Change all realloc() statements to Realloc() (ecxept for tdb.c)

changed some code to exploit the fact that Realloc(NULL, size) == malloc(size)
fixed some possible mem leaks, or seg faults.

thanks to andreas moroder (mallocs not checked in client/client.c, client/smbumount.c)
(This used to be commit 7f33c01688b825ab2fa9bbb2730bff4f2fa352be)

8 files changed, 45 insertions, 48 deletions

diff --git a/source3/client/client.c b/source3/client/client.c
index 479c4f764f..32cc34b225 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -1013,6 +1013,10 @@ static void do_put(char *rname,char *lname)
 		 rname));
   
 	buf = (char *)malloc(maxwrite);
+	if (!buf) {
+		DEBUG(0, ("ERROR: Not enough memory!\n"));
+		return;
+	}
 	while (!feof(f)) {
 		int n = maxwrite;
 		int ret;
diff --git a/source3/client/smbumount.c b/source3/client/smbumount.c
index dacf4ab67d..983ad44fa0 100644
--- a/source3/client/smbumount.c
+++ b/source3/client/smbumount.c
@@ -74,6 +74,11 @@ canonicalize (char *path)
 {
 	char *canonical = malloc (PATH_MAX + 1);
 
+	if (!canonical) {
+		fprintf(stderr, "Error! Not enough memory!\n");
+		return NULL;
+	}
+
 	if (strlen(path) > PATH_MAX) {
 		fprintf(stderr, "Mount point string too long\n");
 		return NULL;
diff --git a/source3/lib/sysacls.c b/source3/lib/sysacls.c
index b1347b80e9..98f0617d44 100644
--- a/source3/lib/sysacls.c
+++ b/source3/lib/sysacls.c
@@ -689,7 +689,7 @@ char *sys_acl_to_text(SMB_ACL_T acl_d, ssize_t *len_p)
 
 			maxlen += nbytes + 20 * (acl_d->count - i);
 
-			if ((text = realloc(oldtext, maxlen)) == NULL) {
+			if ((text = Realloc(oldtext, maxlen)) == NULL) {
 				free(oldtext);
 				errno = ENOMEM;
 				return NULL;
diff --git a/source3/lib/talloc.c b/source3/lib/talloc.c
index a8ee481744..cfd130e888 100644
--- a/source3/lib/talloc.c
+++ b/source3/lib/talloc.c
@@ -90,7 +90,7 @@ void *talloc_realloc(TALLOC_CTX *t, void *ptr, size_t size)
 
 	for (tc=t->list; tc; tc=tc->next) {
 		if (tc->ptr == ptr) {
-			ptr = realloc(ptr, size);
+			ptr = Realloc(ptr, size);
 			if (ptr) {
 				t->total_alloc_size += (size - tc->size);
 				tc->size = size;
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 6b3ded8c60..f3e3dcc31c 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -3585,25 +3585,17 @@ char **lp_list_make(char *string)
 		return NULL;
 	}
 	
-	list = (char**)malloc(((sizeof(char**)) * P_LIST_ABS));
-	if (!list) {
-		DEBUG(0,("ERROR: Unable to allocate memory"));
-		free (s);
-		return NULL;
-	}
-	memset (list, 0, ((sizeof(char**)) * P_LIST_ABS));
-	lsize = P_LIST_ABS;
-	
-	num = 0;
+	num = lsize = 0;
+	list = NULL;
 	
 	str = s;
 	while (*str)
 	{
 		if (!next_token(&str, tok, LIST_SEP, sizeof(pstring))) continue;
 		
-		if ((num +1) == lsize) {
+		if (num == lsize) {
 			lsize += P_LIST_ABS;
-			rlist = (char **)realloc(list, ((sizeof(char **)) * lsize));
+			rlist = (char **)Realloc(list, ((sizeof(char **)) * (lsize +1)));
 			if (!rlist) {
 				DEBUG(0,("ERROR: Unable to allocate memory"));
 				lp_list_free (&list);
@@ -3611,7 +3603,7 @@ char **lp_list_make(char *string)
 				return NULL;
 			}
 			else list = rlist;
-			memset (&list[num], 0, ((sizeof(char**)) * P_LIST_ABS));
+			memset (&list[num], 0, ((sizeof(char**)) * (P_LIST_ABS +1)));
 		}
 		
 		list[num] = strdup(tok);
@@ -3637,26 +3629,21 @@ BOOL lp_list_copy(char ***dest, char **src)
 	*dest = NULL;
 	if (!src) return False;
 	
-	list = (char**)malloc(((sizeof(char**)) * P_LIST_ABS));
-	if (!list) {
-		DEBUG(0,("ERROR: Unable to allocate memory"));
-		return False;
-	}
-	memset (list, 0, ((sizeof(char**)) * P_LIST_ABS));
-	lsize = P_LIST_ABS;
+	num = lsize = 0;
+	list = NULL;
 		
-	for (num = 0; src[num]; num++)
+	while (src[num])
 	{
-		if ((num +1) == lsize) {
+		if (num == lsize) {
 			lsize += P_LIST_ABS;
-			rlist = (char **)realloc(list, ((sizeof(char **)) * lsize));
+			rlist = (char **)Realloc(list, ((sizeof(char **)) * (lsize +1)));
 			if (!rlist) {
 				DEBUG(0,("ERROR: Unable to allocate memory"));
 				lp_list_free (&list);
 				return False;
 			}
 			else list = rlist;
-			memset (&list[num], 0, ((sizeof(char**)) * P_LIST_ABS));
+			memset (&list[num], 0, ((sizeof(char **)) * (P_LIST_ABS +1)));
 		}
 		
 		list[num] = strdup(src[num]);
@@ -3665,6 +3652,8 @@ BOOL lp_list_copy(char ***dest, char **src)
 			lp_list_free (&list);
 			return False;
 		}
+
+		num++;
 	}
 	
 	*dest = list;
@@ -3758,4 +3747,3 @@ BOOL lp_list_substitute(char **list, const char *pattern, const char *insert)
 	
 	return True;
 }
-
diff --git a/source3/passdb/ldap.c b/source3/passdb/ldap.c
index b520f521bd..9987990cc2 100644
--- a/source3/passdb/ldap.c
+++ b/source3/passdb/ldap.c
@@ -406,7 +406,7 @@ static void make_a_mod(LDAPMod ***modlist,int modop, char *attribute, char *valu
 	
 	if (mods[i] == NULL)
 	{
-		mods = (LDAPMod **)realloc( mods,  (i+2) * sizeof( LDAPMod * ) );	
+		mods = (LDAPMod **)Realloc( mods,  (i+2) * sizeof( LDAPMod * ) );	
 		if (mods == NULL)
 		{
 			DEBUG(0,("make_a_mod: out of memory!\n"));
@@ -431,7 +431,7 @@ static void make_a_mod(LDAPMod ***modlist,int modop, char *attribute, char *valu
 		{
 			for ( ; mods[ i ]->mod_values[ j ] ! = NULL; j++ );
 		}
-		mods[ i ]->mod_values = (char **)realloc(mods[ i ]->mod_values,
+		mods[ i ]->mod_values = (char **)Realloc(mods[ i ]->mod_values,
 		                                          (j+2) * sizeof( char * ));
 		if ( mods[ i ]->mod_values == NULL)
 		{
diff --git a/source3/printing/print_cups.c b/source3/printing/print_cups.c
index 6d5a5460cd..0a40e5ec91 100644
--- a/source3/printing/print_cups.c
+++ b/source3/printing/print_cups.c
@@ -819,17 +819,16 @@ cups_queue_get(int snum, print_queue_struct **q, print_status_struct *status)
 		{
 			qalloc += 16;
 
-			if (qalloc == 16)
-				temp = malloc(sizeof(print_queue_struct) * qalloc);
-			else
-				temp = realloc(queue, sizeof(print_queue_struct) * qalloc);
+			temp = Realloc(queue, sizeof(print_queue_struct) * qalloc);
 
 			if (temp == NULL)
 			{
+				DEBUG(0,("cups_queue_get: Not enough memory!");
 				ippDelete(response);
 				httpClose(http);
 
-				return (qcount);
+				free (queue);
+				return (0);
 			}
 
 			queue = temp;
@@ -960,6 +959,7 @@ cups_queue_get(int snum, print_queue_struct **q, print_status_struct *status)
 		DEBUG(0,("Unable to get printer status for %s - %s\n", PRINTERNAME(snum),
 			 ippErrorString(cupsLastError())));
 		httpClose(http);
+		*q = queue;
 		return (qcount);
 	}
 
@@ -969,7 +969,7 @@ cups_queue_get(int snum, print_queue_struct **q, print_status_struct *status)
 			 ippErrorString(response->request.status.status_code)));
 		ippDelete(response);
 		httpClose(http);
-
+		*q = queue;
 		return (qcount);
 	}
 
diff --git a/source3/web/cgi.c b/source3/web/cgi.c
index e47514904b..74e9969ff4 100644
--- a/source3/web/cgi.c
+++ b/source3/web/cgi.c
@@ -85,16 +85,23 @@ static void unescape(char *buf)
 
 static char *grab_line(FILE *f, int *cl)
 {
-	char *ret;
+	char *ret = NULL;
 	int i = 0;
 	int len = 1024;
 
-	ret = (char *)malloc(len);
-	if (!ret) return NULL;
-	
-
 	while ((*cl)) {
-		int c = fgetc(f);
+		int c;
+	
+		if (i == len) {
+			char *ret2;
+			if (len == 0) len = 1024;
+			else len *= 2;
+			ret2 = (char *)Realloc(ret, len*2);
+			if (!ret2) return ret;
+			ret = ret2;
+		}
+	
+		c = fgetc(f);
 		(*cl)--;
 
 		if (c == EOF) {
@@ -108,13 +115,6 @@ static char *grab_line(FILE *f, int *cl)
 
 		ret[i++] = c;
 
-		if (i == len-1) {
-			char *ret2;
-			ret2 = (char *)realloc(ret, len*2);
-			if (!ret2) return ret;
-			len *= 2;
-			ret = ret2;
-		}
 	}