this is a big global fix for the ptr = Realloc(ptr, size) bug.

many possible mem leaks, and segfaults fixed.

someone should port this fix to 2.2 also.
(This used to be commit fa8e55b8b465114ce209344965c1ca0333b84db9)

1 files changed, 26 insertions, 4 deletions

diff --git a/source3/libsmb/clitrans.c b/source3/libsmb/clitrans.c
index ac50c7bf6d..c4e19b9375 100644
--- a/source3/libsmb/clitrans.c
+++ b/source3/libsmb/clitrans.c
@@ -147,6 +147,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 	int this_data,this_param;
 	uint8 eclass;
 	uint32 ecode;
+	char *tdata;
 
 	*data_len = *param_len = 0;
 
@@ -187,8 +188,18 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 	total_param = SVAL(cli->inbuf,smb_tprcnt);
 
 	/* allocate it */
-	*data = Realloc(*data,total_data);
-	*param = Realloc(*param,total_param);
+	tdata = Realloc(*data,total_data);
+	if (!tdata) {
+		DEBUG(0,("cli_receive_trans: failed to enlarge buffer"));
+		return False;
+	}
+	else *data = tdata;
+	tdata = Realloc(*param,total_param);
+	if (!tdata) {
+		DEBUG(0,("cli_receive_trans: failed to enlarge buffer"));
+		return False;
+	}
+	else *param = tdata;
 
 	while (1)  {
 		this_data = SVAL(cli->inbuf,smb_drcnt);
@@ -358,6 +369,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 	int this_data,this_param;
 	uint8 eclass;
 	uint32 ecode;
+	char *tdata;
 
 	*data_len = *param_len = 0;
 
@@ -389,8 +401,18 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 	total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 
 	/* allocate it */
-	*data = Realloc(*data,total_data);
-	*param = Realloc(*param,total_param);
+	tdata = Realloc(*data,total_data);
+	if (!tdata) {
+		DEBUG(0,("cli_receive_nt_trans: failed to enlarge buffer"));
+		return False;
+	}
+	else *data = tdata;
+	tdata = Realloc(*param,total_param);
+	if (!tdata) {
+		DEBUG(0,("cli_receive_nt_trans: failed to enlarge buffer"));
+		return False;
+	}
+	else *param = tdata;
 
 	while (1)  {
 		this_data = SVAL(cli->inbuf,smb_ntr_DataCount);