r1983: a completely new implementation of talloc

This version does the following:

  1) talloc_free(), talloc_realloc() and talloc_steal() lose their
     (redundent) first arguments

  2) you can use _any_ talloc pointer as a talloc context to allocate
     more memory. This allows you to create complex data structures
     where the top level structure is the logical parent of the next
     level down, and those are the parents of the level below
     that. Then destroy either the lot with a single talloc_free() or
     destroy any sub-part with a talloc_free() of that part

  3) you can name any pointer. Use talloc_named() which is just like
     talloc() but takes the printf style name argument as well as the
     parent context and the size.

The whole thing ends up being a very simple piece of code, although
some of the pointer walking gets hairy.

So far, I'm just using the new talloc() like the old one. The next
step is to actually take advantage of the new interface
properly. Expect some new commits soon that simplify some common
coding styles in samba4 by using the new talloc().
(This used to be commit e35bb094c5)

source4/auth/auth_sam.c

@@ -339,7 +339,7 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 		}
 		
 		if (group_ret > 0 && 
-		    !(groupSIDs = talloc_realloc_p((*server_info)->mem_ctx, groupSIDs, 
+		    !(groupSIDs = talloc_realloc_p(groupSIDs, 
 						   struct dom_sid *, group_ret))) {
 			talloc_destroy((*server_info)->mem_ctx);
 			samdb_close(sam_ctx);

source4/include/talloc.h

@@ -3,8 +3,8 @@
 /* 
    Unix SMB/CIFS implementation.
    Samba temporary memory allocation functions
-   Copyright (C) Andrew Tridgell 2000
+
-   Copyright (C) 2001 by Martin Pool <mbp@samba.org>
+   Copyright (C) Andrew Tridgell 2004
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -21,40 +21,19 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
-/**
+/* this is only needed for compatibility with the old talloc */
- * @ingroup talloc
+typedef void TALLOC_CTX;
- * @{
- * @sa talloc.c
- */
-
-/**
- * talloc allocation pool.  All allocated blocks can be freed in one go.
- **/
-typedef struct talloc_ctx TALLOC_CTX;
-
-TALLOC_CTX *talloc_init(char const *fmt, ...) PRINTF_ATTRIBUTE(1, 2);
-
-char *talloc_vasprintf(TALLOC_CTX *t, const char *fmt, va_list ap)
-	PRINTF_ATTRIBUTE(2, 0);
-
-char *talloc_asprintf(TALLOC_CTX *t, const char *fmt, ...)
-	PRINTF_ATTRIBUTE(2, 3);
-
-char *talloc_vasprintf_append(TALLOC_CTX *t, char *, const char *, va_list ap)
-	PRINTF_ATTRIBUTE(3, 0);
-
-char *talloc_asprintf_append(TALLOC_CTX *t, char *, const char *, ...)
-	PRINTF_ATTRIBUTE(3, 4);
 
 /* useful macros for creating type checked pointers */
 #define talloc_p(ctx, type) (type *)talloc(ctx, sizeof(type))
-#define talloc_array_p(ctx, type, count) (type *)talloc_realloc_array(ctx, NULL, sizeof(type), count)
+#define talloc_array_p(ctx, type, count) (type *)talloc_array(ctx, sizeof(type), count)
-#define talloc_realloc_p(ctx, p, type, count) (type *)talloc_realloc_array(ctx, p, sizeof(type), count)
+#define talloc_realloc_p(p, type, count) (type *)talloc_realloc_array(p, sizeof(type), count)
+
+#define talloc_destroy(ctx) talloc_free(ctx)
 
 #define malloc_p(type) (type *)malloc(sizeof(type))
 #define malloc_array_p(type, count) (type *)realloc_array(NULL, sizeof(type), count)
 #define realloc_p(p, type, count) (type *)realloc_array(p, sizeof(type), count)
 
-/** @} */
+#endif
 
-#endif /* ndef _TALLOC_H_ */

source4/lib/data_blob.c

@@ -108,7 +108,7 @@ DATA_BLOB data_blob_talloc_steal(TALLOC_CTX *old_ctx, TALLOC_CTX *new_ctx,
 {
 	DATA_BLOB new;
 	new = *old;
-	new.data = talloc_steal(old_ctx, new_ctx, old->data);
+	new.data = talloc_steal(new_ctx, old->data);
 	if (new.data == NULL) {
 		smb_panic("data_blob_talloc_steal: talloc_steal failed.\n");
 	}

source4/lib/registry/common/reg_interface.c

@@ -214,7 +214,7 @@ WERROR reg_open_key(REG_KEY *parent, const char *name, REG_KEY **result)
 	(*result)->path = talloc_asprintf((*result)->mem_ctx, "%s\\%s", 
 								 reg_key_get_path_abs(parent), (*result)->name);
 	(*result)->hive = parent->hive;
-	talloc_steal(mem_ctx, (*result)->mem_ctx, fullname);
+	talloc_steal((*result)->mem_ctx, fullname);
 
 	talloc_destroy(mem_ctx);
 

source4/lib/registry/reg_backend_dir/reg_backend_dir.c

@@ -65,7 +65,7 @@ static WERROR reg_dir_open_key(REG_HANDLE *h, int hive, const char *name, REG_KE
 	}
 	closedir(d);
 	ret = reg_key_new_abs(name, h, fullpath);
-	talloc_steal(mem_ctx, ret->mem_ctx, fullpath);
+	talloc_steal(ret->mem_ctx, fullpath);
 	talloc_destroy(mem_ctx);
 	*subkey = ret;
 	return WERR_OK;

source4/lib/registry/reg_backend_gconf/reg_backend_gconf.c

@@ -126,7 +126,7 @@ static WERROR gconf_fetch_values(REG_KEY *p, int *count, REG_VAL ***vals)
 		} else newval->data_type = REG_NONE; 
 
 		ar[(*count)] = newval;
-		ar = talloc_realloc(p->mem_ctx, ar, sizeof(REG_VAL *) * ((*count)+2));
+		ar = talloc_realloc(ar, sizeof(REG_VAL *) * ((*count)+2));
 		(*count)++;
 		g_free(cur->data);
 		cur = cur->next;
@@ -151,7 +151,7 @@ static WERROR gconf_fetch_subkeys(REG_KEY *p, int *count, REG_KEY ***subs)
 		ar[(*count)] = reg_key_new_abs(winpath, p->handle,NULL);
 		free(winpath);
 		ar[(*count)]->backend_data = reg_path_win2unix(talloc_strdup(ar[*count]->mem_ctx, cur->data));
-		ar = talloc_realloc_p(p->mem_ctx, ar, REG_KEY *, (*count)+2);
+		ar = talloc_realloc_p(ar, REG_KEY *, (*count)+2);
 		(*count)++;
 		g_free(cur->data);
 		cur = cur->next;

source4/lib/registry/reg_backend_ldb/reg_backend_ldb.c

@@ -188,7 +188,7 @@ static WERROR ldb_open_key(REG_HANDLE *h, int num, const char *name, REG_KEY **k
 	}
 
 	*key = reg_key_new_abs(name, h, ldap_path);
-	talloc_steal(mem_ctx, (*key)->mem_ctx, ldap_path);
+	talloc_steal((*key)->mem_ctx, ldap_path);
 	printf("Got something!\n");
 	/* FIXME */
 

source4/lib/talloc.c

@@ -1,8 +1,9 @@
 /* 
    Samba Unix SMB/CIFS implementation.
-   Samba temporary memory allocation functions
+
-   Copyright (C) Andrew Tridgell 2000-2004
+   Samba temporary memory allocation functions - new interface
-   Copyright (C) 2001, 2002 by Martin Pool <mbp@samba.org>
+
+   Copyright (C) Andrew Tridgell 2004
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -19,208 +20,175 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
-/**
-   @defgroup talloc Simple memory allocator
-   @{
-   
-   This is a very simple temporary memory allocator. To use it do the following:
-
-   1) when you first want to allocate a pool of meomry use
-   talloc_init() and save the resulting context pointer somewhere
-
-   2) to allocate memory use talloc()
-
-   3) when _all_ of the memory allocated using this context is no longer needed
-   use talloc_destroy()
-
-   talloc does not zero the memory. 
-
-   @sa talloc.h
-*/
-
-/**
- * If you want testing for memory corruption use valgrind
- **/
-
 #include "includes.h"
 
 #define MAX_TALLOC_SIZE 0x10000000
-#define TALLOC_MAGIC 0x06052004
+#define TALLOC_MAGIC 0x14082004
 #define TALLOC_MAGIC_FREE 0x3421abcd
 
 struct talloc_chunk {
 	struct talloc_chunk *next, *prev;
-	TALLOC_CTX *context;
+	struct talloc_chunk *parent, *child;
 	size_t size;
-	void *ptr;
 	uint_t magic;
-};
-
-
-struct talloc_ctx {
-	struct talloc_chunk *list;
-	off_t total_alloc_size;
-
-	/** The name recorded for this pool, if any.  Should describe
-	 * the purpose for which it was allocated.  The string is
-	 * allocated within the pool. **/
 	char *name;
-
-	/** Pointer to the next allocate talloc pool, so that we can
-	 * summarize all talloc memory usage. **/
-	struct talloc_ctx *next, *prev;
 };
 
 
-/**
- * Start of linked list of all talloc pools.
- *
- * @todo We should turn the global list off when using Insure++,
- * otherwise all the memory will be seen as still reachable.
- **/
-static TALLOC_CTX *list_head;
-
-/**
- * Add to the global list
- **/
-static void talloc_enroll(TALLOC_CTX *t)
-{
-#if 0
-	/* disabled enrole/disenrole until we have __thread support */
-	MUTEX_LOCK_BY_ID(MUTEX_TALLOC);
-	DLIST_ADD(list_head, t);
-	MUTEX_UNLOCK_BY_ID(MUTEX_TALLOC);
-#endif
-}
-
-
-static void talloc_disenroll(TALLOC_CTX *t)
-{
-#if 0
-	/* disabled enrole/disenrole until we have __thread support */
-	MUTEX_LOCK_BY_ID(MUTEX_TALLOC);
-	DLIST_REMOVE(list_head, t);
-	MUTEX_UNLOCK_BY_ID(MUTEX_TALLOC);
-#endif
-}
-
-
-/** Create a new talloc context. **/
-static TALLOC_CTX *talloc_init_internal(void)
-{
-	TALLOC_CTX *t;
-
-	t = (TALLOC_CTX *)malloc(sizeof(TALLOC_CTX));
-	if (t) {
-		t->list = NULL;
-		t->total_alloc_size = 0;
-		t->name = NULL;
-		talloc_enroll(t);
-	}
-
-	return t;
-}
-
-
-
-/**
- * Create a new talloc context, with a name specifying its purpose.
- **/
-
- TALLOC_CTX *talloc_init(char const *fmt, ...) 
-{
-	TALLOC_CTX *t;
-	va_list ap;
-
-	t = talloc_init_internal();
-	if (t && fmt) {
-		/*
-		 * t->name must not be talloced.
-		 * as destroying the pool would destroy it. JRA.
-		 */
-		t->name = NULL;
-		va_start(ap, fmt);
-		vasprintf(&t->name, fmt, ap);
-		va_end(ap);
-		if (!t->name) {
-			talloc_destroy(t);
-			t = NULL;
-		}
-	}
-	
-	return t;
-}
-
-
 /* 
-  return the talloc context given a pointer that has been allocated using
+   Allocate a bit of memory as a child of an existing pointer
-  talloc
 */
-TALLOC_CTX *talloc_get_context(void *ptr)
+void *talloc(void *context, size_t size)
-{
-	struct talloc_chunk *tc;
-	tc = ((struct talloc_chunk *)ptr)-1;
-
-	if (tc->magic == TALLOC_MAGIC) {
-		return tc->context;
-	} else {
-		return NULL;
-	}
-}
-
-/** Allocate a bit of memory from the specified pool **/
-void *talloc(TALLOC_CTX *t, size_t size)
 {
 	struct talloc_chunk *tc;
 
-	if (!t || size == 0) {
+	if (size >= MAX_TALLOC_SIZE) {
 		return NULL;
 	}
 
 	tc = malloc(sizeof(*tc)+size);
-	if (!tc) {
+	if (tc == NULL) {
 		return NULL;
 	}
 
-	tc->context = t;
 	tc->size = size;
 	tc->magic = TALLOC_MAGIC;
+	tc->child = NULL;
+	tc->name = NULL;
 
-	DLIST_ADD(t->list, tc);
+	if (context) {
+		struct talloc_chunk *parent = ((struct talloc_chunk *)context)-1;
 
-	t->total_alloc_size += size;
+		if (parent->magic != TALLOC_MAGIC) {
+			DEBUG(0,("Bad magic in context - 0x%08x\n", parent->magic));
+			free(tc);
+			return NULL;
+		}
+
+		tc->parent = parent;
+
+		if (parent->child) {
+			parent->child->parent = NULL;
+		}
+
+		DLIST_ADD(parent->child, tc);
+	} else {
+		tc->next = tc->prev = tc->parent = NULL;
+	}
 
 	return (void *)(tc+1);
 }
 
-/** A talloc version of realloc */
+
-void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size)
+/*
+  create a named talloc pointer
+*/
+void *talloc_named(void *context, size_t size, 
+		   const char *fmt, ...) _PRINTF_ATTRIBUTE(3,4)
+{
+	va_list ap;
+	void *ptr;
+	struct talloc_chunk *tc;
+
+	ptr = talloc(context, size);
+	if (ptr == NULL) {
+		return NULL;
+	}
+
+	tc = ((struct talloc_chunk *)ptr)-1;
+
+	va_start(ap, fmt);
+	vasprintf(&tc->name, fmt, ap);
+	va_end(ap);
+
+	return ptr;
+}
+
+/*
+  this is for compatibility with older versions of talloc
+*/
+void *talloc_init(const char *fmt, ...) _PRINTF_ATTRIBUTE(1,2)
+{
+	va_list ap;
+	void *ptr;
+	struct talloc_chunk *tc;
+
+	ptr = talloc(NULL, 0);
+	if (ptr == NULL) {
+		return NULL;
+	}
+
+	tc = ((struct talloc_chunk *)ptr)-1;
+
+	va_start(ap, fmt);
+	vasprintf(&tc->name, fmt, ap);
+	va_end(ap);
+
+	return ptr;
+}
+
+
+
+/* 
+   free a talloc pointer. This also frees all child pointers of this 
+   pointer recursively
+*/
+void talloc_free(void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (ptr == NULL) return;
+
+	tc = ((struct talloc_chunk *)ptr)-1;
+
+	if (tc->magic != TALLOC_MAGIC) {
+		DEBUG(0,("Bad talloc magic 0x%08x in talloc_free\n", tc->magic));
+		return;
+	}
+
+	while (tc->child) {
+		talloc_free(tc->child + 1);
+	}
+
+	if (tc->parent) {
+		DLIST_REMOVE(tc->parent->child, tc);
+		if (tc->parent->child) {
+			tc->parent->child->parent = tc->parent;
+		}
+	} else {
+		if (tc->prev) tc->prev->next = tc->next;
+		if (tc->next) tc->next->prev = tc->prev;
+	}
+
+	tc->magic = TALLOC_MAGIC_FREE;
+	if (tc->name) free(tc->name);
+
+	free(tc);
+}
+
+
+
+/*
+  A talloc version of realloc 
+*/
+void *talloc_realloc(void *ptr, size_t size)
 {
 	struct talloc_chunk *tc;
 	void *new_ptr;
 
 	/* size zero is equivalent to free() */
-	if (!t) {
-		return NULL;
-	}
-
 	if (size == 0) {
-		talloc_free(t, ptr);
+		talloc_free(ptr);
 		return NULL;
 	}
 
 	/* realloc(NULL) is equavalent to malloc() */
 	if (ptr == NULL) {
-		return talloc(t, size);
+		return talloc(NULL, size);
 	}
 
 	tc = ((struct talloc_chunk *)ptr)-1;
 
-	if (tc->context != t) {
-		DEBUG(0,("Bad talloc context passed to talloc_realloc\n"));
-		return NULL;
-	}
-
 	if (tc->magic != TALLOC_MAGIC) {
 		DEBUG(0,("Bad talloc magic 0x%08x in talloc_realloc\n", tc->magic));
 		return NULL;
@@ -235,11 +203,11 @@ void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size)
 		return NULL;
 	}
 
-	if (tc == t->list) {
-		t->list = new_ptr;
-	}
 	tc = new_ptr;
 	tc->magic = TALLOC_MAGIC;
+	if (tc->parent) {
+		tc->parent->child = new_ptr;
+	}
 
 	if (tc->prev) {
 		tc->prev->next = tc;
@@ -248,129 +216,74 @@ void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size)
 		tc->next->prev = tc;
 	}
 
-	t->total_alloc_size += (size - tc->size);
 	tc->size = size;
 
 	return (void *)(tc+1);
 }
 
 /* 
-   free a lump from a pool. Use sparingly please.
+   move a lump of memory from one talloc context to another return the
+   ptr on success, or NUL if it could not be transferred
 */
-void talloc_free(TALLOC_CTX *ctx, void *ptr)
+void *talloc_steal(void *new_ctx, void *ptr)
 {
-	struct talloc_chunk *tc;
+	struct talloc_chunk *tc, *new_tc;
-
-	if (!ptr || !ctx->list) return;
-
-	tc = ((struct talloc_chunk *)ptr)-1;
-
-	if (tc->context != ctx) {
-		DEBUG(0,("Bad talloc context passed to talloc_free\n"));
-	}
-
-	if (tc->magic != TALLOC_MAGIC) {
-		DEBUG(0,("Bad talloc magic 0x%08x in talloc_free\n", tc->magic));
-	}
-
-	DLIST_REMOVE(ctx->list, tc);
-
-	ctx->total_alloc_size -= tc->size;
-	tc->magic = TALLOC_MAGIC_FREE;
-
-	free(tc);
-}
-
-
-/* 
-   move a lump of memory from one talloc context to another
-   return the ptr on success, or NULL if it could not be found
-   in the old context or could not be transferred
-*/
-void *talloc_steal(TALLOC_CTX *old_ctx, TALLOC_CTX *new_ctx, void *ptr)
-{
-	struct talloc_chunk *tc;
 
 	if (!ptr) {
 		return NULL;
 	}
 
 	tc = ((struct talloc_chunk *)ptr)-1;
-
+	new_tc = ((struct talloc_chunk *)new_ctx)-1;
-	if (tc->context != old_ctx) {
-		DEBUG(0,("Bad talloc context passed to talloc_steal\n"));
-		return NULL;
-	}
 
 	if (tc->magic != TALLOC_MAGIC) {
 		DEBUG(0,("Bad talloc magic 0x%08x in talloc_steal\n", tc->magic));
 		return NULL;
 	}
+	if (new_tc->magic != TALLOC_MAGIC) {
+		DEBUG(0,("Bad new talloc magic 0x%08x in talloc_steal\n", new_tc->magic));
+		return NULL;
+	}
 
-	DLIST_REMOVE(old_ctx->list, tc);
+	if (tc->parent) {
-	DLIST_ADD(new_ctx->list, tc);
+		DLIST_REMOVE(tc->parent->child, tc);
+		if (tc->parent->child) {
+			tc->parent->child->parent = tc->parent;
+		}
+	} else {
+		if (tc->prev) tc->prev->next = tc->next;
+		if (tc->next) tc->next->prev = tc->prev;
+	}
 
-	tc->context = new_ctx;
+	tc->parent = new_tc;
-
+	if (new_tc->child) new_tc->child->parent = NULL;
-	old_ctx->total_alloc_size -= tc->size;
+	DLIST_ADD(new_tc->child, tc);
-	new_ctx->total_alloc_size += tc->size;
 
 	return ptr;
 }
 
-
+/*
-
+  return the total size of a talloc pool (subtree)
-/** Destroy all the memory allocated inside @p t, but not @p t
+*/
- * itself. */
+off_t talloc_total_size(void *p)
-void talloc_destroy_pool(TALLOC_CTX *t)
 {
-	if (!t) {
+	off_t total = 0;
-		return;
+	struct talloc_chunk *c, *tc;
+
+	tc = ((struct talloc_chunk *)p)-1;
+
+	total = tc->size;
+	for (c=tc->child;c;c=c->next) {
+		total += talloc_total_size(c+1);
 	}
-
+	return total;
-	while (t->list) {
-		struct talloc_chunk *tc = t->list;
-		if (tc->magic != TALLOC_MAGIC) {
-			DEBUG(0,("Bad magic 0x%08x in talloc_destroy_pool\n", 
-				 tc->magic));
-			return;
-		}
-		DLIST_REMOVE(t->list, tc);
-		tc->magic = TALLOC_MAGIC_FREE;
-		free(tc);
-	}
-
-	t->total_alloc_size = 0;
-}
-
-/** Destroy a whole pool including the context */
-void talloc_destroy(TALLOC_CTX *t)
-{
-	if (!t)
-		return;
-
-	talloc_destroy_pool(t);
-	talloc_disenroll(t);
-	SAFE_FREE(t->name);
-	SAFE_FREE(t);
-}
-
-/** Return the current total size of the pool. */
-size_t talloc_pool_size(TALLOC_CTX *t)
-{
-	return t->total_alloc_size;
-}
-
-const char *talloc_pool_name(TALLOC_CTX const *t)
-{
-	if (t) return t->name;
-
-	return NULL;
 }
 
 
-/** talloc and zero memory. */
+/* 
-void *talloc_zero(TALLOC_CTX *t, size_t size)
+   talloc and zero memory. 
+*/
+void *talloc_zero(void *t, size_t size)
 {
 	void *p = talloc(t, size);
 
@@ -382,8 +295,10 @@ void *talloc_zero(TALLOC_CTX *t, size_t size)
 }
 
 
-/** memdup with a talloc. */
+/*
-void *talloc_memdup(TALLOC_CTX *t, const void *p, size_t size)
+  memdup with a talloc. 
+*/
+void *talloc_memdup(void *t, const void *p, size_t size)
 {
 	void *newp = talloc(t,size);
 
@@ -394,8 +309,10 @@ void *talloc_memdup(TALLOC_CTX *t, const void *p, size_t size)
 	return newp;
 }
 
-/** strdup with a talloc */
+/*
-char *talloc_strdup(TALLOC_CTX *t, const char *p)
+  strdup with a talloc 
+*/
+char *talloc_strdup(void *t, const char *p)
 {
 	if (!p) {
 		return NULL;
@@ -403,8 +320,10 @@ char *talloc_strdup(TALLOC_CTX *t, const char *p)
 	return talloc_memdup(t, p, strlen(p) + 1);
 }
 
-/** strndup with a talloc */
+/*
-char *talloc_strndup(TALLOC_CTX *t, const char *p, size_t n)
+  strndup with a talloc 
+*/
+char *talloc_strndup(void *t, const char *p, size_t n)
 {
 	size_t len = strnlen(p, n);
 	char *ret;
@@ -416,23 +335,7 @@ char *talloc_strndup(TALLOC_CTX *t, const char *p, size_t n)
 	return ret;
 }
 
-/**
+ char *talloc_vasprintf(void *t, const char *fmt, va_list ap)
- * Perform string formatting, and return a pointer to newly allocated
- * memory holding the result, inside a memory pool.
- **/
- char *talloc_asprintf(TALLOC_CTX *t, const char *fmt, ...)
-{
-	va_list ap;
-	char *ret;
-
-	va_start(ap, fmt);
-	ret = talloc_vasprintf(t, fmt, ap);
-	va_end(ap);
-	return ret;
-}
-
-
- char *talloc_vasprintf(TALLOC_CTX *t, const char *fmt, va_list ap)
 {	
 	int len;
 	char *ret;
@@ -452,30 +355,28 @@ char *talloc_strndup(TALLOC_CTX *t, const char *p, size_t n)
 }
 
 
-/**
+/*
- * Realloc @p s to append the formatted result of @p fmt and return @p
+  Perform string formatting, and return a pointer to newly allocated
- * s, which may have moved.  Good for gradually accumulating output
+  memory holding the result, inside a memory pool.
- * into a string buffer.
+ */
- **/
+char *talloc_asprintf(void *t, const char *fmt, ...) _PRINTF_ATTRIBUTE(2,3)
- char *talloc_asprintf_append(TALLOC_CTX *t, char *s,
-			      const char *fmt, ...)
 {
 	va_list ap;
+	char *ret;
 
 	va_start(ap, fmt);
-	s = talloc_vasprintf_append(t, s, fmt, ap);
+	ret = talloc_vasprintf(t, fmt, ap);
 	va_end(ap);
-	return s;
+	return ret;
 }
 
 
-
 /**
  * Realloc @p s to append the formatted result of @p fmt and @p ap,
  * and return @p s, which may have moved.  Good for gradually
  * accumulating output into a string buffer.
  **/
- char *talloc_vasprintf_append(TALLOC_CTX *t, char *s,
+char *talloc_vasprintf_append(char *s,
 			      const char *fmt, va_list ap)
 {	
 	int len, s_len;
@@ -486,11 +387,11 @@ char *talloc_strndup(TALLOC_CTX *t, const char *p, size_t n)
 	if (s) {
 		s_len = strlen(s);
 	} else {
-		s = 0;
+		s_len = 0;
 	}
 	len = vsnprintf(NULL, 0, fmt, ap2);
 
-	s = talloc_realloc(t, s, s_len + len+1);
+	s = talloc_realloc(s, s_len + len+1);
 	if (!s) return NULL;
 
 	VA_COPY(ap2, ap);
@@ -500,109 +401,45 @@ char *talloc_strndup(TALLOC_CTX *t, const char *p, size_t n)
 	return s;
 }
 
-
+/*
-/**
+  Realloc @p s to append the formatted result of @p fmt and return @p
- * Return a human-readable description of all talloc memory usage.
+  s, which may have moved.  Good for gradually accumulating output
- * The result is allocated from @p t.
+  into a string buffer.
- **/
+ */
-char *talloc_describe_all(TALLOC_CTX *rt)
+char *talloc_asprintf_append(char *s,
+			     const char *fmt, ...) _PRINTF_ATTRIBUTE(2,3)
 {
-	int n_pools = 0, total_chunks = 0;
+	va_list ap;
-	size_t total_bytes = 0;
-	TALLOC_CTX *it;
-	char *s;
-
-	if (!rt) return NULL;
-
-	s = talloc_asprintf(rt, "global talloc allocations in pid: %u\n",
-			    (uint_t) getpid());
-	s = talloc_asprintf_append(rt, s, "%-40s %8s %8s\n",
-				   "name", "chunks", "bytes");
-	s = talloc_asprintf_append(rt, s, "%-40s %8s %8s\n",
-				   "----------------------------------------",
-				   "--------",
-				   "--------");	
-	MUTEX_LOCK_BY_ID(MUTEX_TALLOC);
-	
-	for (it = list_head; it; it = it->next) {
-		size_t bytes;
-		int n_chunks;
-		fstring what;
-		
-		n_pools++;
-		
-		talloc_get_allocation(it, &bytes, &n_chunks);
-
-		if (it->name)
-			fstrcpy(what, it->name);
-		else
-			slprintf(what, sizeof(what), "@%p", it);
-		
-		s = talloc_asprintf_append(rt, s, "%-40s %8u %8u\n",
-					   what,
-					   (uint_t) n_chunks,
-					   (uint_t) bytes);
-		total_bytes += bytes;
-		total_chunks += n_chunks;
-	}
-
-	MUTEX_UNLOCK_BY_ID(MUTEX_TALLOC);
-
-	s = talloc_asprintf_append(rt, s, "%-40s %8s %8s\n",
-				   "----------------------------------------",
-				   "--------",
-				   "--------");	
-
-	s = talloc_asprintf_append(rt, s, "%-40s %8u %8u\n",
-				   "TOTAL",
-				   (uint_t) total_chunks, (uint_t) total_bytes);
 
+	va_start(ap, fmt);
+	s = talloc_vasprintf_append(s, fmt, ap);
+	va_end(ap);
 	return s;
 }
 
-
-
-/**
- * Return an estimated memory usage for the specified pool.  This does
- * not include memory used by the underlying malloc implementation.
- **/
-void talloc_get_allocation(TALLOC_CTX *t,
-			   size_t *total_bytes,
-			   int *n_chunks)
-{
-	struct talloc_chunk *tc;
-
-	if (t) {
-		*total_bytes = 0;
-		*n_chunks = 0;
-
-		for (tc = t->list; tc; tc = tc->next) {
-			n_chunks[0]++;
-			*total_bytes += tc->size;
-		}
-	}
-}
-
 /*
-  realloc an array, checking for integer overflow in the array size
+  alloc an array, checking for integer overflow in the array size
 */
-void *talloc_realloc_array(TALLOC_CTX *ctx, void *ptr, size_t el_size, uint_t count)
+void *talloc_array(void *ctx, size_t el_size, uint_t count)
 {
 	if (count == 0 ||
 	    count >= MAX_TALLOC_SIZE/el_size) {
 		return NULL;
 	}
-	return talloc_realloc(ctx, ptr, el_size * count);
+	return talloc(ctx, el_size * count);
 }
 
 
 /*
-  we really should get rid of this
+  realloc an array, checking for integer overflow in the array size
 */
-void *talloc_strdup_w(TALLOC_CTX *mem_ctx, void *s)
+void *talloc_realloc_array(void *ptr, size_t el_size, uint_t count)
 {
-	size_t len = strlen_w(s);
+	if (count == 0 ||
-	return talloc_memdup(mem_ctx, s, (len+1)*2);
+	    count >= MAX_TALLOC_SIZE/el_size) {
+		return NULL;
+	}
+	return talloc_realloc(ptr, el_size * count);
 }
 
 /*
@@ -610,8 +447,12 @@ void *talloc_strdup_w(TALLOC_CTX *mem_ctx, void *s)
 */
 void *talloc_ldb_alloc(void *context, void *ptr, size_t size)
 {
-	return talloc_realloc((TALLOC_CTX *)context, ptr, size);
+	if (ptr == NULL) {
+		return talloc(context, size);
+	}
+	if (size == 0) {
+		talloc_free(ptr);
+		return NULL;
+	}
+	return talloc_realloc(ptr, size);
 }
-
-
-/** @} */

source4/lib/tallocmsg.c

@@ -33,15 +33,16 @@
 void msg_pool_usage(int msg_type, pid_t src_pid,
 		    void *UNUSED(buf), size_t UNUSED(len))
 {
-	char *reply;
+	const char *reply="NOT IMPLEMENTED\n";
 	TALLOC_CTX *reply_pool = talloc_init("msg_pool_usage");
 
 	SMB_ASSERT(msg_type == MSG_REQ_POOL_USAGE);
 	
 	DEBUG(2,("Got POOL_USAGE\n"));
 
+#if 0
 	reply = talloc_describe_all(reply_pool);
-	
+#endif
 	message_send_pid(src_pid, MSG_POOL_USAGE,
 			 reply, strlen(reply)+1, True);
 

source4/lib/util_str.c

@@ -1452,7 +1452,7 @@ BOOL add_string_to_array(TALLOC_CTX *mem_ctx,
 {
 	char *dup_str = talloc_strdup(mem_ctx, str);
 
-	*strings = talloc_realloc(mem_ctx, *strings,
+	*strings = talloc_realloc(*strings,
 				  ((*num)+1) * sizeof(**strings));
 
 	if ((*strings == NULL) || (dup_str == NULL))

source4/lib/util_unistr.c

@@ -249,14 +249,6 @@ const smb_ucs2_t *strrchr_w(const smb_ucs2_t *s, smb_ucs2_t c)
 	return NULL;
 }
 
-static int strncmp_w(const smb_ucs2_t *a, const smb_ucs2_t *b, size_t len)
-{
-	size_t n = 0;
-	while ((n < len) && *b && *a == *b) { a++; b++; n++;}
-	return (len - n)?(*a - *b):0;	
-}
-
-
 /*******************************************************************
  Convert a string to lower case.
  return True if any char is converted

source4/lib/util_uuid.c

@@ -24,7 +24,7 @@
 
 void uuid_generate_random(struct GUID *out)
 {
-	generate_random_buffer(out, sizeof(struct GUID));
+	generate_random_buffer((unsigned char *)out, sizeof(struct GUID));
 	out->clock_seq[0] = (out->clock_seq[0] & 0x3F) | 0x80;
 	out->time_hi_and_version = (out->time_hi_and_version & 0x0FFF) | 0x4000;
 }

source4/libads/ldap.c

@@ -795,7 +795,7 @@ static ADS_STATUS ads_modlist_add(TALLOC_CTX *ctx, ADS_MODLIST *mods,
 	for (curmod=0; modlist[curmod] && modlist[curmod] != (LDAPMod *) -1;
 	     curmod++);
 	if (modlist[curmod] == (LDAPMod *) -1) {
-		if (!(modlist = talloc_realloc(ctx, modlist, 
+		if (!(modlist = talloc_realloc(modlist, 
 			(curmod+ADS_MODLIST_ALLOC_SIZE+1)*sizeof(LDAPMod *))))
 			return ADS_ERROR(LDAP_NO_MEMORY);
 		memset(&modlist[curmod], 0, 
@@ -1703,7 +1703,7 @@ char **ads_pull_strings_range(ADS_STRUCT *ads,
 		return NULL;
 	}
 
-	strings = talloc_realloc(mem_ctx, current_strings,
+	strings = talloc_realloc(current_strings,
 				 sizeof(*current_strings) *
 				 (*num_strings + num_new_strings));
 	

source4/libcli/clilist.c

@@ -83,7 +83,7 @@ static BOOL smbcli_list_new_callback(void *private, union smb_search_data *file)
 	file_info *tdl;
  
 	/* add file info to the dirlist pool */
-	tdl = talloc_realloc(state->mem_ctx, state->dirlist,
+	tdl = talloc_realloc(state->dirlist,
 			     state->dirlist_len + sizeof(struct file_info));
 
 	if (!tdl) {
@@ -225,7 +225,7 @@ static BOOL smbcli_list_old_callback(void *private, union smb_search_data *file)
 	file_info *tdl;
 	
 	/* add file info to the dirlist pool */
-	tdl = talloc_realloc(state->mem_ctx, state->dirlist,
+	tdl = talloc_realloc(state->dirlist,
 			     state->dirlist_len + sizeof(struct file_info));
 
 	if (!tdl) {

source4/libcli/ldap/ldap.c

@@ -179,7 +179,7 @@ static struct ldap_parse_tree *ldap_parse_filterlist(TALLOC_CTX *mem_ctx,
 
 	while (*s && (next = ldap_parse_filter(mem_ctx, &s))) {
 		struct ldap_parse_tree **e;
-		e = talloc_realloc(mem_ctx, ret->u.list.elements,
+		e = talloc_realloc(ret->u.list.elements,
 				   sizeof(struct ldap_parse_tree) *
 				   (ret->u.list.num_elements+1));
 		if (!e) {

source4/libcli/ldap/ldap_ldif.c

@@ -51,7 +51,7 @@ static char *next_chunk(TALLOC_CTX *mem_ctx,
 		if (chunk_size+1 >= alloc_size) {
 			char *c2;
 			alloc_size += 1024;
-			c2 = talloc_realloc(mem_ctx, chunk, alloc_size);
+			c2 = talloc_realloc(chunk, alloc_size);
 			if (!c2) {
 				errno = ENOMEM;
 				return NULL;
@@ -158,7 +158,7 @@ static int next_attr(char **s, const char **attr, struct ldap_val *value)
 BOOL add_value_to_attrib(TALLOC_CTX *mem_ctx, struct ldap_val *value,
 				struct ldap_attribute *attrib)
 {
-	attrib->values = talloc_realloc(mem_ctx, attrib->values,
+	attrib->values = talloc_realloc(attrib->values,
 					sizeof(*attrib->values) *
 					(attrib->num_values+1));
 	if (attrib->values == NULL)
@@ -175,7 +175,7 @@ BOOL add_attrib_to_array_talloc(TALLOC_CTX *mem_ctx,
 				       struct ldap_attribute **attribs,
 				       int *num_attribs)
 {
-	*attribs = talloc_realloc(mem_ctx, *attribs,
+	*attribs = talloc_realloc(*attribs,
 				  sizeof(**attribs) * (*num_attribs+1));
 
 	if (*attribs == NULL)
@@ -207,8 +207,7 @@ static BOOL fill_add_attributes(struct ldap_message *msg, char **chunk)
 		}
 
 		if (attrib == NULL) {
-			r->attributes = talloc_realloc(msg->mem_ctx,
+			r->attributes = talloc_realloc(r->attributes,
-						       r->attributes,
 						       sizeof(*r->attributes) *
 						       (r->num_attributes+1));
 			if (r->attributes == NULL)
@@ -232,7 +231,7 @@ BOOL add_mod_to_array_talloc(TALLOC_CTX *mem_ctx,
 				    struct ldap_mod **mods,
 				    int *num_mods)
 {
-	*mods = talloc_realloc(mem_ctx, *mods,
+	*mods = talloc_realloc(*mods,
 			       sizeof(**mods) * ((*num_mods)+1));
 
 	if (*mods == NULL)

source4/libcli/raw/clisession.c

@@ -69,7 +69,7 @@ void smbcli_session_close(struct smbcli_session *session)
 ****************************************************************************/
 struct smbcli_request *smb_raw_session_setup_send(struct smbcli_session *session, union smb_sesssetup *parms) 
 {
-	struct smbcli_request *req;
+	struct smbcli_request *req = NULL;
 
 	switch (parms->generic.level) {
 	case RAW_SESSSETUP_GENERIC:

source4/libcli/raw/clisocket.c

@@ -181,7 +181,7 @@ BOOL smbcli_sock_connect_byname(struct smbcli_socket *sock, const char *host, in
 	ret = smbcli_sock_connect(sock, &ip, port);
 
 	if (ret) {
-		sock->hostname = talloc_steal(mem_ctx, sock->mem_ctx, name);
+		sock->hostname = talloc_steal(sock->mem_ctx, name);
 	}
 
 	talloc_destroy(mem_ctx);

source4/libcli/raw/clitransport.c

@@ -296,7 +296,7 @@ static void smbcli_transport_finish_recv(struct smbcli_transport *transport)
 {
 	uint8_t *buffer, *hdr, *vwv;
 	int len;
-	uint16_t wct, mid = 0;
+	uint16_t wct=0, mid = 0;
 	struct smbcli_request *req;
 
 	buffer = transport->recv_buffer.buffer;
@@ -309,7 +309,7 @@ static void smbcli_transport_finish_recv(struct smbcli_transport *transport)
 
 	/* see if it could be an oplock break request */
 	if (handle_oplock_break(transport, len, hdr, vwv)) {
-		talloc_free(transport->mem_ctx, buffer);
+		talloc_free(buffer);
 		return;
 	}
 
@@ -325,7 +325,7 @@ static void smbcli_transport_finish_recv(struct smbcli_transport *transport)
 		if (!req) goto error;
 
 		req->in.buffer = buffer;
-		talloc_steal(transport->mem_ctx, req->mem_ctx, buffer);
+		talloc_steal(req->mem_ctx, buffer);
 		req->in.size = len;
 		req->in.allocated = req->in.size;
 		goto async;
@@ -349,7 +349,7 @@ static void smbcli_transport_finish_recv(struct smbcli_transport *transport)
 
 	/* fill in the 'in' portion of the matching request */
 	req->in.buffer = buffer;
-	talloc_steal(transport->mem_ctx, req->mem_ctx, buffer);
+	talloc_steal(req->mem_ctx, buffer);
 	req->in.size = len;
 	req->in.allocated = req->in.size;
 

source4/libcli/raw/clitree.c

@@ -70,7 +70,7 @@ void smbcli_tree_close(struct smbcli_tree *tree)
 ****************************************************************************/
 struct smbcli_request *smb_tree_connect_send(struct smbcli_tree *tree, union smb_tcon *parms)
 {
-	struct smbcli_request *req;
+	struct smbcli_request *req = NULL;
 
 	switch (parms->tcon.level) {
 	case RAW_TCON_TCON:

source4/libcli/raw/raweas.c

@@ -128,7 +128,7 @@ NTSTATUS ea_pull_list(const DATA_BLOB *blob,
 		blob2.data = blob->data + ofs;
 		blob2.length = ea_size - ofs;
 
-		*eas = talloc_realloc(mem_ctx, *eas, sizeof(**eas) * (n+1));
+		*eas = talloc_realloc(*eas, sizeof(**eas) * (n+1));
 		if (! *eas) return NT_STATUS_NO_MEMORY;
 
 		len = ea_pull_struct(&blob2, mem_ctx, &(*eas)[n]);

source4/libcli/raw/rawfile.c

@@ -34,7 +34,7 @@
 struct smbcli_request *smb_raw_rename_send(struct smbcli_tree *tree,
 					union smb_rename *parms)
 {
-	struct smbcli_request *req; 
+	struct smbcli_request *req = NULL; 
 
 	switch (parms->generic.level) {
 	case RAW_RENAME_RENAME:
@@ -490,7 +490,7 @@ NTSTATUS smb_raw_open(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, union smb_o
 ****************************************************************************/
 struct smbcli_request *smb_raw_close_send(struct smbcli_tree *tree, union smb_close *parms)
 {
-	struct smbcli_request *req; 
+	struct smbcli_request *req = NULL; 
 
 	switch (parms->generic.level) {
 	case RAW_CLOSE_GENERIC:
@@ -536,7 +536,7 @@ NTSTATUS smb_raw_close(struct smbcli_tree *tree, union smb_close *parms)
 ****************************************************************************/
 struct smbcli_request *smb_raw_lock_send(struct smbcli_tree *tree, union smb_lock *parms)
 {
-	struct smbcli_request *req; 
+	struct smbcli_request *req = NULL; 
 
 	switch (parms->generic.level) {
 	case RAW_LOCK_GENERIC:

source4/libcli/raw/rawfileinfo.c

@@ -174,7 +174,7 @@ static NTSTATUS smb_raw_info_backend(struct smbcli_session *session,
 		while (blob->length - ofs >= 24) {
 			uint_t n = parms->stream_info.out.num_streams;
 			parms->stream_info.out.streams = 
-				talloc_realloc(mem_ctx,parms->stream_info.out.streams,
+				talloc_realloc(parms->stream_info.out.streams,
 					       (n+1) * sizeof(parms->stream_info.out.streams[0]));
 			if (!parms->stream_info.out.streams) {
 				return NT_STATUS_NO_MEMORY;

source4/libcli/raw/rawreadwrite.c

@@ -33,7 +33,7 @@
 struct smbcli_request *smb_raw_read_send(struct smbcli_tree *tree, union smb_read *parms)
 {
 	BOOL bigoffset = False;
-	struct smbcli_request *req; 
+	struct smbcli_request *req = NULL; 
 
 	switch (parms->generic.level) {
 	case RAW_READ_GENERIC:
@@ -185,7 +185,7 @@ NTSTATUS smb_raw_read(struct smbcli_tree *tree, union smb_read *parms)
 struct smbcli_request *smb_raw_write_send(struct smbcli_tree *tree, union smb_write *parms)
 {
 	BOOL bigoffset = False;
-	struct smbcli_request *req; 
+	struct smbcli_request *req = NULL; 
 
 	switch (parms->generic.level) {
 	case RAW_WRITE_GENERIC:

source4/libcli/raw/rawrequest.c

@@ -224,7 +224,7 @@ static void smbcli_req_grow_allocation(struct smbcli_request *req, uint_t new_si
 
 	/* we need to realloc */
 	req->out.allocated = req->out.size + delta + REQ_OVER_ALLOCATION;
-	buf2 = talloc_realloc(req->mem_ctx, req->out.buffer, req->out.allocated);
+	buf2 = talloc_realloc(req->out.buffer, req->out.allocated);
 	if (buf2 == NULL) {
 		smb_panic("out of memory in req_grow_allocation");
 	}
@@ -915,7 +915,7 @@ size_t smbcli_blob_append_string(struct smbcli_session *session,
 
 	max_len = (strlen(str)+2) * MAX_BYTES_PER_CHAR;		
 
-	blob->data = talloc_realloc(mem_ctx, blob->data, blob->length + max_len);
+	blob->data = talloc_realloc(blob->data, blob->length + max_len);
 	if (!blob->data) {
 		return 0;
 	}

source4/libcli/raw/rawtrans.c

@@ -84,7 +84,7 @@ NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
 
 	/* allocate it */
 	if (total_data != 0) {
-		tdata = talloc_realloc(mem_ctx, parms->out.data.data,total_data);
+		tdata = talloc_realloc(parms->out.data.data,total_data);
 		if (!tdata) {
 			DEBUG(0,("smb_raw_receive_trans: failed to enlarge data buffer to %d bytes\n", total_data));
 			req->status = NT_STATUS_NO_MEMORY;
@@ -94,7 +94,7 @@ NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
 	}
 
 	if (total_param != 0) {
-		tparam = talloc_realloc(mem_ctx, parms->out.params.data,total_param);
+		tparam = talloc_realloc(parms->out.params.data,total_param);
 		if (!tparam) {
 			DEBUG(0,("smb_raw_receive_trans: failed to enlarge param buffer to %d bytes\n", total_param));
 			req->status = NT_STATUS_NO_MEMORY;

source4/librpc/ndr/ndr.c

@@ -188,7 +188,7 @@ NTSTATUS ndr_push_expand(struct ndr_push *ndr, uint32_t size)
 	if (size > ndr->alloc_size) {
 		ndr->alloc_size = size;
 	}
-	ndr->data = talloc_realloc(ndr->mem_ctx, ndr->data, ndr->alloc_size);
+	ndr->data = talloc_realloc(ndr->data, ndr->alloc_size);
 	if (!ndr->data) {
 		return ndr_push_error(ndr, NDR_ERR_ALLOC, "Failed to push_expand to %u",
 				      ndr->alloc_size);

source4/librpc/rpc/dcerpc.c

@@ -660,8 +660,7 @@ NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
 
 		length = pkt.u.response.stub_and_verifier.length;
 
-		payload.data = talloc_realloc(mem_ctx, 
+		payload.data = talloc_realloc(payload.data, 
-					      payload.data, 
 					      payload.length + length);
 		if (!payload.data) {
 			return NT_STATUS_NO_MEMORY;

source4/librpc/rpc/dcerpc_smb.c

@@ -98,7 +98,7 @@ static NTSTATUS dcerpc_raw_recv(struct dcerpc_pipe *p,
 	}
 
 	/* make sure the payload can hold the whole fragment */
-	payload.data = talloc_realloc(mem_ctx, payload.data, frag_length);
+	payload.data = talloc_realloc(payload.data, frag_length);
 	if (!payload.data) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -203,7 +203,7 @@ static NTSTATUS smb_secondary_request(struct dcerpc_pipe *p,
 		return status;
 	}
 
-	blob->data = talloc_realloc(mem_ctx, blob->data, frag_length);
+	blob->data = talloc_realloc(blob->data, frag_length);
 	if (!blob->data) {
 		return NT_STATUS_NO_MEMORY;
 	}

source4/ntvfs/ipc/ipc_rap.c

@@ -178,7 +178,7 @@ static NTSTATUS rap_push_string(struct ndr_push *data_push,
 	NDR_CHECK(ndr_push_uint16(data_push, heap->offset));
 	NDR_CHECK(ndr_push_uint16(data_push, 0));
 
-	heap->strings = talloc_realloc(heap->mem_ctx, heap->strings,
+	heap->strings = talloc_realloc(heap->strings,
 				       sizeof(*heap->strings) *
 				       (heap->num_strings + 1));
 

source4/ntvfs/reference/ref_util.c

@@ -104,7 +104,7 @@ struct svfs_dir *svfs_list(TALLOC_CTX *mem_ctx, struct smbsrv_request *req, cons
 		
 		if (dir->count >= allocated) {
 			allocated = (allocated + 100) * 1.2;
-			dir->files = talloc_realloc(mem_ctx, dir->files, allocated * sizeof(dir->files[0]));
+			dir->files = talloc_realloc(dir->files, allocated * sizeof(dir->files[0]));
 			if (!dir->files) { 
 				closedir(odir);
 				return NULL;

source4/ntvfs/simple/svfs_util.c

@@ -105,7 +105,7 @@ struct svfs_dir *svfs_list_unix(TALLOC_CTX *mem_ctx, struct smbsrv_request *req,
 		
 		if (dir->count >= allocated) {
 			allocated = (allocated + 100) * 1.2;
-			dir->files = talloc_realloc(mem_ctx, dir->files, allocated * sizeof(dir->files[0]));
+			dir->files = talloc_realloc(dir->files, allocated * sizeof(dir->files[0]));
 			if (!dir->files) { 
 				closedir(odir);
 				return NULL;

source4/ntvfs/simple/vfs_simple.c

@@ -580,8 +580,8 @@ static NTSTATUS svfs_close(struct smbsrv_request *req, union smb_close *io)
 	}
 
 	DLIST_REMOVE(private->open_files, f);
-	talloc_free(req->tcon->mem_ctx, f->name);
+	talloc_free(f->name);
-	talloc_free(req->tcon->mem_ctx, f);
+	talloc_free(f);
 
 	return NT_STATUS_OK;
 }
@@ -766,7 +766,7 @@ static NTSTATUS svfs_search_first(struct smbsrv_request *req, union smb_search_f
 
 	dir = svfs_list(mem_ctx, req, io->t2ffirst.in.pattern);
 	if (!dir) {
-		talloc_destroy_pool(mem_ctx);
+		talloc_free(mem_ctx);
 		return NT_STATUS_FOOBAR;
 	}
 

source4/rpc_server/dcerpc_server.c

@@ -734,7 +734,7 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 	}
 	call = talloc_p(mem_ctx, struct dcesrv_call_state);
 	if (!call) {
-		talloc_free(dce_conn->mem_ctx, dce_conn->partial_input.data);
+		talloc_free(dce_conn->partial_input.data);
 		talloc_destroy(mem_ctx);
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -747,7 +747,7 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 
 	ndr = ndr_pull_init_blob(&blob, mem_ctx);
 	if (!ndr) {
-		talloc_free(dce_conn->mem_ctx, dce_conn->partial_input.data);
+		talloc_free(dce_conn->partial_input.data);
 		talloc_destroy(mem_ctx);
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -758,7 +758,7 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 
 	status = ndr_pull_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, &call->pkt);
 	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(dce_conn->mem_ctx, dce_conn->partial_input.data);
+		talloc_free(dce_conn->partial_input.data);
 		talloc_destroy(mem_ctx);
 		return status;
 	}
@@ -801,8 +801,7 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 		}
 
 		call->pkt.u.request.stub_and_verifier.data = 
-			talloc_realloc(call->mem_ctx,
+			talloc_realloc(call->pkt.u.request.stub_and_verifier.data, alloc_size);
-				       call->pkt.u.request.stub_and_verifier.data, alloc_size);
 		if (!call->pkt.u.request.stub_and_verifier.data) {
 			return dcesrv_fault(call2, DCERPC_FAULT_OTHER);
 		}

source4/rpc_server/epmapper/rpc_epmapper.c

@@ -129,7 +129,7 @@ static uint32_t build_ep_list(TALLOC_CTX *mem_ctx,
 		struct dcesrv_if_list *iface;
 
 		for (iface=d->interface_list;iface;iface=iface->next) {
-			(*eps) = talloc_realloc_p(mem_ctx, *eps, 
+			(*eps) = talloc_realloc_p(*eps, 
 						  struct dcesrv_ep_iface,
 						  total + 1);
 			if (!*eps) {

source4/rpc_server/netlogon/dcerpc_netlogon.c

@@ -265,14 +265,14 @@ static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TAL
 
 	if (pipe_state->account_name) {
 		/* We don't want a memory leak on this long-lived talloc context */
-		talloc_free(pipe_state->mem_ctx, pipe_state->account_name);
+		talloc_free(pipe_state->account_name);
 	}
 
 	pipe_state->account_name = talloc_strdup(pipe_state->mem_ctx, r->in.account_name);
 	
 	if (pipe_state->computer_name) {
 		/* We don't want a memory leak on this long-lived talloc context */
-		talloc_free(pipe_state->mem_ctx, pipe_state->account_name);
+		talloc_free(pipe_state->account_name);
 	}
 
 	pipe_state->computer_name = talloc_strdup(pipe_state->mem_ctx, r->in.computer_name);

source4/rpc_server/samr/dcesrv_samr.c

@@ -572,7 +572,7 @@ static NTSTATUS samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLO
 	a_state->sam_ctx = d_state->sam_ctx;
 	a_state->access_mask = r->in.access_mask;
 	a_state->domain_state = d_state;
-	a_state->account_dn = talloc_steal(mem_ctx, mem_ctx2, msg.dn);
+	a_state->account_dn = talloc_steal(mem_ctx2, msg.dn);
 	a_state->account_sid = talloc_strdup(mem_ctx2, sidstr);
 	a_state->account_name = talloc_strdup(mem_ctx2, groupname);
 	if (!a_state->account_name || !a_state->account_sid) {
@@ -756,7 +756,7 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	a_state->sam_ctx = d_state->sam_ctx;
 	a_state->access_mask = r->in.access_mask;
 	a_state->domain_state = d_state;
-	a_state->account_dn = talloc_steal(mem_ctx, mem_ctx2, msg.dn);
+	a_state->account_dn = talloc_steal(mem_ctx2, msg.dn);
 	a_state->account_sid = talloc_strdup(mem_ctx2, sidstr);
 	a_state->account_name = talloc_strdup(mem_ctx2, account_name);
 	if (!a_state->account_name || !a_state->account_sid) {
@@ -1074,7 +1074,7 @@ static NTSTATUS samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
 	a_state->sam_ctx = d_state->sam_ctx;
 	a_state->access_mask = r->in.access_mask;
 	a_state->domain_state = d_state;
-	a_state->account_dn = talloc_steal(mem_ctx, mem_ctx2, msgs[0]->dn);
+	a_state->account_dn = talloc_steal(mem_ctx2, msgs[0]->dn);
 	a_state->account_sid = talloc_strdup(mem_ctx2, sidstr);
 	a_state->account_name = talloc_strdup(mem_ctx2, groupname);
 	if (!a_state->account_name || !a_state->account_sid) {
@@ -1453,7 +1453,7 @@ static NTSTATUS samr_OpenUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
 	a_state->sam_ctx = d_state->sam_ctx;
 	a_state->access_mask = r->in.access_mask;
 	a_state->domain_state = d_state;
-	a_state->account_dn = talloc_steal(mem_ctx, mem_ctx2, msgs[0]->dn);
+	a_state->account_dn = talloc_steal(mem_ctx2, msgs[0]->dn);
 	a_state->account_sid = talloc_strdup(mem_ctx2, sidstr);
 	a_state->account_name = talloc_strdup(mem_ctx2, account_name);
 	if (!a_state->account_name || !a_state->account_sid) {

source4/smb_server/request.c

@@ -89,7 +89,7 @@ static void req_setup_chain_reply(struct smbsrv_request *req, uint_t wct, uint_t
 	/* over allocate by a small amount */
 	req->out.allocated = req->out.size + REQ_OVER_ALLOCATION; 
 
-	req->out.buffer = talloc_realloc(req->mem_ctx, req->out.buffer, req->out.allocated);
+	req->out.buffer = talloc_realloc(req->out.buffer, req->out.allocated);
 	if (!req->out.buffer) {
 		smbsrv_terminate_connection(req->smb_conn, "allocation failed");
 	}
@@ -203,7 +203,7 @@ static void req_grow_allocation(struct smbsrv_request *req, uint_t new_size)
 
 	/* we need to realloc */
 	req->out.allocated = req->out.size + delta + REQ_OVER_ALLOCATION;
-	buf2 = talloc_realloc(req->mem_ctx, req->out.buffer, req->out.allocated);
+	buf2 = talloc_realloc(req->out.buffer, req->out.allocated);
 	if (buf2 == NULL) {
 		smb_panic("out of memory in req_grow_allocation");
 	}

source4/smb_server/trans2.c

@@ -39,7 +39,7 @@ static void trans2_grow_data_allocation(struct smbsrv_request *req,
 	if (new_size <= trans->out.data.length) {
 		return;
 	}
-	trans->out.data.data = talloc_realloc(req->mem_ctx, trans->out.data.data, new_size);
+	trans->out.data.data = talloc_realloc(trans->out.data.data, new_size);
 }
 
 

source4/torture/rap/rap.c

@@ -79,7 +79,7 @@ static void rap_cli_push_paramdesc(struct rap_call *call, char desc)
 	if (call->paramdesc != NULL)
 		len = strlen(call->paramdesc);
 
-	call->paramdesc = talloc_realloc(call->mem_ctx, call->paramdesc,
+	call->paramdesc = talloc_realloc(call->paramdesc,
 					 len+2);
 	call->paramdesc[len] = desc;
 	call->paramdesc[len+1] = '\0';

source4/torture/raw/open.c

@@ -150,7 +150,7 @@ static BOOL test_open(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	union smb_fileinfo finfo;
 	const char *fname = BASEDIR "\\torture_open.txt";
 	NTSTATUS status;
-	int fnum, fnum2;
+	int fnum = -1, fnum2;
 	BOOL ret = True;
 
 	printf("Checking RAW_OPEN_OPEN\n");
@@ -261,7 +261,7 @@ static BOOL test_openx(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	union smb_fileinfo finfo;
 	const char *fname = BASEDIR "\\torture_openx.txt";
 	NTSTATUS status;
-	int fnum, fnum2;
+	int fnum = -1, fnum2;
 	BOOL ret = True;
 	int i;
 	struct {
@@ -579,7 +579,7 @@ static BOOL test_ntcreatex(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	const char *fname = BASEDIR "\\torture_ntcreatex.txt";
 	const char *dname = BASEDIR "\\torture_ntcreatex.dir";
 	NTSTATUS status;
-	int fnum;
+	int fnum = -1;
 	BOOL ret = True;
 	int i;
 	struct {
@@ -822,7 +822,7 @@ static BOOL test_mknew(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	union smb_open io;
 	const char *fname = BASEDIR "\\torture_mknew.txt";
 	NTSTATUS status;
-	int fnum;
+	int fnum = -1;
 	BOOL ret = True;
 	time_t basetime = (time(NULL) + 3600*24*3) & ~1;
 	union smb_fileinfo finfo;
@@ -876,7 +876,7 @@ static BOOL test_create(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	union smb_open io;
 	const char *fname = BASEDIR "\\torture_create.txt";
 	NTSTATUS status;
-	int fnum;
+	int fnum = -1;
 	BOOL ret = True;
 	time_t basetime = (time(NULL) + 3600*24*3) & ~1;
 	union smb_fileinfo finfo;
@@ -930,7 +930,7 @@ static BOOL test_ctemp(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 {
 	union smb_open io;
 	NTSTATUS status;
-	int fnum;
+	int fnum = -1;
 	BOOL ret = True;
 	time_t basetime = (time(NULL) + 3600*24*3) & ~1;
 	union smb_fileinfo finfo;

source4/torture/raw/search.c

@@ -377,8 +377,7 @@ static BOOL multiple_search_callback(void *private, union smb_search_data *file)
 
 
 	data->count++;
-	data->list = talloc_realloc(data->mem_ctx, 
+	data->list = talloc_realloc(data->list, 
-				    data->list, 
 				    data->count * (sizeof(data->list[0])));
 
 	data->list[data->count-1] = *file;

source4/torture/rpc/winreg.c

@@ -488,8 +488,9 @@ static BOOL test_Open(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, void *fn)
 	BOOL ret = True;
 	winreg_open_fn *open_fn = (winreg_open_fn *)fn;
 
-	if (!open_fn(p, mem_ctx, &handle))
+	if (!open_fn(p, mem_ctx, &handle)) {
 		return False;
+	}
 
 	if (!test_CreateKey(p, mem_ctx, &handle, "spottyfoot", NULL)) {
 		printf("CreateKey failed\n");