sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

r16582: Fix Klocwork #1997 and all generic class of problems

Browse Source 
where we don't correctly check the return from memdup.
Jeremy.
(This used to be commit ce14daf51c)
This commit is contained in:
Jeremy Allison 2006-06-28 00:50:14 +00:00 committed by Gerald (Jerry) Carter
parent 5a1a08d428
commit d1014c1cdf
6 changed files with 62 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source3/lib/interface.c
View File

@ -188,6 +188,10 @@ void load_interfaces(void)
if (total_probed > 0) {
probed_ifaces = memdup(ifaces, sizeof(ifaces[0])*total_probed);
if (!probed_ifaces) {
DEBUG(0,("ERROR: memdup failed\n"));
exit(1);
}
}
/* if we don't have a interfaces line then use all broadcast capable

6
source3/libsmb/clirap.c
View File

@ -848,6 +848,12 @@ BOOL cli_qfileinfo_test(struct cli_state *cli, int fnum, int level, char **poutd
}
*poutdata = memdup(rdata, data_len);
if (!*poutdata) {
SAFE_FREE(rdata);
SAFE_FREE(rparam);
return False;
}
*poutlen = data_len;
SAFE_FREE(rdata);

6
source3/passdb/pdb_tdb.c
View File

@ -902,6 +902,12 @@ static int tdbsam_traverse_setpwent(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data,
/* save a copy of the key */
ptr->key.dptr = memdup( key.dptr, key.dsize );
if (!ptr->key.dptr) {
DEBUG(0,("tdbsam_traverse_setpwent: memdup failed\n"));
/* just return 0 and let the traversal continue */
return 0;
}
ptr->key.dsize = key.dsize;
DLIST_ADD( tdbsam_pwent_list, ptr );

15
source3/printing/nt_printing.c
View File

@ -738,6 +738,9 @@ uint32 get_c_setprinter(void)
int get_builtin_ntforms(nt_forms_struct **list)
{
*list = (nt_forms_struct *)memdup(&default_forms[0], sizeof(default_forms));
if (!*list) {
return 0;
}
return sizeof(default_forms) / sizeof(default_forms[0]);
}
@ -2078,6 +2081,10 @@ static WERROR get_a_printer_driver_3_default(NT_PRINTER_DRIVER_INFO_LEVEL_3 **in
fstrcpy(info.dependentfiles[0], "");
*info_ptr = memdup(&info, sizeof(info));
if (!*info_ptr) {
SAFE_FREE(info.dependentfiles);
return WERR_NOMEM;
}
return WERR_OK;
}
@ -2152,6 +2159,10 @@ static WERROR get_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 **info_ptr,
}
*info_ptr = (NT_PRINTER_DRIVER_INFO_LEVEL_3 *)memdup(&driver, sizeof(driver));
if (!*info_ptr) {
SAFE_FREE(driver.dependentfiles);
return WERR_NOMEM;
}
return WERR_OK;
}
@ -2652,6 +2663,10 @@ int unpack_devicemode(NT_DEVICEMODE **nt_devmode, char *buf, int buflen)
}
*nt_devmode = (NT_DEVICEMODE *)memdup(&devmode, sizeof(devmode));
if (!*nt_devmode) {
SAFE_FREE(devmode.nt_dev_private);
return -1;
}
DEBUG(8,("Unpacked devicemode [%s](%s)\n", devmode.devicename, devmode.formname));
if (devmode.nt_dev_private)

15
source3/rpc_server/srv_pipe.c
View File

@ -679,7 +679,8 @@ static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
if (p->pipe_user.ut.ngroups) {
if (!(p->pipe_user.ut.groups = memdup(a->server_info->groups,
sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
DEBUG(0,("pipe_ntlmssp_verify_final: failed to memdup group list to p->pipe_user.groups\n"));
data_blob_free(&p->session_key);
return False;
}
}
@ -687,9 +688,17 @@ static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
if (a->server_info->ptok) {
p->pipe_user.nt_user_token =
dup_nt_token(NULL, a->server_info->ptok);
if (!p->pipe_user.nt_user_token) {
DEBUG(1,("pipe_ntlmssp_verify_final: dup_nt_token failed.\n"));
data_blob_free(&p->session_key);
SAFE_FREE(p->pipe_user.ut.groups);
return False;
}
} else {
DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
p->pipe_user.nt_user_token = NULL;
DEBUG(1,("pipe_ntlmssp_verify_final: Error: Authmodule failed to provide nt_user_token\n"));
data_blob_free(&p->session_key);
SAFE_FREE(p->pipe_user.ut.groups);
return False;
}

22
source3/smbd/sec_ctx.c
View File

@ -252,13 +252,29 @@ void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, NT_USER_TOKEN
ctx_p->ut.ngroups = ngroups;
SAFE_FREE(ctx_p->ut.groups);
if (token && (token == ctx_p->token))
if (token && (token == ctx_p->token)) {
smb_panic("DUPLICATE_TOKEN");
}
TALLOC_FREE(ctx_p->token);
ctx_p->ut.groups = memdup(groups, sizeof(gid_t) * ngroups);
ctx_p->token = dup_nt_token(NULL, token);
if (ngroups) {
ctx_p->ut.groups = memdup(groups, sizeof(gid_t) * ngroups);
if (!ctx_p->ut.groups) {
smb_panic("memdup failed");
}
} else {
ctx_p->ut.groups = NULL;
}
if (token) {
ctx_p->token = dup_nt_token(NULL, token);
if (!ctx_p->token) {
smb_panic("dup_nt_token failed");
}
} else {
ctx_p->token = NULL;
}
become_id(uid, gid);