this is a big global fix for the ptr = Realloc(ptr, size) bug.

many possible mem leaks, and segfaults fixed.

someone should port this fix to 2.2 also.
(This used to be commit fa8e55b8b465114ce209344965c1ca0333b84db9)

4 files changed, 32 insertions, 14 deletions

diff --git a/source3/lib/time.c b/source3/lib/time.c
index 9714d4b9f8..12643b0522 100644
--- a/source3/lib/time.c
+++ b/source3/lib/time.c
@@ -121,7 +121,7 @@ Updated by Paul Eggert <eggert@twinsun.com>
 ********************************************************************/
 static int TimeZoneFaster(time_t t)
 {
-  static struct dst_table {time_t start,end; int zone;} *dst_table = NULL;
+  static struct dst_table {time_t start,end; int zone;} *tdt, *dst_table = NULL;
   static int table_size = 0;
   int i;
   int zone = 0;
@@ -141,11 +141,14 @@ static int TimeZoneFaster(time_t t)
     time_t low,high;
 
     zone = TimeZone(t);
-    dst_table = (struct dst_table *)Realloc(dst_table,
+    tdt = (struct dst_table *)Realloc(dst_table,
 					      sizeof(dst_table[0])*(i+1));
-    if (!dst_table) {
+    if (!tdt) {
+      DEBUG(0,("TimeZoneFaster: out of memory!\n"));
+      if (dst_table) free (dst_table);
       table_size = 0;
     } else {
+      dst_table = tdt;
       table_size++;
 
       dst_table[i].zone = zone; 
diff --git a/source3/lib/util.c b/source3/lib/util.c
index ac0a004a26..33d604e85f 100644
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -166,11 +166,15 @@ char *get_numlist(char *p, uint32 **num, int *count)
 
 	while ((p = Atoic(p, &val, ":,")) != NULL && (*p) != ':')
 	{
-		(*num) = Realloc((*num), ((*count)+1) * sizeof(uint32));
-		if ((*num) == NULL)
+		uint32 *tn;
+		
+		tn = Realloc((*num), ((*count)+1) * sizeof(uint32));
+		if (tn == NULL)
 		{
+			if (*num) free(*num);
 			return NULL;
 		}
+		else (*num) = tn;
 		(*num)[(*count)] = val;
 		(*count)++;
 		p++;
diff --git a/source3/lib/util_array.c b/source3/lib/util_array.c
index 567c170834..dcb08d9ce7 100644
--- a/source3/lib/util_array.c
+++ b/source3/lib/util_array.c
@@ -58,15 +58,18 @@ void* add_copy_to_array(uint32 *len, void ***array, const void *item,
 
 void* add_item_to_array(uint32 *len, void ***array, void *item)
 {
+	void **tary;
+
 	if (len == NULL || array == NULL)
 	{
 		return NULL;
 	}
 
-	(*array) = (void**)Realloc((*array), ((*len)+1)*sizeof((*array)[0]));
+	tary = (void**)Realloc((*array), ((*len)+1)*sizeof((*array)[0]));
 
-	if ((*array) != NULL)
+	if (tary != NULL)
 	{
+		(*array) = tary;
 		(*array)[(*len)] = item;
 		(*len)++;
 		return item;
diff --git a/source3/lib/util_file.c b/source3/lib/util_file.c
index a92eb15333..d80c09666b 100644
--- a/source3/lib/util_file.c
+++ b/source3/lib/util_file.c
@@ -287,7 +287,7 @@ char *fgets_slash(char *s2,int maxlen,FILE *f)
   if (!s2)
     {
       maxlen = MIN(maxlen,8);
-      s = (char *)Realloc(s,maxlen);
+      s = (char *)malloc(maxlen);
     }
 
   if (!s) return(NULL);
@@ -327,9 +327,15 @@ char *fgets_slash(char *s2,int maxlen,FILE *f)
 	}
       if (!s2 && len > maxlen-3)
 	{
+	  char *t;
+	  
 	  maxlen *= 2;
-	  s = (char *)Realloc(s,maxlen);
-	  if (!s) return(NULL);
+	  t = (char *)Realloc(s,maxlen);
+	  if (!t) {
+	    DEBUG(0,("fgets_slash: failed to expand buffer!\n"));
+	    if (s) free(s);
+	    return(NULL);
+	  } else s = t;
 	}
     }
   return(s);
@@ -342,7 +348,7 @@ load from a pipe into memory
 char *file_pload(char *syscmd, size_t *size)
 {
 	int fd, n;
-	char *p;
+	char *p, *tp;
 	pstring buf;
 	size_t total;
 	
@@ -353,11 +359,13 @@ char *file_pload(char *syscmd, size_t *size)
 	total = 0;
 
 	while ((n = read(fd, buf, sizeof(buf))) > 0) {
-		p = Realloc(p, total + n + 1);
-		if (!p) {
+		tp = Realloc(p, total + n + 1);
+		if (!tp) {
+		        DEBUG(0,("file_pload: failed to exand buffer!\n"));
 			close(fd);
+			if (p) free(p);
 			return NULL;
-		}
+		} else p = tp;
 		memcpy(p+total, buf, n);
 		total += n;
 	}