summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStefan Metzmacher <metze@samba.org>2008-02-13 14:52:53 +0100
committerStefan Metzmacher <metze@samba.org>2008-02-13 16:23:34 +0100
commita9d30b0d61a6a3363dc659c3e07ce1615c5e85df (patch)
tree85b0d9d7190adc5604d379821cf6799726ab2c5a
parent4218856ba908e793c7e5e1edb9153c9036c843a4 (diff)
downloadsamba-a9d30b0d61a6a3363dc659c3e07ce1615c5e85df.tar.gz
samba-a9d30b0d61a6a3363dc659c3e07ce1615c5e85df.tar.bz2
samba-a9d30b0d61a6a3363dc659c3e07ce1615c5e85df.zip
torture/eventlog: fix crash bugs!
This bug was introduced in 92b8bde561277a6b83048ce003cc29ff1b380255 and this shows that we need to be very, very careful in changing idl elements from scalars to [ref] pointers! metze (This used to be commit 3ec4bce0b64764e364aedea2800eed296805c51e)
-rw-r--r--source4/torture/rpc/eventlog.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/source4/torture/rpc/eventlog.c b/source4/torture/rpc/eventlog.c
index 047146edaf..4701fdfe4d 100644
--- a/source4/torture/rpc/eventlog.c
+++ b/source4/torture/rpc/eventlog.c
@@ -67,11 +67,14 @@ static bool test_GetNumRecords(struct torture_context *tctx, struct dcerpc_pipe
struct eventlog_GetNumRecords r;
struct eventlog_CloseEventLog cr;
struct policy_handle handle;
+ uint32_t number = 0;
if (!get_policy_handle(tctx, p, &handle))
return false;
+ ZERO_STRUCT(r);
r.in.handle = &handle;
+ r.out.number = &number;
torture_assert_ntstatus_ok(tctx,
dcerpc_eventlog_GetNumRecords(p, tctx, &r),
@@ -98,6 +101,7 @@ static bool test_ReadEventLog(struct torture_context *tctx,
if (!get_policy_handle(tctx, p, &handle))
return false;
+ ZERO_STRUCT(r);
r.in.offset = 0;
r.in.handle = &handle;
r.in.flags = EVENTLOG_BACKWARDS_READ|EVENTLOG_SEQUENTIAL_READ;
@@ -107,11 +111,15 @@ static bool test_ReadEventLog(struct torture_context *tctx,
struct eventlog_Record rec;
struct ndr_pull *ndr;
enum ndr_err_code ndr_err;
+ uint32_t sent_size = 0;
+ uint32_t real_size = 0;
/* Read first for number of bytes in record */
r.in.number_of_bytes = 0;
r.out.data = NULL;
+ r.out.sent_size = &sent_size;
+ r.out.real_size = &real_size;
status = dcerpc_eventlog_ReadEventLogW(p, tctx, &r);