Fox missing SMB_MALLOC return checks noticed by "Andreas Moroder <andreas.moroder@gmx.net>".

Jeremy.

5 files changed, 34 insertions, 3 deletions

diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index f93832e752..449b5d1a60 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -2067,6 +2067,9 @@ void string_append(char **left, const char *right)
 
 	if (*left == NULL) {
 		*left = (char *)SMB_MALLOC(new_len);
+		if (*left == NULL) {
+			return;
+		}
 		*left[0] = '\0';
 	} else {
 		new_len += strlen(*left);
diff --git a/source3/lib/util_unistr.c b/source3/lib/util_unistr.c
index f53ef94d69..4cda38dc19 100644
--- a/source3/lib/util_unistr.c
+++ b/source3/lib/util_unistr.c
@@ -109,6 +109,11 @@ void load_case_tables(void)
 	if (!upcase_table) {
 		DEBUG(1,("creating lame upcase table\n"));
 		upcase_table = (smb_ucs2_t *)SMB_MALLOC(0x20000);
+		if (!upcase_table) {
+			smb_panic("lame upcase table malloc fail");
+			/* notreached. */
+			return;
+		}
 		for (i=0;i<0x10000;i++) {
 			smb_ucs2_t v;
 			SSVAL(&v, 0, i);
@@ -124,6 +129,11 @@ void load_case_tables(void)
 	if (!lowcase_table) {
 		DEBUG(1,("creating lame lowcase table\n"));
 		lowcase_table = (smb_ucs2_t *)SMB_MALLOC(0x20000);
+		if (!lowcase_table) {
+			smb_panic("lame lowcase table malloc fail");
+			/* notreached. */
+			return;
+		}
 		for (i=0;i<0x10000;i++) {
 			smb_ucs2_t v;
 			SSVAL(&v, 0, i);
diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index 7ad4c9a868..051fc961d9 100644
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -987,6 +987,11 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
 
 	output_token.length = 4;
 	output_token.value = SMB_MALLOC(output_token.length);
+	if (!output_token.value) {
+		output_token.length = 0;
+		status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+		goto failed;
+	}
 	p = (uint8 *)output_token.value;
 
 	RSIVAL(p,0,max_msg_size);
@@ -1002,14 +1007,19 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
 	 */
 
 	gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT,
-			  &output_token, &conf_state,
-			  &input_token);
+			&output_token, /* used as *input* here. */
+			&conf_state,
+			&input_token); /* Used as *output* here. */
 	if (gss_rc) {
 		status = ADS_ERROR_GSS(gss_rc, minor_status);
+		output_token.length = 0;
+		SAFE_FREE(output_token.value);
 		goto failed;
 	}
 
-	free(output_token.value);
+	/* We've finished with output_token. */
+	SAFE_FREE(output_token.value);
+	output_token.length = 0;
 
 	cred.bv_val = (char *)input_token.value;
 	cred.bv_len = input_token.length;
diff --git a/source3/libnet/libnet_samsync_ldif.c b/source3/libnet/libnet_samsync_ldif.c
index f18ba5bc33..96bad4da32 100644
--- a/source3/libnet/libnet_samsync_ldif.c
+++ b/source3/libnet/libnet_samsync_ldif.c
@@ -83,6 +83,9 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 	if (suffix_attr == NULL) {
 		len = strlen(suffix);
 		suffix_attr = (char*)SMB_MALLOC(len+1);
+		if (!suffix_attr) {
+			return NT_STATUS_NO_MEMORY;
+		}
 		memcpy(suffix_attr, suffix, len);
 		suffix_attr[len] = '\0';
 	}
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 49da8edb7c..169bf4f037 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -2135,6 +2135,11 @@ static void cli_negprot_done(struct tevent_req *subreq)
 			SAFE_FREE(cli->inbuf);
 			cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
 			cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
+			if (!cli->outbuf || !cli->inbuf) {
+				tevent_req_nterror(req,
+						NT_STATUS_NO_MEMORY);
+				return;
+			}
 			cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
 		}