summaryrefslogtreecommitdiff
path: root/source3/printing
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2006-03-07 06:31:04 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 11:10:59 -0500
commit894358a8f3e338b339b6c37233edef794b312087 (patch)
tree2dade0771837ba267d365af24d551c3084f0f948 /source3/printing
parent1d5ed2bde9a67083c9b73c7eb6fb966c0e824ab2 (diff)
downloadsamba-894358a8f3e338b339b6c37233edef794b312087.tar.gz
samba-894358a8f3e338b339b6c37233edef794b312087.tar.bz2
samba-894358a8f3e338b339b6c37233edef794b312087.zip
r13915: Fixed a very interesting class of realloc() bugs found by Coverity.
realloc can return NULL in one of two cases - (1) the realloc failed, (2) realloc succeeded but the new size requested was zero, in which case this is identical to a free() call. The error paths dealing with these two cases should be different, but mostly weren't. Secondly the standard idiom for dealing with realloc when you know the new size is non-zero is the following : tmp = realloc(p, size); if (!tmp) { SAFE_FREE(p); return error; } else { p = tmp; } However, there were *many* *many* places in Samba where we were using the old (broken) idiom of : p = realloc(p, size) if (!p) { return error; } which will leak the memory pointed to by p on realloc fail. This commit (hopefully) fixes all these cases by moving to a standard idiom of : p = SMB_REALLOC(p, size) if (!p) { return error; } Where if the realloc returns null due to the realloc failing or size == 0 we *guarentee* that the storage pointed to by p has been freed. This allows me to remove a lot of code that was dealing with the standard (more verbose) method that required a tmp pointer. This is almost always what you want. When a realloc fails you never usually want the old memory, you want to free it and get into your error processing asap. For the 11 remaining cases where we really do need to keep the old pointer I have invented the new macro SMB_REALLOC_KEEP_OLD_ON_ERROR, which can be used as follows : tmp = SMB_REALLOC_KEEP_OLD_ON_ERROR(p, size); if (!tmp) { SAFE_FREE(p); return error; } else { p = tmp; } SMB_REALLOC_KEEP_OLD_ON_ERROR guarentees never to free the pointer p, even on size == 0 or realloc fail. All this is done by a hidden extra argument to Realloc(), BOOL free_old_on_error which is set appropriately by the SMB_REALLOC and SMB_REALLOC_KEEP_OLD_ON_ERROR macros (and their array counterparts). It remains to be seen what this will do to our Coverity bug count :-). Jeremy. (This used to be commit 1d710d06a214f3f1740e80e0bffd6aab44aac2b0)
Diffstat (limited to 'source3/printing')
-rw-r--r--source3/printing/nt_printing.c57
-rw-r--r--source3/printing/print_cups.c7
-rw-r--r--source3/printing/print_iprint.c7
-rw-r--r--source3/printing/printing.c8
4 files changed, 23 insertions, 56 deletions
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index becd51cd7e..1ce0b5e9e3 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -743,12 +743,12 @@ BOOL get_a_builtin_ntform(UNISTR2 *uni_formname,nt_forms_struct *form)
}
/****************************************************************************
-get a form struct list
+ get a form struct list.
****************************************************************************/
+
int get_ntforms(nt_forms_struct **list)
{
TDB_DATA kbuf, newkey, dbuf;
- nt_forms_struct *tl;
nt_forms_struct form;
int ret;
int i;
@@ -773,12 +773,11 @@ int get_ntforms(nt_forms_struct **list)
if (ret != dbuf.dsize)
continue;
- tl = SMB_REALLOC_ARRAY(*list, nt_forms_struct, n+1);
- if (!tl) {
+ *list = SMB_REALLOC_ARRAY(*list, nt_forms_struct, n+1);
+ if (!*list) {
DEBUG(0,("get_ntforms: Realloc fail.\n"));
return 0;
}
- *list = tl;
(*list)[n] = form;
n++;
}
@@ -823,7 +822,6 @@ BOOL add_a_form(nt_forms_struct **list, const FORM *form, int *count)
int n=0;
BOOL update;
fstring form_name;
- nt_forms_struct *tl;
/*
* NT tries to add forms even when
@@ -842,11 +840,10 @@ BOOL add_a_form(nt_forms_struct **list, const FORM *form, int *count)
}
if (update==False) {
- if((tl=SMB_REALLOC_ARRAY(*list, nt_forms_struct, n+1)) == NULL) {
+ if((*list=SMB_REALLOC_ARRAY(*list, nt_forms_struct, n+1)) == NULL) {
DEBUG(0,("add_a_form: failed to enlarge forms list!\n"));
return False;
}
- *list = tl;
unistr2_to_ascii((*list)[n].name, &form->name, sizeof((*list)[n].name)-1);
(*count)++;
}
@@ -940,7 +937,6 @@ int get_ntdrivers(fstring **list, const char *architecture, uint32 version)
{
int total=0;
const char *short_archi;
- fstring *fl;
pstring key;
TDB_DATA kbuf, newkey;
@@ -954,11 +950,10 @@ int get_ntdrivers(fstring **list, const char *architecture, uint32 version)
if (strncmp(kbuf.dptr, key, strlen(key)) != 0)
continue;
- if((fl = SMB_REALLOC_ARRAY(*list, fstring, total+1)) == NULL) {
+ if((*list = SMB_REALLOC_ARRAY(*list, fstring, total+1)) == NULL) {
DEBUG(0,("get_ntdrivers: failed to enlarge list!\n"));
return -1;
}
- else *list = fl;
fstrcpy((*list)[total], kbuf.dptr+strlen(key));
total++;
@@ -1973,15 +1968,12 @@ static uint32 add_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 *driver)
}
if (len != buflen) {
- char *tb;
-
- tb = (char *)SMB_REALLOC(buf, len);
- if (!tb) {
+ buf = (char *)SMB_REALLOC(buf, len);
+ if (!buf) {
DEBUG(0,("add_a_printer_driver_3: failed to enlarge buffer\n!"));
ret = -1;
goto done;
}
- else buf = tb;
buflen = len;
goto again;
}
@@ -2098,15 +2090,11 @@ static WERROR get_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 **info_ptr,
i=0;
while (len < dbuf.dsize) {
- fstring *tddfs;
-
- tddfs = SMB_REALLOC_ARRAY(driver.dependentfiles, fstring, i+2);
- if ( !tddfs ) {
+ driver.dependentfiles = SMB_REALLOC_ARRAY(driver.dependentfiles, fstring, i+2);
+ if ( !driver.dependentfiles ) {
DEBUG(0,("get_a_printer_driver_3: failed to enlarge buffer!\n"));
break;
}
- else
- driver.dependentfiles = tddfs;
len += tdb_unpack(dbuf.dptr+len, dbuf.dsize-len, "f",
&driver.dependentfiles[i]);
@@ -2406,15 +2394,12 @@ static WERROR update_a_printer_2(NT_PRINTER_INFO_LEVEL_2 *info)
len += pack_values( info->data, buf+len, buflen-len );
if (buflen != len) {
- char *tb;
-
- tb = (char *)SMB_REALLOC(buf, len);
- if (!tb) {
+ buf = (char *)SMB_REALLOC(buf, len);
+ if (!buf) {
DEBUG(0,("update_a_printer_2: failed to enlarge buffer!\n"));
ret = WERR_NOMEM;
goto done;
}
- else buf = tb;
buflen = len;
goto again;
}
@@ -2744,7 +2729,7 @@ int get_printer_subkeys( NT_PRINTER_DATA *data, const char* key, fstring **subke
int key_len;
int num_subkeys = 0;
char *p;
- fstring *ptr, *subkeys_ptr = NULL;
+ fstring *subkeys_ptr = NULL;
fstring subkeyname;
if ( !data )
@@ -2760,14 +2745,12 @@ int get_printer_subkeys( NT_PRINTER_DATA *data, const char* key, fstring **subke
/* found a match, so allocate space and copy the name */
- if ( !(ptr = SMB_REALLOC_ARRAY( subkeys_ptr, fstring, num_subkeys+2)) ) {
+ if ( !(subkeys_ptr = SMB_REALLOC_ARRAY( subkeys_ptr, fstring, num_subkeys+2)) ) {
DEBUG(0,("get_printer_subkeys: Realloc failed for [%d] entries!\n",
num_subkeys+1));
- SAFE_FREE( subkeys );
return -1;
}
- subkeys_ptr = ptr;
fstrcpy( subkeys_ptr[num_subkeys], data->keys[i].name );
num_subkeys++;
}
@@ -2807,14 +2790,12 @@ int get_printer_subkeys( NT_PRINTER_DATA *data, const char* key, fstring **subke
/* found a match, so allocate space and copy the name */
- if ( !(ptr = SMB_REALLOC_ARRAY( subkeys_ptr, fstring, num_subkeys+2)) ) {
+ if ( !(subkeys_ptr = SMB_REALLOC_ARRAY( subkeys_ptr, fstring, num_subkeys+2)) ) {
DEBUG(0,("get_printer_subkeys: Realloc failed for [%d] entries!\n",
num_subkeys+1));
- SAFE_FREE( subkeys );
return 0;
}
- subkeys_ptr = ptr;
fstrcpy( subkeys_ptr[num_subkeys], subkeyname );
num_subkeys++;
}
@@ -4080,16 +4061,12 @@ static uint32 update_driver_init_2(NT_PRINTER_INFO_LEVEL_2 *info)
len += pack_values( info->data, buf+len, buflen-len );
if (buflen < len) {
- char *tb;
-
- tb = (char *)SMB_REALLOC(buf, len);
- if (!tb) {
+ buf = (char *)SMB_REALLOC(buf, len);
+ if (!buf) {
DEBUG(0, ("update_driver_init_2: failed to enlarge buffer!\n"));
ret = -1;
goto done;
}
- else
- buf = tb;
buflen = len;
goto again;
}
diff --git a/source3/printing/print_cups.c b/source3/printing/print_cups.c
index 8ae896fddf..afa301bbea 100644
--- a/source3/printing/print_cups.c
+++ b/source3/printing/print_cups.c
@@ -816,16 +816,13 @@ static int cups_queue_get(const char *sharename,
if (qcount >= qalloc) {
qalloc += 16;
- temp = SMB_REALLOC_ARRAY(queue, print_queue_struct, qalloc);
+ queue = SMB_REALLOC_ARRAY(queue, print_queue_struct, qalloc);
- if (temp == NULL) {
+ if (queue == NULL) {
DEBUG(0,("cups_queue_get: Not enough memory!"));
qcount = 0;
- SAFE_FREE(queue);
goto out;
}
-
- queue = temp;
}
temp = queue + qcount;
diff --git a/source3/printing/print_iprint.c b/source3/printing/print_iprint.c
index fc60667628..04b096a8a5 100644
--- a/source3/printing/print_iprint.c
+++ b/source3/printing/print_iprint.c
@@ -1074,16 +1074,13 @@ static int iprint_queue_get(const char *sharename,
if (qcount >= qalloc) {
qalloc += 16;
- temp = SMB_REALLOC_ARRAY(queue, print_queue_struct, qalloc);
+ queue = SMB_REALLOC_ARRAY(queue, print_queue_struct, qalloc);
- if (temp == NULL) {
+ if (queue == NULL) {
DEBUG(0,("iprint_queue_get: Not enough memory!"));
qcount = 0;
- SAFE_FREE(queue);
goto out;
}
-
- queue = temp;
}
temp = queue + qcount;
diff --git a/source3/printing/printing.c b/source3/printing/printing.c
index 315034879e..452031368d 100644
--- a/source3/printing/printing.c
+++ b/source3/printing/printing.c
@@ -541,15 +541,11 @@ static BOOL pjob_store(const char* sharename, uint32 jobid, struct printjob *pjo
len += pack_devicemode(pjob->nt_devmode, buf+len, buflen-len);
if (buflen != len) {
- char *tb;
-
- tb = (char *)SMB_REALLOC(buf, len);
- if (!tb) {
+ buf = (char *)SMB_REALLOC(buf, len);
+ if (!buf) {
DEBUG(0,("pjob_store: failed to enlarge buffer!\n"));
goto done;
}
- else
- buf = tb;
newlen = len;
}
} while ( buflen != len );