sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-12-02 00:23:50 +03:00
Code Activity

r23080: Fix bug #4637 - we hads missed some cases where

Browse Source 
we were calling PRS_ALLOC_MEM with zero count.
Jeremy.
This commit is contained in:
Jeremy Allison
2007-05-22 20:20:01 +00:00
committed by Gerald (Jerry) Carter
parent 4d9e8c91dc
commit 9a10736e6f
7 changed files with 120 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
source/libads/authdata.c
View File

@@ -120,10 +120,14 @@ static BOOL pac_io_krb_sid_and_attr_array(const char *desc,
return False; return False;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
array->krb_sid_and_attrs = PRS_ALLOC_MEM(ps, KRB_SID_AND_ATTRS, num); if (num) {
if (!array->krb_sid_and_attrs) { array->krb_sid_and_attrs = PRS_ALLOC_MEM(ps, KRB_SID_AND_ATTRS, num);
DEBUG(3, ("No memory available\n")); if (!array->krb_sid_and_attrs) {
return False; DEBUG(3, ("No memory available\n"));
return False;
}
} else {
array->krb_sid_and_attrs = NULL;
} }
} }
@@ -184,10 +188,14 @@ static BOOL pac_io_group_membership_array(const char *desc,
return False; return False;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
array->group_membership = PRS_ALLOC_MEM(ps, GROUP_MEMBERSHIP, num); if (num) {
if (!array->group_membership) { array->group_membership = PRS_ALLOC_MEM(ps, GROUP_MEMBERSHIP, num);
DEBUG(3, ("No memory available\n")); if (!array->group_membership) {
return False; DEBUG(3, ("No memory available\n"));
return False;
}
} else {
array->group_membership = NULL;
} }
} }
@@ -456,10 +464,14 @@ static BOOL pac_io_pac_signature_data(const char *desc,
return False; return False;
if (UNMARSHALLING(ps) && length) { if (UNMARSHALLING(ps) && length) {
data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, siglen); if (siglen) {
if (!data->signature.buffer) { data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, siglen);
DEBUG(3, ("No memory available\n")); if (!data->signature.buffer) {
return False; DEBUG(3, ("No memory available\n"));
return False;
}
} else {
data->signature.buffer = NULL;
} }
} }

8
source/registry/regfio.c
View File

@@ -642,8 +642,12 @@ static BOOL hbin_prs_lf_records( const char *desc, REGF_HBIN *hbin, int depth, R
return False; return False;
if ( UNMARSHALLING(&hbin->ps) ) { if ( UNMARSHALLING(&hbin->ps) ) {
if ( !(lf->hashes = PRS_ALLOC_MEM( &hbin->ps, REGF_HASH_REC, lf->num_keys )) ) if (lf->num_keys) {
return False; if ( !(lf->hashes = PRS_ALLOC_MEM( &hbin->ps, REGF_HASH_REC, lf->num_keys )) )
return False;
} else {
lf->hashes = NULL;
}
} }
for ( i=0; i<lf->num_keys; i++ ) { for ( i=0; i<lf->num_keys; i++ ) {

20
source/rpc_parse/parse_lsa.c
View File

@@ -1178,7 +1178,7 @@ static BOOL lsa_io_sid_enum(const char *desc, LSA_SID_ENUM *sen, prs_struct *ps,
/* Mallocate memory if we're unpacking from the wire */ /* Mallocate memory if we're unpacking from the wire */
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && sen->num_entries) {
if ((sen->ptr_sid = PRS_ALLOC_MEM( ps, uint32, sen->num_entries)) == NULL) { if ((sen->ptr_sid = PRS_ALLOC_MEM( ps, uint32, sen->num_entries)) == NULL) {
DEBUG(3, ("init_lsa_sid_enum(): out of memory for " DEBUG(3, ("init_lsa_sid_enum(): out of memory for "
"ptr_sid\n")); "ptr_sid\n"));
@@ -1361,7 +1361,7 @@ static BOOL lsa_io_trans_names(const char *desc, LSA_TRANS_NAME_ENUM *trn,
return False; return False;
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && trn->num_entries2) {
if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME, trn->num_entries2)) == NULL) { if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME, trn->num_entries2)) == NULL) {
return False; return False;
} }
@@ -1423,7 +1423,7 @@ static BOOL lsa_io_trans_names2(const char *desc, LSA_TRANS_NAME_ENUM2 *trn,
return False; return False;
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && trn->num_entries2) {
if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME2, trn->num_entries2)) == NULL) { if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME2, trn->num_entries2)) == NULL) {
return False; return False;
} }
@@ -1700,7 +1700,7 @@ BOOL lsa_io_r_lookup_names(const char *desc, LSA_R_LOOKUP_NAMES *out, prs_struct
return False; return False;
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && out->num_entries2) {
if ((out->dom_rid = PRS_ALLOC_MEM(ps, DOM_RID, out->num_entries2)) if ((out->dom_rid = PRS_ALLOC_MEM(ps, DOM_RID, out->num_entries2))
== NULL) { == NULL) {
DEBUG(3, ("lsa_io_r_lookup_names(): out of memory\n")); DEBUG(3, ("lsa_io_r_lookup_names(): out of memory\n"));
@@ -1825,7 +1825,7 @@ BOOL lsa_io_r_lookup_names2(const char *desc, LSA_R_LOOKUP_NAMES2 *out, prs_stru
return False; return False;
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && out->num_entries2) {
if ((out->dom_rid = PRS_ALLOC_MEM(ps, DOM_RID2, out->num_entries2)) if ((out->dom_rid = PRS_ALLOC_MEM(ps, DOM_RID2, out->num_entries2))
== NULL) { == NULL) {
DEBUG(3, ("lsa_io_r_lookup_names2(): out of memory\n")); DEBUG(3, ("lsa_io_r_lookup_names2(): out of memory\n"));
@@ -1978,7 +1978,7 @@ BOOL lsa_io_r_lookup_names3(const char *desc, LSA_R_LOOKUP_NAMES3 *out, prs_stru
return False; return False;
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && out->num_entries2) {
if ((out->trans_sids = PRS_ALLOC_MEM(ps, LSA_TRANSLATED_SID3, out->num_entries2)) if ((out->trans_sids = PRS_ALLOC_MEM(ps, LSA_TRANSLATED_SID3, out->num_entries2))
== NULL) { == NULL) {
DEBUG(3, ("lsa_io_r_lookup_names3(): out of memory\n")); DEBUG(3, ("lsa_io_r_lookup_names3(): out of memory\n"));
@@ -2107,7 +2107,7 @@ BOOL lsa_io_r_lookup_names4(const char *desc, LSA_R_LOOKUP_NAMES4 *out, prs_stru
return False; return False;
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && out->num_entries2) {
if ((out->trans_sids = PRS_ALLOC_MEM(ps, LSA_TRANSLATED_SID3, out->num_entries2)) if ((out->trans_sids = PRS_ALLOC_MEM(ps, LSA_TRANSLATED_SID3, out->num_entries2))
== NULL) { == NULL) {
DEBUG(3, ("lsa_io_r_lookup_names4(): out of memory\n")); DEBUG(3, ("lsa_io_r_lookup_names4(): out of memory\n"));
@@ -2346,7 +2346,7 @@ BOOL lsa_io_r_enum_privs(const char *desc, LSA_R_ENUM_PRIVS *out, prs_struct *ps
if(!prs_uint32("count1", ps, depth, &out->count1)) if(!prs_uint32("count1", ps, depth, &out->count1))
return False; return False;
if (UNMARSHALLING(ps)) if (UNMARSHALLING(ps) && out->count1)
if (!(out->privs = PRS_ALLOC_MEM(ps, LSA_PRIV_ENTRY, out->count1))) if (!(out->privs = PRS_ALLOC_MEM(ps, LSA_PRIV_ENTRY, out->count1)))
return False; return False;
@@ -3908,7 +3908,7 @@ static BOOL smb_io_lsa_data_buf(const char *desc, LSA_DATA_BUF *buf,
prs_debug(ps, depth, desc, "smb_io_lsa_data_buf"); prs_debug(ps, depth, desc, "smb_io_lsa_data_buf");
depth++; depth++;
if ( UNMARSHALLING(ps) ) { if ( UNMARSHALLING(ps) && length ) {
if ( !(buf->data = PRS_ALLOC_MEM( ps, uint8, length )) ) if ( !(buf->data = PRS_ALLOC_MEM( ps, uint8, length )) )
return False; return False;
} }
@@ -3922,7 +3922,7 @@ static BOOL smb_io_lsa_data_buf(const char *desc, LSA_DATA_BUF *buf,
if (!prs_uint32("length", ps, depth, &buf->length)) if (!prs_uint32("length", ps, depth, &buf->length))
return False; return False;
if(!prs_uint8s(False, "data", ps, depth, buf->data, size)) if(!prs_uint8s(False, "data", ps, depth, buf->data, length))
return False; return False;
return True; return True;

23
source/rpc_parse/parse_net.c
View File

@@ -1813,9 +1813,13 @@ BOOL net_io_user_info3(const char *desc, NET_USER_INFO_3 *usr, prs_struct *ps,
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
usr->gids = PRS_ALLOC_MEM(ps, DOM_GID, usr->num_groups); if (usr->num_groups) {
if (usr->gids == NULL) usr->gids = PRS_ALLOC_MEM(ps, DOM_GID, usr->num_groups);
return False; if (usr->gids == NULL)
return False;
} else {
usr->gids = NULL;
}
} }
for (i = 0; i < usr->num_groups; i++) { for (i = 0; i < usr->num_groups; i++) {
@@ -1848,10 +1852,15 @@ BOOL net_io_user_info3(const char *desc, NET_USER_INFO_3 *usr, prs_struct *ps,
return False; return False;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
usr->other_sids = PRS_ALLOC_MEM(ps, DOM_SID2, usr->num_other_sids); if (usr->num_other_sids) {
usr->other_sids_attrib = usr->other_sids = PRS_ALLOC_MEM(ps, DOM_SID2, usr->num_other_sids);
PRS_ALLOC_MEM(ps, uint32, usr->num_other_sids); usr->other_sids_attrib =
PRS_ALLOC_MEM(ps, uint32, usr->num_other_sids);
} else {
usr->other_sids = NULL;
usr->other_sids_attrib = NULL;
}
if ((num_other_sids != 0) && if ((num_other_sids != 0) &&
((usr->other_sids == NULL) || ((usr->other_sids == NULL) ||
(usr->other_sids_attrib == NULL))) (usr->other_sids_attrib == NULL)))

48
source/rpc_parse/parse_prs.c
View File

@@ -644,8 +644,12 @@ BOOL prs_pointer( const char *name, prs_struct *ps, int depth,
return True; return True;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
if ( !(*data = PRS_ALLOC_MEM(ps, char, data_size)) ) if (data_size) {
return False; if ( !(*data = PRS_ALLOC_MEM(ps, char, data_size)) )
return False;
} else {
*data = NULL;
}
} }
return prs_fn(name, ps, depth, *data); return prs_fn(name, ps, depth, *data);
@@ -1016,16 +1020,16 @@ BOOL prs_buffer5(BOOL charmode, const char *name, prs_struct *ps, int depth, BUF
if (q == NULL) if (q == NULL)
return False; return False;
/* If the string is empty, we don't have anything to stream */
if (str->buf_len==0)
return True;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
str->buffer = PRS_ALLOC_MEM(ps,uint16,str->buf_len); str->buffer = PRS_ALLOC_MEM(ps,uint16,str->buf_len);
if (str->buffer == NULL) if (str->buffer == NULL)
return False; return False;
} }
/* If the string is empty, we don't have anything to stream */
if (str->buf_len==0)
return True;
p = (char *)str->buffer; p = (char *)str->buffer;
dbg_rw_punival(charmode, name, depth, ps, q, p, str->buf_len); dbg_rw_punival(charmode, name, depth, ps, q, p, str->buf_len);
@@ -1055,6 +1059,8 @@ BOOL prs_regval_buffer(BOOL charmode, const char *name, prs_struct *ps, int dept
buf->buffer = PRS_ALLOC_MEM(ps, uint16, buf->buf_max_len); buf->buffer = PRS_ALLOC_MEM(ps, uint16, buf->buf_max_len);
if ( buf->buffer == NULL ) if ( buf->buffer == NULL )
return False; return False;
} else {
buf->buffer = NULL;
} }
} }
@@ -1082,9 +1088,13 @@ BOOL prs_string2(BOOL charmode, const char *name, prs_struct *ps, int depth, STR
if (str->str_str_len > str->str_max_len) { if (str->str_str_len > str->str_max_len) {
return False; return False;
} }
str->buffer = PRS_ALLOC_MEM(ps,unsigned char, str->str_max_len); if (str->str_max_len) {
if (str->buffer == NULL) str->buffer = PRS_ALLOC_MEM(ps,unsigned char, str->str_max_len);
return False; if (str->buffer == NULL)
return False;
} else {
str->buffer = NULL;
}
} }
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
@@ -1129,9 +1139,13 @@ BOOL prs_unistr2(BOOL charmode, const char *name, prs_struct *ps, int depth, UNI
if (str->uni_str_len > str->uni_max_len) { if (str->uni_str_len > str->uni_max_len) {
return False; return False;
} }
str->buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_max_len); if (str->uni_max_len) {
if (str->buffer == NULL) str->buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_max_len);
return False; if (str->buffer == NULL)
return False;
} else {
str->buffer = NULL;
}
} }
p = (char *)str->buffer; p = (char *)str->buffer;
@@ -1156,9 +1170,13 @@ BOOL prs_unistr3(BOOL charmode, const char *name, UNISTR3 *str, prs_struct *ps,
return False; return False;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps)) {
str->str.buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_str_len); if (str->uni_str_len) {
if (str->str.buffer == NULL) str->str.buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_str_len);
return False; if (str->str.buffer == NULL)
return False;
} else {
str->str.buffer = NULL;
}
} }
p = (char *)str->str.buffer; p = (char *)str->str.buffer;

22
source/rpc_parse/parse_samr.c
View File

@@ -3398,7 +3398,7 @@ BOOL samr_io_r_enum_domains(const char *desc, SAMR_R_ENUM_DOMAINS * r_u,
if(!prs_uint32("num_entries3", ps, depth, &r_u->num_entries3)) if(!prs_uint32("num_entries3", ps, depth, &r_u->num_entries3))
return False; return False;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && r_u->num_entries2) {
r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2); r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2);
r_u->uni_dom_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2); r_u->uni_dom_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2);
} }
@@ -3537,7 +3537,7 @@ BOOL samr_io_r_enum_dom_groups(const char *desc, SAMR_R_ENUM_DOM_GROUPS * r_u,
if(!prs_uint32("num_entries3", ps, depth, &r_u->num_entries3)) if(!prs_uint32("num_entries3", ps, depth, &r_u->num_entries3))
return False; return False;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && r_u->num_entries2) {
r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2); r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2);
r_u->uni_grp_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2); r_u->uni_grp_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2);
} }
@@ -5067,12 +5067,13 @@ BOOL samr_io_r_lookup_names(const char *desc, SAMR_R_LOOKUP_NAMES * r_u,
return False; return False;
} }
if (UNMARSHALLING(ps)) if (UNMARSHALLING(ps) && r_u->num_rids2) {
r_u->rids = PRS_ALLOC_MEM(ps, uint32, r_u->num_rids2); r_u->rids = PRS_ALLOC_MEM(ps, uint32, r_u->num_rids2);
if (!r_u->rids) { if (!r_u->rids) {
DEBUG(0, ("NULL rids in samr_io_r_lookup_names\n")); DEBUG(0, ("NULL rids in samr_io_r_lookup_names\n"));
return False; return False;
}
} }
for (i = 0; i < r_u->num_rids2; i++) { for (i = 0; i < r_u->num_rids2; i++) {
@@ -5096,12 +5097,13 @@ BOOL samr_io_r_lookup_names(const char *desc, SAMR_R_LOOKUP_NAMES * r_u,
return False; return False;
} }
if (UNMARSHALLING(ps)) if (UNMARSHALLING(ps) && r_u->num_types2) {
r_u->types = PRS_ALLOC_MEM(ps, uint32, r_u->num_types2); r_u->types = PRS_ALLOC_MEM(ps, uint32, r_u->num_types2);
if (!r_u->types) { if (!r_u->types) {
DEBUG(0, ("NULL types in samr_io_r_lookup_names\n")); DEBUG(0, ("NULL types in samr_io_r_lookup_names\n"));
return False; return False;
}
} }
for (i = 0; i < r_u->num_types2; i++) { for (i = 0; i < r_u->num_types2; i++) {

34
source/rpc_parse/parse_spoolss.c
View File

@@ -256,7 +256,7 @@ static BOOL smb_io_notify_option_type_ctr(const char *desc, SPOOL_NOTIFY_OPTION_
return False; return False;
/* reading */ /* reading */
if (UNMARSHALLING(ps)) if (UNMARSHALLING(ps) && ctr->count)
if((ctr->type=PRS_ALLOC_MEM(ps,SPOOL_NOTIFY_OPTION_TYPE,ctr->count)) == NULL) if((ctr->type=PRS_ALLOC_MEM(ps,SPOOL_NOTIFY_OPTION_TYPE,ctr->count)) == NULL)
return False; return False;
@@ -415,7 +415,7 @@ BOOL smb_io_notify_info_data_strings(const char *desc,SPOOL_NOTIFY_INFO_DATA *da
if(!prs_uint32("string length", ps, depth, &data->notify_data.data.length)) if(!prs_uint32("string length", ps, depth, &data->notify_data.data.length))
return False; return False;
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && data->notify_data.data.length) {
data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16, data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16,
data->notify_data.data.length); data->notify_data.data.length);
@@ -434,7 +434,7 @@ BOOL smb_io_notify_info_data_strings(const char *desc,SPOOL_NOTIFY_INFO_DATA *da
case NOTIFY_POINTER: case NOTIFY_POINTER:
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && data->notify_data.data.length) {
data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16, data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16,
data->notify_data.data.length); data->notify_data.data.length);
@@ -494,9 +494,13 @@ BOOL smb_io_notify_info_data_strings(const char *desc,SPOOL_NOTIFY_INFO_DATA *da
/* Tallocate memory for string */ /* Tallocate memory for string */
data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16, x * 2); if (x) {
if (!data->notify_data.data.string) data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16, x * 2);
return False; if (!data->notify_data.data.string)
return False;
} else {
data->notify_data.data.string = NULL;
}
if(!prs_uint16uni(True,"string",ps,depth,data->notify_data.data.string,x)) if(!prs_uint16uni(True,"string",ps,depth,data->notify_data.data.string,x))
return False; return False;
@@ -6001,14 +6005,14 @@ BOOL spoolss_io_q_setprinterdata(const char *desc, SPOOL_Q_SETPRINTERDATA *q_u,
case REG_BINARY: case REG_BINARY:
case REG_DWORD: case REG_DWORD:
case REG_MULTI_SZ: case REG_MULTI_SZ:
if (q_u->max_len) { if (q_u->max_len) {
if (UNMARSHALLING(ps)) if (UNMARSHALLING(ps))
q_u->data=PRS_ALLOC_MEM(ps, uint8, q_u->max_len); q_u->data=PRS_ALLOC_MEM(ps, uint8, q_u->max_len);
if(q_u->data == NULL) if(q_u->data == NULL)
return False; return False;
if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len)) if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))
return False; return False;
} }
if(!prs_align(ps)) if(!prs_align(ps))
return False; return False;
break; break;
@@ -7031,7 +7035,7 @@ static BOOL spoolss_io_printer_enum_values_ctr(const char *desc, prs_struct *ps,
/* first loop to write basic enum_value information */ /* first loop to write basic enum_value information */
if (UNMARSHALLING(ps)) { if (UNMARSHALLING(ps) && ctr->size_of_array) {
ctr->values = PRS_ALLOC_MEM(ps, PRINTER_ENUM_VALUES, ctr->size_of_array); ctr->values = PRS_ALLOC_MEM(ps, PRINTER_ENUM_VALUES, ctr->size_of_array);
if (!ctr->values) if (!ctr->values)
return False; return False;