s3-smbd: Change allocation of smb_acl_t to talloc()

The acl element is changed to be a talloc child, and is no longer one element
longer than requested by virtue of the acl[1] base pointer.

This also avoids one of the few remaining cases of over-allocation of a structure.

Andrew Bartlett

source3/include/smb_acls.h

@@ -54,7 +54,7 @@ typedef struct smb_acl_t {
 	int	size;
 	int	count;
 	int	next;
-	struct smb_acl_entry acl[1];
+	struct smb_acl_entry *acl;
 } *SMB_ACL_T;
 
 typedef struct smb_acl_entry 	*SMB_ACL_ENTRY_T;

source3/lib/sysacls.c

@@ -258,15 +258,7 @@ SMB_ACL_T sys_acl_init(int count)
 		return NULL;
 	}
 
-	/*
-	 * note that since the definition of the structure pointed
-	 * to by the SMB_ACL_T includes the first element of the
-	 * acl[] array, this actually allocates an ACL with room
-	 * for (count+1) entries
-	 */
-	if ((a = (struct smb_acl_t *)SMB_MALLOC(
-		     sizeof(struct smb_acl_t) +
-		     count * sizeof(struct smb_acl_entry))) == NULL) {
+	if ((a = talloc(NULL, struct smb_acl_t)) == NULL) {
 		errno = ENOMEM;
 		return NULL;
 	}
@@ -275,6 +267,13 @@ SMB_ACL_T sys_acl_init(int count)
 	a->count = 0;
 	a->next = -1;
 
+	a->acl = talloc_array(a, struct smb_acl_entry, count+1);
+	if (!a->acl) {
+		TALLOC_FREE(a);
+		errno = ENOMEM;
+		return NULL;
+	}
+
 	return a;
 }
 
@@ -357,7 +356,7 @@ int sys_acl_free_text(char *text)
 
 int sys_acl_free_acl(SMB_ACL_T acl_d) 
 {
-	SAFE_FREE(acl_d);
+	TALLOC_FREE(acl_d);
 	return 0;
 }
 

source3/modules/vfs_aixacl2.c

@@ -229,7 +229,7 @@ static SMB_ACL_T aixjfs2_get_posix_acl(const char *path, acl_type_t type)
 
  done:
         if (errno != 0) {
-                SAFE_FREE(result);
+                TALLOC_FREE(result);
         }
         return result;
 }

source3/modules/vfs_aixacl_util.c

@@ -27,14 +27,13 @@ SMB_ACL_T aixacl_to_smbacl(struct acl *file_acl)
 	struct acl_entry *acl_entry;
 	struct ace_id *idp;
 	
-	struct smb_acl_t *result = SMB_MALLOC_P(struct smb_acl_t);
+	struct smb_acl_t *result = sys_acl_init(0);
 	struct smb_acl_entry *ace;
 	int i;
 	
 	if (result == NULL) {
 		return NULL;
 	}
-	ZERO_STRUCTP(result);
 	
 	/* Point to the first acl entry in the acl */
 	acl_entry =  file_acl->acl_ext;
@@ -64,11 +63,9 @@ SMB_ACL_T aixacl_to_smbacl(struct acl *file_acl)
 			idp = acl_entry->ace_id;
 			DEBUG(10,("idp->id_data is %d\n",idp->id_data[0]));
 			
-			result = SMB_REALLOC(result, sizeof(struct smb_acl_t) +
-				     (sizeof(struct smb_acl_entry) *
-				      (result->count+1)));
+			result->acl = talloc_realloc(result, result->acl, result->count+1);
 			if (result == NULL) {
-				DEBUG(0, ("SMB_REALLOC failed\n"));
+				DEBUG(0, ("talloc_realloc failed\n"));
 				errno = ENOMEM;
 				return NULL;
 			}
@@ -117,7 +114,7 @@ SMB_ACL_T aixacl_to_smbacl(struct acl *file_acl)
 				break;
 			default:
 				DEBUG(0, ("unknown ace->type\n"));
-			 	SAFE_FREE(result);
+			 	TALLOC_FREE(result);
 				return(0);
 			}
 		
@@ -141,15 +138,14 @@ SMB_ACL_T aixacl_to_smbacl(struct acl *file_acl)
 	for( i = 1; i < 4; i++) {
 		DEBUG(10,("i is %d\n",i));
 
-			result = SMB_REALLOC(result, sizeof(struct smb_acl_t) +
-				     (sizeof(struct smb_acl_entry) *
-				      (result->count+1)));
-			if (result == NULL) {
-				DEBUG(0, ("SMB_REALLOC failed\n"));
-				errno = ENOMEM;
-				DEBUG(0,("Error in AIX sys_acl_get_file is %d\n",errno));
-				return NULL;
-			}
+		result->acl = talloc_realloc(result, result->acl, result->count+1);
+		if (result->acl == NULL) {
+			TALLOC_FREE(result);
+			DEBUG(0, ("talloc_realloc failed\n"));
+			errno = ENOMEM;
+			DEBUG(0,("Error in AIX sys_acl_get_file is %d\n",errno));
+			return NULL;
+		}
 			
 		ace = &result->acl[result->count];
 		

source3/modules/vfs_gpfs.c

@@ -594,7 +594,7 @@ static SMB_ACL_T gpfs2smb_acl(const struct gpfs_acl *pacl)
 			DEBUG(10, ("Got invalid ace_type: %d\n",
 				   g_ace->ace_type));
 			errno = EINVAL;
-			SAFE_FREE(result);
+			TALLOC_FREE(result);
 			return NULL;
 		}
 
@@ -648,7 +648,7 @@ static SMB_ACL_T gpfsacl_get_posix_acl(const char *path, gpfs_aclType_t type)
  done:
 
 	if (errno != 0) {
-		SAFE_FREE(result);
+		TALLOC_FREE(result);
 	}
 	return result;	
 }

source3/modules/vfs_hpuxacl.c

@@ -386,7 +386,7 @@ int hpuxacl_sys_acl_delete_def_file(vfs_handle_struct *handle,
  done:
 	DEBUG(10, ("hpuxacl_sys_acl_delete_def_file %s.\n",
 		   ((ret != 0) ? "failed" : "succeeded" )));
-	SAFE_FREE(smb_acl);
+	TALLOC_FREE(smb_acl);
 	return ret;
 }
 
@@ -506,11 +506,8 @@ static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpux_acl, int count,
 		if (!_IS_OF_TYPE(hpux_acl[i], type)) {
 			continue;
 		}
-		result = SMB_REALLOC(result, 
-				     sizeof(struct smb_acl_t) +
-				     (sizeof(struct smb_acl_entry) *
-				      (result->count + 1)));
-		if (result == NULL) {
+		result->acl = talloc_realloc(result, result->acl, struct smb_acl_entry, result->count + 1);
+		if (result->acl == NULL) {
 			DEBUG(10, ("error reallocating memory for SMB_ACL\n"));
 			goto fail;
 		}
@@ -534,7 +531,7 @@ static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpux_acl, int count,
 	}
 	goto done;
  fail:
-	SAFE_FREE(result);
+	TALLOC_FREE(result);
  done:
 	DEBUG(10, ("hpux_acl_to_smb_acl %s\n",
 		   ((result == NULL) ? "failed" : "succeeded")));

source3/modules/vfs_posixacl.c

@@ -214,28 +214,27 @@ static bool smb_ace_to_internal(acl_entry_t posix_ace,
 
 static struct smb_acl_t *smb_acl_to_internal(acl_t acl)
 {
-	struct smb_acl_t *result = SMB_MALLOC_P(struct smb_acl_t);
+	struct smb_acl_t *result = sys_acl_init(0);
 	int entry_id = ACL_FIRST_ENTRY;
 	acl_entry_t e;
 	if (result == NULL) {
 		return NULL;
 	}
-	ZERO_STRUCTP(result);
 	while (acl_get_entry(acl, entry_id, &e) == 1) {
 
 		entry_id = ACL_NEXT_ENTRY;
 
-		result = (struct smb_acl_t *)SMB_REALLOC(
-			result, sizeof(struct smb_acl_t) +
-			(sizeof(struct smb_acl_entry) * (result->count+1)));
-		if (result == NULL) {
-			DEBUG(0, ("SMB_REALLOC failed\n"));
+		result->acl = talloc_realloc(result, result->acl, 
+					     struct smb_acl_entry, result->count+1);
+		if (result->acl == NULL) {
+			TALLOC_FREE(result);
+			DEBUG(0, ("talloc_realloc failed\n"));
 			errno = ENOMEM;
 			return NULL;
 		}
 
 		if (!smb_ace_to_internal(e, &result->acl[result->count])) {
-			SAFE_FREE(result);
+			TALLOC_FREE(result);
 			return NULL;
 		}
 

source3/modules/vfs_solarisacl.c

@@ -323,7 +323,7 @@ int solarisacl_sys_acl_delete_def_file(vfs_handle_struct *handle,
  done:
 	DEBUG(10, ("solarisacl_sys_acl_delete_def_file %s.\n",
 		   ((ret != 0) ? "failed" : "succeeded" )));
-	SAFE_FREE(smb_acl);
+	TALLOC_FREE(smb_acl);
 	return ret;
 }
 
@@ -440,11 +440,8 @@ static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solaris_acl, int count,
 		if (!_IS_OF_TYPE(solaris_acl[i], type)) {
 			continue;
 		}
-		result = SMB_REALLOC(result, 
-				     sizeof(struct smb_acl_t) +
-				     (sizeof(struct smb_acl_entry) *
-				      (result->count + 1)));
-		if (result == NULL) {
+		result->acl = talloc_realloc(result, result->acl, struct smb_acl_entry, result->count + 1);
+		if (result->acl == NULL) {
 			DEBUG(10, ("error reallocating memory for SMB_ACL\n"));
 			goto fail;
 		}
@@ -469,7 +466,7 @@ static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solaris_acl, int count,
 	goto done;
 	
  fail:
-	SAFE_FREE(result);
+	TALLOC_FREE(result);
  done:
 	DEBUG(10, ("solaris_acl_to_smb_acl %s\n",
 		   ((result == NULL) ? "failed" : "succeeded")));

source3/modules/vfs_tru64acl.c

@@ -160,28 +160,27 @@ static struct smb_acl_t *tru64_acl_to_smb_acl(const struct acl *tru64_acl)
 
 	DEBUG(10, ("Hi! This is tru64_acl_to_smb_acl.\n"));
 	
-	if ((result = SMB_MALLOC_P(struct smb_acl_t)) == NULL) {
-		DEBUG(0, ("SMB_MALLOC_P failed in tru64_acl_to_smb_acl\n"));
+	if ((result = sys_acl_init(0)) == NULL) {
+		DEBUG(0, ("sys_acl_init() failed in tru64_acl_to_smb_acl\n"));
 		errno = ENOMEM;
 		goto fail;
 	}
-	ZERO_STRUCTP(result);
 	if (acl_first_entry((struct acl *)tru64_acl) != 0) {
 		DEBUG(10, ("acl_first_entry failed: %s\n", strerror(errno)));
 		goto fail;
 	}
 	while ((entry = acl_get_entry((struct acl *)tru64_acl)) != NULL) {
-		result = SMB_REALLOC(result, sizeof(struct smb_acl_t) +
-					(sizeof(struct smb_acl_entry) * 
-					 (result->count + 1)));
-		if (result == NULL) {
-			DEBUG(0, ("SMB_REALLOC failed in tru64_acl_to_smb_acl\n"));
+		result->acl = talloc_realloc(result, result->acl, struct smb_acl_entry, 
+					     result->count + 1);
+		if (result->acl == NULL) {
+			TALLOC_FREE(result);
+			DEBUG(0, ("talloc_realloc failed in tru64_acl_to_smb_acl\n"));
 			errno = ENOMEM;
 			goto fail;
 		}
 		/* XYZ */
 		if (!tru64_ace_to_smb_ace(entry, &result->acl[result->count])) {
-			SAFE_FREE(result);
+			TALLOC_FREE(result);
 			goto fail;
 		}
 		result->count += 1;
@@ -189,9 +188,7 @@ static struct smb_acl_t *tru64_acl_to_smb_acl(const struct acl *tru64_acl)
 	return result;
 
 fail:
-	if (result != NULL) {
-		SAFE_FREE(result);
-	}
+	TALLOC_FREE(result);
 	DEBUG(1, ("tru64_acl_to_smb_acl failed!\n"));
 	return NULL;
 }