);
> 
> 	if (ctx_p->ngroups != 0) {
>-		if (!(ctx_p->groups = malloc(ctx_p->ngroups * sizeof(gid_t)))) {
>+		if (!(ctx_p->groups = SMB_MALLOC_ARRAY(gid_t, ctx_p->ngroups))) {
> 			DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
> 			delete_nt_token(&ctx_p->token);
> 			return False;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/statcache.c samba-2.2.12-backport/source/smbd/statcache.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/statcache.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/statcache.c	2004-12-15 17:17:39.000000000 -0500
>@@ -103,7 +103,7 @@
>       return;
>     } else {
>       hash_remove(&stat_cache, hash_elem);
>-      if((scp = (stat_cache_entry *)malloc(sizeof(stat_cache_entry)+2*namelen)) == NULL) {
>+      if((scp = (stat_cache_entry *)SMB_MALLOC(sizeof(stat_cache_entry)+2*namelen)) == NULL) {
>         DEBUG(0,("stat_cache_add: Out of memory !\n"));
>         return;
>       }
>@@ -119,7 +119,7 @@
>      * New entry.
>      */
> 
>-    if((scp = (stat_cache_entry *)malloc(sizeof(stat_cache_entry)+2*namelen)) == NULL) {
>+    if((scp = (stat_cache_entry *)SMB_MALLOC(sizeof(stat_cache_entry)+2*namelen)) == NULL) {
>       DEBUG(0,("stat_cache_add: Out of memory !\n"));
>       return;
>     }
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/trans2.c samba-2.2.12-backport/source/smbd/trans2.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/trans2.c	2004-12-16 11:53:56.000000000 -0500
>+++ samba-2.2.12-backport/source/smbd/trans2.c	2004-12-16 15:50:23.000000000 -0500
>@@ -305,7 +305,7 @@
> 	}
> 
> 	/* Realloc the size of parameters and data we will return */
>-	params = Realloc(*pparams, 28);
>+	params = SMB_REALLOC(*pparams, 28);
> 	if( params == NULL )
> 		return(ERROR_DOS(ERRDOS,ERRnomem));
> 	*pparams = params;
>@@ -970,14 +970,14 @@
> 
> 	DEBUG(5,("dir=%s, mask = %s\n",directory, mask));
> 
>-	pdata = Realloc(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
>+	pdata = SMB_REALLOC(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
> 	if( pdata == NULL )
> 		return(ERROR_DOS(ERRDOS,ERRnomem));
> 	*ppdata = pdata;
> 	memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
> 
> 	/* Realloc the params space */
>-	params = Realloc(*pparams, 10);
>+	params = SMB_REALLOC(*pparams, 10);
> 	if( params == NULL )
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	*pparams = params;
>@@ -989,7 +989,7 @@
> 	/* Save the wildcard match and attribs we are using on this directory - 
> 		needed as lanman2 assumes these are being saved between calls */
> 
>-	if(!(wcard = strdup(mask))) {
>+	if(!(wcard = SMB_STRDUP(mask))) {
> 		dptr_close(&dptr_num);
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	}
>@@ -1170,7 +1170,7 @@
> 			return ERROR_DOS(ERRDOS,ERRunknownlevel);
> 	}
> 
>-	pdata = Realloc( *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
>+	pdata = SMB_REALLOC( *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
> 	if(pdata == NULL)
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 
>@@ -1178,7 +1178,7 @@
> 	memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
> 
> 	/* Realloc the params space */
>-	params = Realloc(*pparams, 6*SIZEOFWORD);
>+	params = SMB_REALLOC(*pparams, 6*SIZEOFWORD);
> 	if( params == NULL )
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	*pparams = params;
>@@ -1377,7 +1377,7 @@
> 		return ERROR_DOS(ERRSRV,ERRinvdevice);
> 	}
> 
>-	pdata = Realloc(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
>+	pdata = SMB_REALLOC(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
> 	if ( pdata == NULL )
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 
>@@ -1766,13 +1766,13 @@
> 	/* from now on we only want the part after the / */
> 	fname = p;
>   
>-	params = Realloc(*pparams,2);
>+	params = SMB_REALLOC(*pparams,2);
> 	if ( params == NULL )
> 	  return ERROR_DOS(ERRDOS,ERRnomem);
> 	*pparams	= params;
> 	memset((char *)params,'\0',2);
> 	data_size = max_data_bytes + DIR_ENTRY_SAFETY_MARGIN;
>-	pdata = Realloc(*ppdata, data_size); 
>+	pdata = SMB_REALLOC(*ppdata, data_size); 
> 	if ( pdata == NULL )
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	*ppdata	= pdata;
>@@ -2415,7 +2415,7 @@
> 		tran_call,fname,info_level,total_data));
> 
> 	/* Realloc the parameter and data sizes */
>-	params = Realloc(*pparams,2);
>+	params = SMB_REALLOC(*pparams,2);
> 	if(params == NULL)
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	*pparams = params;
>@@ -2969,7 +2969,7 @@
> 	}
> 
> 	/* Realloc the parameter and data sizes */
>-	params = Realloc(*pparams,2);
>+	params = SMB_REALLOC(*pparams,2);
> 	if(params == NULL)
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	*pparams = params;
>@@ -3008,7 +3008,7 @@
> 	}
> 
> 	/* Realloc the parameter and data sizes */
>-	params = Realloc(*pparams,6);
>+	params = SMB_REALLOC(*pparams,6);
> 	if(params == NULL)
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	*pparams = params;
>@@ -3040,7 +3040,7 @@
> 	DEBUG(3,("call_trans2findnotifynext\n"));
> 
> 	/* Realloc the parameter and data sizes */
>-	params = Realloc(*pparams,4);
>+	params = SMB_REALLOC(*pparams,4);
> 	if(params == NULL)
> 		return ERROR_DOS(ERRDOS,ERRnomem);
> 	*pparams = params;
>@@ -3109,7 +3109,7 @@
> 
> 	if ((SVAL(inbuf,(smb_setup+4)) == LMCAT_SPL) &&
> 			(SVAL(inbuf,(smb_setup+6)) == LMFUNC_GETJOBID)) {
>-		pdata = Realloc(*ppdata, 32);
>+		pdata = SMB_REALLOC(*ppdata, 32);
> 		if(pdata == NULL)
> 			return ERROR_DOS(ERRDOS,ERRnomem);
> 		*ppdata = pdata;
>@@ -3253,9 +3253,9 @@
>     
> 	/* Allocate the space for the maximum needed parameters and data */
> 	if (total_params > 0)
>-		params = (char *)malloc(total_params);
>+		params = (char *)SMB_MALLOC(total_params);
> 	if (total_data > 0)
>-		data = (char *)malloc(total_data);
>+		data = (char *)SMB_MALLOC(total_data);
>   
> 	if ((total_params && !params)  || (total_data && !data)) {
> 		DEBUG(2,("Out of memory in reply_trans2\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/uid.c samba-2.2.12-backport/source/smbd/uid.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/uid.c	2004-08-12 14:24:21.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/uid.c	2004-12-16 00:16:14.000000000 -0500
>@@ -395,7 +395,7 @@
> 
> 	total_groups = current_n_groups + ptok->num_sids;
>  
>-	final_groups = (gid_t *)malloc(total_groups * sizeof(gid_t));
>+	final_groups = SMB_MALLOC_ARRAY(gid_t, total_groups );
> 	if (!final_groups) {
> 		DEBUG(0,("add_supplementary_nt_login_groups: Failed to malloc new groups.\n"));
> 		delete_nt_token(&new_tok);
>@@ -640,7 +640,7 @@
> 		}
> 	}
> 
>-	pc = (struct uid_sid_cache *)malloc(sizeof(struct uid_sid_cache));
>+	pc = SMB_MALLOC_P(struct uid_sid_cache);
> 	if (!pc)
> 		return;
> 	pc->uid = uid;
>@@ -716,7 +716,7 @@
> 		}
> 	}
> 
>-	pc = (struct gid_sid_cache *)malloc(sizeof(struct gid_sid_cache));
>+	pc = SMB_MALLOC_P(struct gid_sid_cache);
> 	if (!pc)
> 		return;
> 	pc->gid = gid;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbd/vfs.c samba-2.2.12-backport/source/smbd/vfs.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbd/vfs.c	2004-09-29 13:37:44.000000000 -0400
>+++ samba-2.2.12-backport/source/smbd/vfs.c	2004-12-15 17:17:39.000000000 -0500
>@@ -504,7 +504,7 @@
> 
>     /* Create new vfs option */
> 
>-    new_option = (struct vfs_options *)malloc(sizeof(*new_option));
>+    new_option = SMB_MALLOC_P(struct vfs_options);
>     if (new_option == NULL) {
> 	return False;
>     }
>@@ -601,7 +601,7 @@
> 	if (element == 0)
> 		return;
> 
>-	p = (char *)malloc(elsize);
>+	p = (char *)SMB_MALLOC(elsize);
> 
> 	if (!p) {
> 		DEBUG(5,("array_promote: malloc fail\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbwrapper/shared.c samba-2.2.12-backport/source/smbwrapper/shared.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbwrapper/shared.c	2004-08-12 14:24:19.000000000 -0400
>+++ samba-2.2.12-backport/source/smbwrapper/shared.c	2004-12-16 15:50:23.000000000 -0500
>@@ -111,7 +111,7 @@
> 	if (fstat(shared_fd, &st)) goto failed;
> 
> 	if (st.st_size != shared_size) {
>-		variables = (char *)Realloc(variables, st.st_size);
>+		variables = (char *)SMB_REALLOC(variables, st.st_size);
> 		if (!variables) goto failed;
> 		shared_size = st.st_size;
> 		lseek(shared_fd, 0, SEEK_SET);
>@@ -165,7 +165,7 @@
> 	l1 = strlen(name)+1;
> 	l2 = strlen(val)+1;
> 
>-	variables = (char *)Realloc(variables, shared_size + l1+l2+4);
>+	variables = (char *)SMB_REALLOC(variables, shared_size + l1+l2+4);
> 
> 	if (!variables) {
> 		DEBUG(0,("out of memory in smbw_setshared\n"));
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/smbwrapper/smbw_dir.c samba-2.2.12-backport/source/smbwrapper/smbw_dir.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/smbwrapper/smbw_dir.c	2004-08-12 14:24:19.000000000 -0400
>+++ samba-2.2.12-backport/source/smbwrapper/smbw_dir.c	2004-12-16 15:50:23.000000000 -0500
>@@ -80,9 +80,7 @@
> 	DEBUG(5,("%s\n", finfo->name));
> 
> 	if (cur_dir->malloced == cur_dir->count) {
>-		cur_dir->list = (struct file_info *)Realloc(cur_dir->list, 
>-							    sizeof(cur_dir->list[0])*
>-							    (cur_dir->count+100));
>+		cur_dir->list = SMB_REALLOC_ARRAY(cur_dir->list, struct file_info, cur_dir->count+100 );
> 		if (!cur_dir->list) {
> 			/* oops */
> 			return;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/tdb/tdb.c samba-2.2.12-backport/source/tdb/tdb.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/tdb/tdb.c	2004-08-12 14:24:35.000000000 -0400
>+++ samba-2.2.12-backport/source/tdb/tdb.c	2004-12-15 16:27:12.000000000 -0500
>@@ -39,6 +39,30 @@
> #include "spinlock.h"
> #else
> #include "includes.h"
>+
>+#if defined(PARANOID_MALLOC_CHECKER)
>+#ifdef malloc
>+#undef malloc
>+#endif
>+
>+#ifdef realloc
>+#undef realloc
>+#endif
>+
>+#ifdef calloc
>+#undef calloc
>+#endif
>+
>+#ifdef strdup
>+#undef strdup
>+#endif
>+
>+#ifdef strndup
>+#undef strndup
>+#endif
>+
>+#endif
>+
> #endif
> 
> #define TDB_MAGIC_FOOD "TDB file\n"
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/tdb/tdbutil.c samba-2.2.12-backport/source/tdb/tdbutil.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/tdb/tdbutil.c	2004-08-12 14:24:35.000000000 -0400
>+++ samba-2.2.12-backport/source/tdb/tdbutil.c	2004-12-16 00:31:26.000000000 -0500
>@@ -484,7 +484,7 @@
> 			len += *i;
> 			if (bufsize < len)
> 				goto no_space;
>-			*b = (char *)malloc(*i);
>+			*b = (char *)SMB_MALLOC(*i);
> 			if (! *b)
> 				goto no_space;
> 			memcpy(*b, buf+4, *i);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/utils/make_printerdef.c samba-2.2.12-backport/source/utils/make_printerdef.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/utils/make_printerdef.c	2004-08-12 14:24:34.000000000 -0400
>+++ samba-2.2.12-backport/source/utils/make_printerdef.c	2004-12-15 23:57:43.000000000 -0500
>@@ -83,8 +83,8 @@
>   char *temp;
>   int i=0;
>  
>-  *entry=(char *)malloc(sizeof(pstring));
>-  value=(char *)malloc(sizeof(pstring));
>+  *entry=(char *)SMB_MALLOC(sizeof(pstring));
>+  value=(char *)SMB_MALLOC(sizeof(pstring));
> 
>   if(*entry == NULL || value == NULL) {
>     fprintf(stderr,"scan: malloc fail !\n");
>@@ -151,8 +151,8 @@
>   int found=0,pointeur=0,i=0;
>   char *temp,*temp2;
>   
>-  temp=(char *)malloc(sizeof(pstring));
>-  temp2=(char *)malloc(sizeof(pstring));
>+  temp=(char *)SMB_MALLOC(sizeof(pstring));
>+  temp2=(char *)SMB_MALLOC(sizeof(pstring));
>   
>   if(temp == NULL || temp2 == NULL) {
> 	  safe_free(temp);
>@@ -215,8 +215,8 @@
>   int found=0,pointeur=0,i=0;
>   char *temp,*temp2;
>   
>-  temp=(char *)malloc(sizeof(pstring));
>-  temp2=(char *)malloc(sizeof(pstring));
>+  temp=(char *)SMB_MALLOC(sizeof(pstring));
>+  temp2=(char *)SMB_MALLOC(sizeof(pstring));
>   
>   if(temp == NULL || temp2 == NULL) {
> 	  safe_free(temp);
>@@ -273,9 +273,9 @@
> 
>   int found=0;
> 
>-  chaine=(char *)malloc(sizeof(pstring));
>-  long_desc=(char *)malloc(sizeof(pstring));
>-  short_desc=(char *)malloc(sizeof(pstring));
>+  chaine=(char *)SMB_MALLOC(sizeof(pstring));
>+  long_desc=(char *)SMB_MALLOC(sizeof(pstring));
>+  short_desc=(char *)SMB_MALLOC(sizeof(pstring));
>   if (!chaine || !long_desc || !short_desc) {
> 	  safe_free(chaine);
> 	  safe_free(long_desc);
>@@ -450,7 +450,7 @@
>   languagemonitor=0;
>   vendorsetup=0;
>   datatype="RAW";
>-  if((temp=(char *)malloc(sizeof(pstring))) == NULL) {
>+  if((temp=(char *)SMB_MALLOC(sizeof(pstring))) == NULL) {
>     fprintf(stderr, "scan_short_desc: malloc fail !\n");
>     exit(1);
>   }
>@@ -572,7 +572,7 @@
>   lookup_entry(inf_file,"DestinationDirs");
>   build_subdir();
> 
>-  if((files_to_copy=(char *)malloc(2048*sizeof(char))) == NULL) {
>+  if((files_to_copy=(char *)SMB_MALLOC(2048*sizeof(char))) == NULL) {
>     fprintf(stderr, "%s: malloc fail.\n", argv[0] );
>     exit(1);
>   }
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/utils/make_smbcodepage.c samba-2.2.12-backport/source/utils/make_smbcodepage.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/utils/make_smbcodepage.c	2004-08-12 14:24:34.000000000 -0400
>+++ samba-2.2.12-backport/source/utils/make_smbcodepage.c	2004-12-16 11:41:33.000000000 -0500
>@@ -67,7 +67,7 @@
>   pstring linebuf;
>   char *p = *buf;
>   int num_lines = 0;
>-  char *newbuf = (char *)malloc( *size + 1);
>+  char *newbuf = (char *)SMB_MALLOC( *size + 1);
>   char *newbuf_p = NULL;
> 
>   if(newbuf == NULL)
>@@ -198,7 +198,7 @@
>   }
> 
>   /* As we will be reading text, allocate one more byte for a '\0' */
>-  if((buf = (char *)malloc( size + 1 )) == NULL)
>+  if((buf = (char *)SMB_MALLOC( size + 1 )) == NULL)
>   {
>     fprintf(stderr, "%s: malloc fail for size %d.\n", prog_name, size + 1);
>     fclose(fp);
>@@ -398,7 +398,7 @@
>   } 
>   
>   /* Allocate space for the code page file and read it all in. */
>-  if((buf = (char *)malloc( size )) == NULL)
>+  if((buf = (char *)SMB_MALLOC( size )) == NULL)
>   { 
>     fprintf (stderr, "%s: malloc fail for size %d.\n",
>              prog_name, size );
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/utils/make_unicodemap.c samba-2.2.12-backport/source/utils/make_unicodemap.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/utils/make_unicodemap.c	2004-08-12 14:24:34.000000000 -0400
>+++ samba-2.2.12-backport/source/utils/make_unicodemap.c	2004-12-16 11:41:33.000000000 -0500
>@@ -66,7 +66,7 @@
>   pstring linebuf;
>   char *p = *buf;
>   size_t num_lines = 0;
>-  char *newbuf = (char *)malloc( *size + 1);
>+  char *newbuf = (char *)SMB_MALLOC( *size + 1);
>   char *newbuf_p = NULL;
> 
>   if(newbuf == NULL) {
>@@ -163,7 +163,7 @@
>   }
> 
>   /* As we will be reading text, allocate one more byte for a '\0' */
>-  if((buf = (char *)malloc( size + 1 )) == NULL) {
>+  if((buf = (char *)SMB_MALLOC( size + 1 )) == NULL) {
>     fprintf(stderr, "%s: malloc fail for size %d.\n", prog_name, size + 1);
>     fclose(fp);
>     exit(1);
>@@ -248,7 +248,7 @@
> 
>   size = UNICODE_MAP_HEADER_SIZE + (multibyte_code_page ? (4*65536) : (2*256 + 2*65536));
> 
>-  if((output_buf = (char *)malloc( size )) == NULL) {
>+  if((output_buf = (char *)SMB_MALLOC( size )) == NULL) {
>     fprintf(stderr, "%s: output buffer malloc fail for size %d.\n", prog_name, size);
>     fclose(fp);
>     exit(1);
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/utils/smbcacls.c samba-2.2.12-backport/source/utils/smbcacls.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/utils/smbcacls.c	2004-08-12 14:24:35.000000000 -0400
>+++ samba-2.2.12-backport/source/utils/smbcacls.c	2004-12-16 15:12:47.000000000 -0500
>@@ -337,7 +337,7 @@
> 		return True;
> 	}
> 
>-	aces = calloc(1+(*the_acl)->num_aces,sizeof(SEC_ACE));
>+	aces = SMB_XMALLOC_ARRAY( SEC_ACE, 1+(*the_acl)->num_aces );
> 	memcpy(aces, (*the_acl)->ace, (*the_acl)->num_aces * sizeof(SEC_ACE));
> 	memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
> 	new = make_sec_acl(ctx,(*the_acl)->revision,1+(*the_acl)->num_aces, aces);
>@@ -365,7 +365,7 @@
> 		}
> 
> 		if (strncmp(tok,"OWNER:", 6) == 0) {
>-			owner_sid = (DOM_SID *)calloc(1, sizeof(DOM_SID));
>+			owner_sid = SMB_CALLOC_ARRAY(DOM_SID, 1 );
> 			if (!owner_sid ||
> 			    !StringToSid(owner_sid, tok+6)) {
> 				printf("Failed to parse owner sid\n");
>@@ -375,7 +375,7 @@
> 		}
> 
> 		if (strncmp(tok,"GROUP:", 6) == 0) {
>-			grp_sid = (DOM_SID *)calloc(1, sizeof(DOM_SID));
>+			grp_sid = SMB_CALLOC_ARRAY( DOM_SID, 1);
> 			if (!grp_sid ||
> 			    !StringToSid(grp_sid, tok+6)) {
> 				printf("Failed to parse group sid\n");
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/utils/smbpasswd.c samba-2.2.12-backport/source/utils/smbpasswd.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/utils/smbpasswd.c	2004-08-12 14:24:34.000000000 -0400
>+++ samba-2.2.12-backport/source/utils/smbpasswd.c	2004-12-15 23:57:43.000000000 -0500
>@@ -56,7 +56,7 @@
> 
> static char *strdup_x(const char *s)
> {
>-	char *new_s = strdup(s);
>+	char *new_s = SMB_STRDUP(s);
> 	if (!new_s) {
> 		fprintf(stderr,"out of memory\n");
> 		exit(1);
>@@ -538,8 +538,7 @@
> 	{
> 		UNISTR2 upw;	/* Unicode password */
> 
>-		upw.buffer = (uint16 *)talloc_zero(mem_ctx, 0xc * 
>-						   sizeof(uint16));
>+		upw.buffer = TALLOC_ZERO_ARRAY(mem_ctx, uint16, 0xc);
> 
> 		upw.uni_str_len = 0xc;
> 		upw.uni_max_len = 0xc;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/utils/status.c samba-2.2.12-backport/source/utils/status.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/utils/status.c	2004-08-12 14:24:34.000000000 -0400
>+++ samba-2.2.12-backport/source/utils/status.c	2004-12-15 23:56:19.000000000 -0500
>@@ -544,7 +544,7 @@
> 			ptr=ptr->next;
> 		}
> 		if (ptr==NULL) {
>-			ptr=(struct session_record *) malloc(sizeof(struct session_record));
>+			ptr= SMB_MALLOC_P(struct session_record);
> 			if (!ptr)
> 				return 0;
> 			ptr->uid=crec.uid;
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/web/cgi.c samba-2.2.12-backport/source/web/cgi.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/web/cgi.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/web/cgi.c	2004-12-17 11:55:53.000000000 -0500
>@@ -91,12 +91,12 @@
> 
> 	while ((*cl)) {
> 		int c;
>-	
>+
> 		if (i == len) {
> 			char *ret2;
> 			if (len == 0) len = 1024;
> 			else len *= 2;
>-			ret2 = (char *)Realloc(ret, len);
>+			ret2 = (char *)SMB_REALLOC(ret, len);
> 			if (!ret2) return ret;
> 			ret = ret2;
> 		}
>@@ -165,8 +165,8 @@
> 			
> 			*p = 0;
> 			
>-			variables[num_variables].name = strdup(line);
>-			variables[num_variables].value = strdup(p+1);
>+			variables[num_variables].name = SMB_STRDUP(line);
>+			variables[num_variables].value = SMB_STRDUP(p+1);
> 
> 			SAFE_FREE(line);
> 			
>@@ -205,8 +205,8 @@
> 			
> 			*p = 0;
> 			
>-			variables[num_variables].name = strdup(tok);
>-			variables[num_variables].value = strdup(p+1);
>+			variables[num_variables].name = SMB_STRDUP(tok);
>+			variables[num_variables].value = SMB_STRDUP(p+1);
> 
> 			if (!variables[num_variables].name || 
> 			    !variables[num_variables].value)
>@@ -392,7 +392,7 @@
> 		}
> 
> 		/* Save the users name */
>-		C_user = strdup(user);
>+		C_user = SMB_STRDUP(user);
> 		return True;
> 	}
> 
>@@ -520,11 +520,11 @@
> 		if (line[0] == '\r' || line[0] == '\n') break;
> 		if (strncasecmp(line,"GET ", 4)==0) {
> 			got_request = True;
>-			url = strdup(&line[4]);
>+			url = SMB_STRDUP(&line[4]);
> 		} else if (strncasecmp(line,"POST ", 5)==0) {
> 			got_request = True;
> 			request_post = 1;
>-			url = strdup(&line[5]);
>+			url = SMB_STRDUP(&line[5]);
> 		} else if (strncasecmp(line,"PUT ", 4)==0) {
> 			got_request = True;
> 			cgi_setup_error("400 Bad Request", "",
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/web/statuspage.c samba-2.2.12-backport/source/web/statuspage.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/web/statuspage.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/web/statuspage.c	2004-12-15 23:53:00.000000000 -0500
>@@ -58,14 +58,14 @@
> 	if (PID_or_Machine) {
> 		PIDMAP *newmap;
> 
>-		if ((newmap = (PIDMAP *) malloc (sizeof (PIDMAP))) == NULL) {
>+		if ((newmap = SMB_MALLOC_P(PIDMAP)) == NULL) {
> 			/* XXX need error message for this?
> 			   if malloc fails, PID is always shown */
> 			return;
> 		}
> 
> 		newmap->pid = pid;
>-		newmap->machine = strdup (machine);
>+		newmap->machine = SMB_STRDUP (machine);
> 
> 		DLIST_ADD(pidmap, newmap);
> 	}
>diff -r -u samba-2.2.12-pre-CAN-2004-1154/source/web/swat.c samba-2.2.12-backport/source/web/swat.c
>--- samba-2.2.12-pre-CAN-2004-1154/source/web/swat.c	2004-08-12 14:24:27.000000000 -0400
>+++ samba-2.2.12-backport/source/web/swat.c	2004-12-15 23:53:00.000000000 -0500
>@@ -113,9 +113,9 @@
> 		}
> 	}
> 	if (length == destlen) {
>-		return(strdup(str));
>+		return(SMB_STRDUP(str));
> 	}
>-	p = dststr = malloc(destlen + 1);
>+	p = dststr = SMB_MALLOC(destlen + 1);
> 	if (!dststr) {
> 		return(NULL);
> 	}

Actions: View | Diff

Attachments on bug 64119: 26942 | 27037 | 27038 | 27039 | 27040 | 27041 | 27150 | 27305