this is a big global fix for the ptr = Realloc(ptr, size) bug.

many possible mem leaks, and segfaults fixed.

someone should port this fix to 2.2 also.
(This used to be commit fa8e55b8b465114ce209344965c1ca0333b84db9)

5 files changed, 42 insertions, 13 deletions

diff --git a/source3/groupdb/aliasdb.c b/source3/groupdb/aliasdb.c
index a6876d0afc..eed417a699 100644
--- a/source3/groupdb/aliasdb.c
+++ b/source3/groupdb/aliasdb.c
@@ -140,16 +140,19 @@ LOCAL_GRP *iterate_getaliasnam(char *name, LOCAL_GRP_MEMBER **mem, int *num_mem)
  *************************************************************************/
 BOOL add_domain_alias(LOCAL_GRP **alss, int *num_alss, LOCAL_GRP *als)
 {
+	LOCAL_GRP *talss;
+
 	if (alss == NULL || num_alss == NULL || als == NULL)
 	{
 		return False;
 	}
 
-	(*alss) = Realloc((*alss), ((*num_alss)+1) * sizeof(LOCAL_GRP));
-	if ((*alss) == NULL)
+	talss = Realloc((*alss), ((*num_alss)+1) * sizeof(LOCAL_GRP));
+	if (talss == NULL)
 	{
 		return False;
 	}
+	else (*alss) = talss;
 
 	DEBUG(10,("adding alias %s(%s)\n", als->name, als->comment));
 
diff --git a/source3/groupdb/aliasfile.c b/source3/groupdb/aliasfile.c
index 4b8bbe3079..2735fef38f 100644
--- a/source3/groupdb/aliasfile.c
+++ b/source3/groupdb/aliasfile.c
@@ -128,12 +128,13 @@ static char *get_alias_members(char *p, int *num_mem, LOCAL_GRP_MEMBER **members
 
 	while (next_token(&p, name, ",", sizeof(fstring)))
 	{
+		LOCAL_GRP_MEMBER *mbrs;
 		DOM_SID sid;
 		uint8 type;
 
 		if (lookup_sid(name, &sid, &type))
 		{
-			(*members) = Realloc((*members), ((*num_mem)+1) * sizeof(LOCAL_GRP_MEMBER));
+			mbrs = Realloc((*members), ((*num_mem)+1) * sizeof(LOCAL_GRP_MEMBER));
 			(*num_mem)++;
 		}
 		else
@@ -141,10 +142,12 @@ static char *get_alias_members(char *p, int *num_mem, LOCAL_GRP_MEMBER **members
 			DEBUG(0,("alias database: could not resolve alias named %s\n", name));
 			continue;
 		}
-		if ((*members) == NULL)
+		if (mbrs == NULL)
 		{
 			return NULL;
 		}
+		else (*members) = mbrs;
+		
 		fstrcpy((*members)[(*num_mem)-1].name, name);
 		(*members)[(*num_mem)-1].sid_use = type;
 		sid_copy(&(*members)[(*num_mem)-1].sid, &sid);
diff --git a/source3/groupdb/groupdb.c b/source3/groupdb/groupdb.c
index 1f773d9f15..4b7795c57b 100644
--- a/source3/groupdb/groupdb.c
+++ b/source3/groupdb/groupdb.c
@@ -138,16 +138,19 @@ DOMAIN_GRP *iterate_getgroupnam(char *name, DOMAIN_GRP_MEMBER **mem, int *num_me
  *************************************************************************/
 BOOL add_domain_group(DOMAIN_GRP **grps, int *num_grps, DOMAIN_GRP *grp)
 {
+	DOMAIN_GRP *tgrps;
+
 	if (grps == NULL || num_grps == NULL || grp == NULL)
 	{
 		return False;
 	}
 
-	(*grps) = Realloc((*grps), ((*num_grps)+1) * sizeof(DOMAIN_GRP));
-	if ((*grps) == NULL)
+	tgrps = Realloc((*grps), ((*num_grps)+1) * sizeof(DOMAIN_GRP));
+	if (tgrps == NULL)
 	{
 		return False;
 	}
+	else (*grps) = tgrps;
 
 	DEBUG(10,("adding group %s(%s)\n", grp->name, grp->comment));
 
diff --git a/source3/groupdb/groupfile.c b/source3/groupdb/groupfile.c
index 88d362e7d4..ba9027b4f6 100644
--- a/source3/groupdb/groupfile.c
+++ b/source3/groupdb/groupfile.c
@@ -128,11 +128,14 @@ static char *get_group_members(char *p, int *num_mem, DOMAIN_GRP_MEMBER **member
 
 	while (next_token(&p, name, ",", sizeof(fstring)))
 	{
-		(*members) = Realloc((*members), ((*num_mem)+1) * sizeof(DOMAIN_GRP_MEMBER));
-		if ((*members) == NULL)
+		DOMAIN_GRP_MEMBER *mbrs;
+		
+		mbrs = Realloc((*members), ((*num_mem)+1) * sizeof(DOMAIN_GRP_MEMBER));
+		if (mbrs == NULL)
 		{
 			return NULL;
 		}
+		else (*members) = mbrs;
 		fstrcpy((*members)[(*num_mem)].name, name);
 		(*members)[(*num_mem)].attr = 0x07;
 		(*num_mem)++;
diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c
index 97e7551586..268a1b1bd4 100644
--- a/source3/groupdb/mapping.c
+++ b/source3/groupdb/mapping.c
@@ -395,7 +395,7 @@ BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 	fstring string_sid;
 	fstring group_type;
 	GROUP_MAP map;
-	GROUP_MAP *mapt=NULL;
+	GROUP_MAP *mapt;
 	int ret;
 	int entries=0;
 
@@ -433,7 +433,14 @@ BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 		
 		decode_sid_name_use(group_type, map.sid_name_use);
 
-		mapt=(GROUP_MAP *)Realloc(mapt, (entries+1)*sizeof(GROUP_MAP));
+		mapt=(GROUP_MAP *)Realloc((*rmap), (entries+1)*sizeof(GROUP_MAP));
+		if (!mapt) {
+			DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
+			if (*rmap) free(*rmap);
+			*rmap=NULL;
+			return False;
+		}
+		else (*rmap) = mapt;
 
 		mapt[entries].gid = map.gid;
 		sid_copy( &mapt[entries].sid, &map.sid);
@@ -445,7 +452,6 @@ BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 		entries++;
 	}
 
-	*rmap=mapt;
 	*num_entries=entries;
 	return True;
 }
@@ -661,6 +667,7 @@ BOOL get_uid_list_of_group(gid_t gid, uid_t **uid, int *num_uids)
 	struct passwd *pwd;
 	int i=0;
 	char *gr;
+	uid_t *u;
  
 	*num_uids = 0;
 	*uid=NULL;
@@ -672,7 +679,12 @@ BOOL get_uid_list_of_group(gid_t gid, uid_t **uid, int *num_uids)
 	DEBUG(10, ("getting members\n"));
         
 	while (gr && (*gr != (char)'\0')) {
-		(*uid)=Realloc((*uid), sizeof(uid_t)*(*num_uids+1));
+		u = Realloc((*uid), sizeof(uid_t)*(*num_uids+1));
+		if (!u) {
+			DEBUG(0,("get_uid_list_of_group: unable to enlarge uid list!\n"));
+			return False;
+		}
+		else (*uid) = u;
 
 		if( (pwd=getpwnam(gr)) !=NULL) {
 			(*uid)[*num_uids]=pwd->pw_uid;
@@ -685,7 +697,12 @@ BOOL get_uid_list_of_group(gid_t gid, uid_t **uid, int *num_uids)
 	setpwent();
 	while ((pwd=getpwent()) != NULL) {
 		if (pwd->pw_gid==gid) {
-			(*uid)=Realloc((*uid), sizeof(uid_t)*(*num_uids+1));
+			u = Realloc((*uid), sizeof(uid_t)*(*num_uids+1));
+			if (!u) {
+				DEBUG(0,("get_uid_list_of_group: unable to enlarge uid list!\n"));
+				return False;
+			}
+			else (*uid) = u;
 			(*uid)[*num_uids]=pwd->pw_uid;
 
 			(*num_uids)++;