this is a big global fix for the ptr = Realloc(ptr, size) bug.

many possible mem leaks, and segfaults fixed.

someone should port this fix to 2.2 also.
(This used to be commit fa8e55b8b465114ce209344965c1ca0333b84db9)

4 files changed, 24 insertions, 12 deletions

diff --git a/source3/nsswitch/wb_client.c b/source3/nsswitch/wb_client.c
index 2a29773b9e..f5585557fb 100644
--- a/source3/nsswitch/wb_client.c
+++ b/source3/nsswitch/wb_client.c
@@ -278,7 +278,7 @@ static int wb_getgroups(char *user, gid_t **groups)
 
 int winbind_initgroups(char *user, gid_t gid)
 {
-	gid_t *groups = NULL;
+	gid_t *tgr, *groups = NULL;
 	int result;
 	char *sep;
 
@@ -310,13 +310,14 @@ int winbind_initgroups(char *user, gid_t gid)
 		/* Add group to list if necessary */
 
 		if (!is_member) {
-			groups = Realloc(groups, sizeof(gid_t) * ngroups + 1);
+			tgr = Realloc(groups, sizeof(gid_t) * ngroups + 1);
 			
-			if (!groups) {
+			if (!tgr) {
 				errno = ENOMEM;
 				result = -1;
 				goto done;
 			}
+			else groups = tgr;
 
 			groups[ngroups] = gid;
 			ngroups++;
diff --git a/source3/nsswitch/winbindd_group.c b/source3/nsswitch/winbindd_group.c
index ed4db07dda..ff357dc098 100644
--- a/source3/nsswitch/winbindd_group.c
+++ b/source3/nsswitch/winbindd_group.c
@@ -764,7 +764,7 @@ enum winbindd_result winbindd_list_groups(struct winbindd_cli_state *state)
         uint32 total_entries = 0;
         struct winbindd_domain *domain;
 	struct getent_state groups;
-	char *extra_data = NULL;
+	char *ted, *extra_data = NULL;
 	int extra_data_len = 0, i;
 
 	DEBUG(3, ("[%5d]: list groups\n", state->pid));
@@ -794,12 +794,15 @@ enum winbindd_result winbindd_list_groups(struct winbindd_cli_state *state)
 		   account names to sizeof(fstring) = 128 characters.  */
 
 		total_entries += groups.num_sam_entries;
-		extra_data = Realloc(extra_data, 
+		ted = Realloc(extra_data, 
 				     sizeof(fstring) * total_entries);
 
-		if (!extra_data) {
+		if (!ted) {
+			DEBUG(0,("winbindd_list_groups: failed to enlarge buffer!\n"));
+			if (extra_data) free(extra_data);
 			return WINBINDD_ERROR;
 		}
+		else extra_data = ted;
 
 		/* Pack group list into extra data fields */
 
diff --git a/source3/nsswitch/winbindd_misc.c b/source3/nsswitch/winbindd_misc.c
index 9520fc218b..21f1afa6a7 100644
--- a/source3/nsswitch/winbindd_misc.c
+++ b/source3/nsswitch/winbindd_misc.c
@@ -136,7 +136,7 @@ enum winbindd_result winbindd_list_trusted_domains(struct winbindd_cli_state
 {
 	struct winbindd_domain *domain;
 	int total_entries = 0, extra_data_len = 0;
-	char *extra_data = NULL;
+	char *ted, *extra_data = NULL;
 
 	DEBUG(3, ("[%5d]: list trusted domains\n", state->pid));
 
@@ -149,10 +149,15 @@ enum winbindd_result winbindd_list_trusted_domains(struct winbindd_cli_state
 		/* Add domain to list */
 
 		total_entries++;
-		extra_data = Realloc(extra_data, sizeof(fstring) * 
+		ted = Realloc(extra_data, sizeof(fstring) * 
 				     total_entries);
 
-		if (!extra_data) return WINBINDD_ERROR;
+		if (!ted) {
+			DEBUG(0,("winbindd_list_trusted_domains: failed to enlarge buffer!\n"));
+			if (extra_data) free(extra_data);
+			return WINBINDD_ERROR;
+		}
+		else extra_data = ted;
 
 		memcpy(&extra_data[extra_data_len], domain->name,
 		       strlen(domain->name));
diff --git a/source3/nsswitch/winbindd_user.c b/source3/nsswitch/winbindd_user.c
index 30416e76d7..804d3deebb 100644
--- a/source3/nsswitch/winbindd_user.c
+++ b/source3/nsswitch/winbindd_user.c
@@ -594,7 +594,7 @@ enum winbindd_result winbindd_list_users(struct winbindd_cli_state *state)
         SAM_DISPINFO_CTR ctr;
 	SAM_DISPINFO_1 info1;
         uint32 num_entries = 0, total_entries = 0;
-	char *extra_data = NULL;
+	char *ted, *extra_data = NULL;
 	int extra_data_len = 0;
 
 	DEBUG(3, ("[%5d]: list users\n", state->pid));
@@ -635,12 +635,15 @@ enum winbindd_result winbindd_list_users(struct winbindd_cli_state *state)
 
 			total_entries += num_entries;
 			
-			extra_data = Realloc(extra_data, sizeof(fstring) * 
+			ted = Realloc(extra_data, sizeof(fstring) * 
 					     total_entries);
 			
-			if (!extra_data) {
+			if (!ted) {
+				DEBUG(0,("winbindd_list_users: failed to enlarge buffer!\n"));
+				if (extra_data) free(extra_data);
 				return WINBINDD_ERROR;
 			}
+			else extra_data = ted;
 			
 			/* Pack user list into extra data fields */