this is a big global fix for the ptr = Realloc(ptr, size) bug.

many possible mem leaks, and segfaults fixed.

someone should port this fix to 2.2 also.
(This used to be commit fa8e55b8b465114ce209344965c1ca0333b84db9)

2 files changed, 13 insertions, 6 deletions

diff --git a/source3/locking/brlock.c b/source3/locking/brlock.c
index 1982d9982c..d22297a948 100644
--- a/source3/locking/brlock.c
+++ b/source3/locking/brlock.c
@@ -218,6 +218,7 @@ BOOL brl_lock(SMB_DEV_T dev, SMB_INO_T ino, int fnum,
 	TDB_DATA kbuf, dbuf;
 	int count, i;
 	struct lock_struct lock, *locks;
+	char *tp;
 
 	kbuf = locking_key(dev,ino);
 
@@ -246,8 +247,9 @@ BOOL brl_lock(SMB_DEV_T dev, SMB_INO_T ino, int fnum,
 	}
 
 	/* no conflicts - add it to the list of locks */
-	dbuf.dptr = Realloc(dbuf.dptr, dbuf.dsize + sizeof(*locks));
-	if (!dbuf.dptr) goto fail;
+	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(*locks));
+	if (!tp) goto fail;
+	else dbuf.dptr = tp;
 	memcpy(dbuf.dptr + dbuf.dsize, &lock, sizeof(lock));
 	dbuf.dsize += sizeof(lock);
 	tdb_store(tdb, kbuf, dbuf, TDB_REPLACE);
diff --git a/source3/locking/posix.c b/source3/locking/posix.c
index 2a8a7aacd7..833914c7aa 100644
--- a/source3/locking/posix.c
+++ b/source3/locking/posix.c
@@ -98,16 +98,19 @@ static BOOL add_fd_to_close_entry(files_struct *fsp)
 {
 	TDB_DATA kbuf = locking_key_fsp(fsp);
 	TDB_DATA dbuf;
+	char *tp;
 
 	dbuf.dptr = NULL;
 
 	dbuf = tdb_fetch(posix_pending_close_tdb, kbuf);
 
-	dbuf.dptr = Realloc(dbuf.dptr, dbuf.dsize + sizeof(int));
-	if (!dbuf.dptr) {
+	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(int));
+	if (!tp) {
 		DEBUG(0,("add_fd_to_close_entry: Realloc fail !\n"));
+		if (dbuf.dptr) free(dbuf.dptr);
 		return False;
 	}
+	else dbuf.dptr = tp;
 	memcpy(dbuf.dptr + dbuf.dsize, &fsp->fd, sizeof(int));
 	dbuf.dsize += sizeof(int);
 
@@ -354,6 +357,7 @@ static BOOL add_posix_lock_entry(files_struct *fsp, SMB_OFF_T start, SMB_OFF_T s
 	TDB_DATA kbuf = locking_key_fsp(fsp);
 	TDB_DATA dbuf;
 	struct posix_lock pl;
+	char *tp;
 
 	dbuf.dptr = NULL;
 
@@ -370,11 +374,12 @@ static BOOL add_posix_lock_entry(files_struct *fsp, SMB_OFF_T start, SMB_OFF_T s
 	pl.size = size;
 	pl.lock_type = lock_type;
 
-	dbuf.dptr = Realloc(dbuf.dptr, dbuf.dsize + sizeof(pl));
-	if (!dbuf.dptr) {
+	tp = Realloc(dbuf.dptr, dbuf.dsize + sizeof(pl));
+	if (!tp) {
 		DEBUG(0,("add_posix_lock_entry: Realloc fail !\n"));
 		goto fail;
 	}
+	else dbuf.dptr = tp;
 
 	memcpy(dbuf.dptr + dbuf.dsize, &pl, sizeof(pl));
 	dbuf.dsize += sizeof(pl);