r13915: Fixed a very interesting class of realloc() bugs found by Coverity.

realloc can return NULL in one of two cases - (1) the realloc failed,
(2) realloc succeeded but the new size requested was zero, in which
case this is identical to a free() call.

The error paths dealing with these two cases should be different,
but mostly weren't. Secondly the standard idiom for dealing with
realloc when you know the new size is non-zero is the following :

 tmp = realloc(p, size);
 if (!tmp) {
    SAFE_FREE(p);
    return error;
 } else {
    p = tmp;
 }

However, there were *many* *many* places in Samba where we were
using the old (broken) idiom of :

 p = realloc(p, size)
 if (!p) {
    return error;
 }

which will leak the memory pointed to by p on realloc fail.

This commit (hopefully) fixes all these cases by moving to
a standard idiom of :

 p = SMB_REALLOC(p, size)
 if (!p) {
    return error;
 }

Where if the realloc returns null due to the realloc failing
or size == 0 we *guarentee* that the storage pointed to by p
has been freed. This allows me to remove a lot of code that
was dealing with the standard (more verbose) method that required
a tmp pointer. This is almost always what you want. When a
realloc fails you never usually want the old memory, you
want to free it and get into your error processing asap.

For the 11 remaining cases where we really do need to keep the
old pointer I have invented the new macro SMB_REALLOC_KEEP_OLD_ON_ERROR,
which can be used as follows :

 tmp = SMB_REALLOC_KEEP_OLD_ON_ERROR(p, size);
 if (!tmp) {
    SAFE_FREE(p);
    return error;
 } else {
    p = tmp;
 }

SMB_REALLOC_KEEP_OLD_ON_ERROR guarentees never to free the
pointer p, even on size == 0 or realloc fail. All this is
done by a hidden extra argument to Realloc(), BOOL free_old_on_error
which is set appropriately by the SMB_REALLOC and SMB_REALLOC_KEEP_OLD_ON_ERROR
macros (and their array counterparts).

It remains to be seen what this will do to our Coverity bug count :-).

Jeremy.
(This used to be commit 1d710d06a214f3f1740e80e0bffd6aab44aac2b0)

3 files changed, 20 insertions, 40 deletions

diff --git a/source3/registry/reg_db.c b/source3/registry/reg_db.c
index ddc08cf2ce..e26b9a723b 100644
--- a/source3/registry/reg_db.c
+++ b/source3/registry/reg_db.c
@@ -298,7 +298,7 @@ int regdb_close( void )
 static BOOL regdb_store_keys_internal( const char *key, REGSUBKEY_CTR *ctr )
 {
 	TDB_DATA kbuf, dbuf;
-	char *buffer, *tmpbuf;
+	char *buffer;
 	int i = 0;
 	uint32 len, buflen;
 	BOOL ret = True;
@@ -327,12 +327,11 @@ static BOOL regdb_store_keys_internal( const char *key, REGSUBKEY_CTR *ctr )
 		len += tdb_pack( buffer+len, buflen-len, "f", regsubkey_ctr_specific_key(ctr, i) );
 		if ( len > buflen ) {
 			/* allocate some extra space */
-			if ((tmpbuf = SMB_REALLOC( buffer, len*2 )) == NULL) {
+			if ((buffer = SMB_REALLOC( buffer, len*2 )) == NULL) {
 				DEBUG(0,("regdb_store_keys: Failed to realloc memory of size [%d]\n", len*2));
 				ret = False;
 				goto done;
 			}
-			buffer = tmpbuf;
 			buflen = len*2;
 					
 			len = tdb_pack( buffer+len, buflen-len, "f", regsubkey_ctr_specific_key(ctr, i) );
diff --git a/source3/registry/reg_perfcount.c b/source3/registry/reg_perfcount.c
index a31154fc33..9b631736d6 100644
--- a/source3/registry/reg_perfcount.c
+++ b/source3/registry/reg_perfcount.c
@@ -158,7 +158,7 @@ static uint32 _reg_perfcount_multi_sz_from_tdb(TDB_CONTEXT *tdb,
 {
 	TDB_DATA kbuf, dbuf;
 	char temp[256];
-	char *buf1 = *retbuf, *buf2 = NULL;
+	char *buf1 = *retbuf;
 	uint32 working_size = 0;
 	UNISTR2 name_index, name;
 
@@ -177,27 +177,21 @@ static uint32 _reg_perfcount_multi_sz_from_tdb(TDB_CONTEXT *tdb,
 	}
 	/* First encode the name_index */
 	working_size = (kbuf.dsize + 1)*sizeof(uint16);
-	buf2 = SMB_REALLOC(buf1, buffer_size + working_size);
-	if(!buf2)
-	{
-		SAFE_FREE(buf1);
+	buf1 = SMB_REALLOC(buf1, buffer_size + working_size);
+	if(!buf1) {
 		buffer_size = 0;
 		return buffer_size;
 	}
-	buf1 = buf2;
 	init_unistr2(&name_index, kbuf.dptr, UNI_STR_TERMINATE);
 	memcpy(buf1+buffer_size, (char *)name_index.buffer, working_size);
 	buffer_size += working_size;
 	/* Now encode the actual name */
 	working_size = (dbuf.dsize + 1)*sizeof(uint16);
-	buf2 = SMB_REALLOC(buf1, buffer_size + working_size);
-	if(!buf2)
-	{
-		SAFE_FREE(buf1);
+	buf1 = SMB_REALLOC(buf1, buffer_size + working_size);
+	if(!buf1) {
 		buffer_size = 0;
 		return buffer_size;
 	}
-	buf1 = buf2;
 	memset(temp, 0, sizeof(temp));
 	memcpy(temp, dbuf.dptr, dbuf.dsize);
 	SAFE_FREE(dbuf.dptr);
@@ -215,7 +209,7 @@ static uint32 _reg_perfcount_multi_sz_from_tdb(TDB_CONTEXT *tdb,
 
 uint32 reg_perfcount_get_counter_help(uint32 base_index, char **retbuf)
 {
-	char *buf1 = NULL, *buf2 = NULL;
+	char *buf1 = NULL;
 	uint32 buffer_size = 0;
 	TDB_CONTEXT *names;
 	const char *fname = counters_directory( NAMES_DB );
@@ -240,15 +234,10 @@ uint32 reg_perfcount_get_counter_help(uint32 base_index, char **retbuf)
 
 	/* Now terminate the MULTI_SZ with a double unicode NULL */
 	buf1 = *retbuf;
-	buf2 = SMB_REALLOC(buf1, buffer_size + 2);
-	if(!buf2)
-	{
-		SAFE_FREE(buf1);
+	buf1 = SMB_REALLOC(buf1, buffer_size + 2);
+	if(!buf1) {
 		buffer_size = 0;
-	}
-	else
-	{
-		buf1 = buf2;
+	} else {
 		buf1[buffer_size++] = '\0';
 		buf1[buffer_size++] = '\0';
 	}
@@ -263,7 +252,7 @@ uint32 reg_perfcount_get_counter_help(uint32 base_index, char **retbuf)
 
 uint32 reg_perfcount_get_counter_names(uint32 base_index, char **retbuf)
 {
-	char *buf1 = NULL, *buf2 = NULL;
+	char *buf1 = NULL;
 	uint32 buffer_size = 0;
 	TDB_CONTEXT *names;
 	const char *fname = counters_directory( NAMES_DB );
@@ -290,15 +279,10 @@ uint32 reg_perfcount_get_counter_names(uint32 base_index, char **retbuf)
 
 	/* Now terminate the MULTI_SZ with a double unicode NULL */
 	buf1 = *retbuf;
-	buf2 = SMB_REALLOC(buf1, buffer_size + 2);
-	if(!buf2)
-	{
-		SAFE_FREE(buf1);
+	buf1 = SMB_REALLOC(buf1, buffer_size + 2);
+	if(!buf1) {
 		buffer_size = 0;
-	}
-	else
-	{
-		buf1 = buf2;
+	} else {
 		buf1[buffer_size++] = '\0';
 		buf1[buffer_size++] = '\0';
 	}
diff --git a/source3/registry/reg_printing.c b/source3/registry/reg_printing.c
index 592069052f..f001fdad24 100644
--- a/source3/registry/reg_printing.c
+++ b/source3/registry/reg_printing.c
@@ -858,7 +858,6 @@ static int key_driver_fetch_keys( const char *key, REGSUBKEY_CTR *subkeys )
 static void fill_in_driver_values( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3, REGVAL_CTR *values )
 {
 	char *buffer = NULL;
-	char *buffer2 = NULL;
 	int buffer_size = 0;
 	int i, length;
 	char *filename;
@@ -903,10 +902,10 @@ static void fill_in_driver_values( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3, REGVAL
 			
 			length = strlen(filename);
 		
-			buffer2 = SMB_REALLOC( buffer, buffer_size + (length + 1)*sizeof(uint16) );
-			if ( !buffer2 )
+			buffer = SMB_REALLOC( buffer, buffer_size + (length + 1)*sizeof(uint16) );
+			if ( !buffer ) {
 				break;
-			buffer = buffer2;
+			}
 			
 			init_unistr2( &data, filename, UNI_STR_TERMINATE);
 			memcpy( buffer+buffer_size, (char*)data.buffer, data.uni_str_len*sizeof(uint16) );
@@ -916,12 +915,10 @@ static void fill_in_driver_values( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3, REGVAL
 		
 		/* terminated by double NULL.  Add the final one here */
 		
-		buffer2 = SMB_REALLOC( buffer, buffer_size + 2 );
-		if ( !buffer2 ) {
-			SAFE_FREE( buffer );
+		buffer = SMB_REALLOC( buffer, buffer_size + 2 );
+		if ( !buffer ) {
 			buffer_size = 0;
 		} else {
-			buffer = buffer2;
 			buffer[buffer_size++] = '\0';
 			buffer[buffer_size++] = '\0';
 		}