Ok - this is a *BIG* change - but it fixes the problems with static strings

in the RPC code. This change was prompted by trying to save a long (>256)
character comment in the printer properties page.

The new system associates a TALLOC_CTX with the pipe struct, and frees
the pool on return of a complete PDU.

A global TALLOC_CTX is used for the odd buffer allocated in the BUFFERxx
code, and is freed in the main loop.

This code works with insure, and seems to be free of memory leaks and
crashes (so far) but there are probably the occasional problem with
code that uses UNISTRxx structs on the stack and expects them to contain
storage without doing a init_unistrXX().

This means that rpcclient will probably be horribly broken.
A TALLOC_CTX also needed associating with the struct cli_state also,
to make the prs_xx code there work.

The main interface change is the addition of a TALLOC_CTX to the
prs_init calls - used for dynamic allocation in the prs_XXX calls.

Now this is in place it should make dynamic allocation of all RPC
memory on unmarshall *much* easier to fix.

Jeremy.
(This used to be commit 0ff2ce543ee54f7364e6d839db6d06e7ef1edcf4)

1 files changed, 121 insertions, 69 deletions

diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c
index fe2778a356..2a642e1cec 100644
--- a/source3/rpc_parse/parse_misc.c
+++ b/source3/rpc_parse/parse_misc.c
@@ -26,6 +26,20 @@
 
 extern int DEBUGLEVEL;
 
+static TALLOC_CTX *parse_misc_talloc = NULL;
+
+/******************************************************************* a
+free up temporary memory - called from the main loop
+********************************************************************/
+
+void parse_talloc_free(void)
+{
+    if (!parse_misc_talloc)
+        return;
+    talloc_destroy(parse_misc_talloc);
+    parse_misc_talloc = NULL;
+}
+
 /*******************************************************************
  Reads or writes a UTIME type.
 ********************************************************************/
@@ -296,12 +310,6 @@ BOOL smb_io_strhdr(char *desc,  STRHDR *hdr, prs_struct *ps, int depth)
 	if(!prs_uint32("buffer     ", ps, depth, &hdr->buffer))
 		return False;
 
-	/* oops! XXXX maybe issue a warning that this is happening... */
-	if (hdr->str_max_len > MAX_STRINGLEN)
-		hdr->str_max_len = MAX_STRINGLEN;
-	if (hdr->str_str_len > MAX_STRINGLEN)
-		hdr->str_str_len = MAX_STRINGLEN;
-
 	return True;
 }
 
@@ -338,12 +346,6 @@ BOOL smb_io_unihdr(char *desc, UNIHDR *hdr, prs_struct *ps, int depth)
 	if(!prs_uint32("buffer     ", ps, depth, &hdr->buffer))
 		return False;
 
-	/* oops! XXXX maybe issue a warning that this is happening... */
-	if (hdr->uni_max_len > MAX_UNISTRLEN)
-		hdr->uni_max_len = MAX_UNISTRLEN;
-	if (hdr->uni_str_len > MAX_UNISTRLEN)
-		hdr->uni_str_len = MAX_UNISTRLEN;
-
 	return True;
 }
 
@@ -429,12 +431,6 @@ BOOL smb_io_hdrbuf(char *desc, BUFHDR *hdr, prs_struct *ps, int depth)
 	if(!prs_uint32("buf_len    ", ps, depth, &hdr->buf_len))
 		return False;
 
-	/* oops! XXXX maybe issue a warning that this is happening... */
-	if (hdr->buf_max_len > MAX_BUFFERLEN)
-		hdr->buf_max_len = MAX_BUFFERLEN;
-	if (hdr->buf_len > MAX_BUFFERLEN)
-		hdr->buf_len = MAX_BUFFERLEN;
-
 	return True;
 }
 
@@ -477,8 +473,21 @@ BOOL smb_io_unihdr2(char *desc, UNIHDR2 *hdr2, prs_struct *ps, int depth)
 
 void init_unistr(UNISTR *str, const char *buf)
 {
+	size_t len = strlen(buf) + 1;
+
+    if (!parse_misc_talloc)
+		parse_misc_talloc = talloc_init();
+
+	if (len < MAX_UNISTRLEN)
+		len = MAX_UNISTRLEN;
+	len *= sizeof(uint16);
+
+    str->buffer = (uint16 *)talloc(parse_misc_talloc, len);
+	if (str->buffer == NULL)
+		smb_panic("init_unistr2: malloc fail\n");
+
 	/* store the string (null-terminated copy) */
-	dos_struni2((char *)str->buffer, buf, sizeof(str->buffer));
+	dos_struni2((char *)str->buffer, buf, len);
 }
 
 /*******************************************************************
@@ -503,6 +512,24 @@ BOOL smb_io_unistr(char *desc, UNISTR *uni, prs_struct *ps, int depth)
 }
 
 /*******************************************************************
+ Allocate the BUFFER3 memory.
+********************************************************************/
+
+static void create_buffer3(BUFFER3 *str, size_t len)
+{
+    if (!parse_misc_talloc)
+		parse_misc_talloc = talloc_init();
+
+	if (len < MAX_BUFFERLEN)
+		len = MAX_BUFFERLEN;
+
+    str->buffer = talloc(parse_misc_talloc, len);
+	if (str->buffer == NULL)
+		smb_panic("create_buffer3: malloc fail\n");
+
+}
+
+/*******************************************************************
  Inits a BUFFER3 structure from a uint32
 ********************************************************************/
 
@@ -514,6 +541,7 @@ void init_buffer3_uint32(BUFFER3 *str, uint32 val)
 	str->buf_max_len = sizeof(uint32);
 	str->buf_len     = sizeof(uint32);
 
+	create_buffer3(str, sizeof(uint32));
 	SIVAL(str->buffer, 0, val);
 }
 
@@ -529,8 +557,10 @@ void init_buffer3_str(BUFFER3 *str, char *buf, int len)
 	str->buf_max_len = len * 2;
 	str->buf_len     = len * 2;
 
+	create_buffer3(str, str->buf_max_len);
+
 	/* store the string (null-terminated 8 bit chars into 16 bit chars) */
-	dos_struni2((char *)str->buffer, buf, sizeof(str->buffer));
+	dos_struni2((char *)str->buffer, buf, str->buf_max_len);
 }
 
 /*******************************************************************
@@ -540,6 +570,7 @@ void init_buffer3_str(BUFFER3 *str, char *buf, int len)
 void init_buffer3_hex(BUFFER3 *str, char *buf)
 {
 	ZERO_STRUCTP(str);
+	create_buffer3(str, strlen(buf));
 	str->buf_max_len = str->buf_len = strhex_to_str((char *)str->buffer, sizeof(str->buffer), buf);
 }
 
@@ -553,8 +584,10 @@ void init_buffer3_bytes(BUFFER3 *str, uint8 *buf, int len)
 
 	/* max buffer size (allocated size) */
 	str->buf_max_len = len;
-	if (buf != NULL)
-		memcpy(str->buffer, buf, MIN(str->buf_len, sizeof(str->buffer)));
+	if (buf != NULL) {
+		create_buffer3(str, len);
+		memcpy(str->buffer, buf, len);
+	}
 	str->buf_len = buf != NULL ? len : 0;
 }
 
@@ -578,16 +611,17 @@ BOOL smb_io_buffer3(char *desc, BUFFER3 *buf3, prs_struct *ps, int depth)
 	if(!prs_uint32("uni_max_len", ps, depth, &buf3->buf_max_len))
 		return False;
 
-	if (buf3->buf_max_len > MAX_UNISTRLEN)
-		buf3->buf_max_len = MAX_UNISTRLEN;
+	if (UNMARSHALLING(ps)) {
+		buf3->buffer = prs_alloc_mem(ps, buf3->buf_max_len);
+		if (buf3->buffer == NULL)
+			return False;
+	}
 
 	if(!prs_uint8s(True, "buffer     ", ps, depth, buf3->buffer, buf3->buf_max_len))
 		return False;
 
 	if(!prs_uint32("buf_len    ", ps, depth, &buf3->buf_len))
 		return False;
-	if (buf3->buf_len > MAX_UNISTRLEN)
-		buf3->buf_len = MAX_UNISTRLEN;
 
 	return True;
 }
@@ -607,9 +641,10 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth)
 	prs_uint32("buf_len", ps, depth, &(buf5->buf_len));
 
 	/* reading: alloc the buffer first */
-	if ( ps->io )
-	{
-		buf5->buffer=(uint16 *)malloc( sizeof(uint16)*buf5->buf_len );
+	if ( UNMARSHALLING(ps) ) {
+		buf5->buffer=(uint16 *)prs_alloc_mem(ps, sizeof(uint16)*buf5->buf_len );
+		if (buf5->buffer == NULL)
+			return False;
 	}
 	
 	prs_uint16s(True, "buffer", ps, depth, buf5->buffer, buf5->buf_len);
@@ -618,15 +653,6 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth)
 }
 
 /*******************************************************************
- Frees a BUFFER5 structure (just the malloced part).
-********************************************************************/
-
-void free_buffer5(BUFFER5 *buf5)
-{
-	safe_free(buf5->buffer);
-}
-
-/*******************************************************************
  Inits a BUFFER2 structure.
 ********************************************************************/
 
@@ -639,8 +665,17 @@ void init_buffer2(BUFFER2 *str, uint8 *buf, int len)
 	str->undoc       = 0;
 	str->buf_len = buf != NULL ? len : 0;
 
-	if (buf != NULL)
-		memcpy(str->buffer, buf, MIN(str->buf_len, sizeof(str->buffer)));
+	if (buf != NULL) {
+		if (!parse_misc_talloc)
+			parse_misc_talloc = talloc_init();
+
+		if (len < MAX_BUFFERLEN)
+			len = MAX_BUFFERLEN;
+		str->buffer = talloc(parse_misc_talloc, len);
+		if (str->buffer == NULL)
+			smb_panic("init_buffer2: malloc fail\n");
+		memcpy(str->buffer, buf, MIN(str->buf_len, len));
+	}
 }
 
 /*******************************************************************
@@ -669,12 +704,6 @@ BOOL smb_io_buffer2(char *desc, BUFFER2 *buf2, uint32 buffer, prs_struct *ps, in
 		if(!prs_uint32("buf_len    ", ps, depth, &buf2->buf_len))
 			return False;
 
-		/* oops! XXXX maybe issue a warning that this is happening... */
-		if (buf2->buf_max_len > MAX_UNISTRLEN)
-			buf2->buf_max_len = MAX_UNISTRLEN;
-		if (buf2->buf_len > MAX_UNISTRLEN)
-			buf2->buf_len = MAX_UNISTRLEN;
-
 		/* buffer advanced by indicated length of string
 		   NOT by searching for null-termination */
 
@@ -721,6 +750,21 @@ void copy_unistr2(UNISTR2 *str, UNISTR2 *from)
 	str->undoc       = from->undoc;
 	str->uni_str_len = from->uni_str_len;
 
+	if (str->buffer == NULL) {
+		size_t len = from->uni_max_len * 2;
+
+    	if (!parse_misc_talloc)
+			parse_misc_talloc = talloc_init();
+
+		if (len < MAX_UNISTRLEN)
+			len = MAX_UNISTRLEN;
+		len *= sizeof(uint16);
+
+   		str->buffer = (uint16 *)talloc(parse_misc_talloc, len);
+		if (str->buffer == NULL)
+			smb_panic("copy_unistr2: malloc fail\n");
+	}
+
 	/* copy the string */
 	memcpy(str->buffer, from->buffer, sizeof(from->buffer));
 }
@@ -731,14 +775,23 @@ void copy_unistr2(UNISTR2 *str, UNISTR2 *from)
 
 void init_string2(STRING2 *str, char *buf, int len)
 {
-  /* set up string lengths. */
-  str->str_max_len = len;
-  str->undoc       = 0;
-  str->str_str_len = len;
-
-  /* store the string */
-  if(len != 0)
-    memcpy(str->buffer, buf, len);
+	/* set up string lengths. */
+	str->str_max_len = len;
+	str->undoc       = 0;
+	str->str_str_len = len;
+
+	/* store the string */
+	if(len != 0) {
+		if (!parse_misc_talloc)
+			parse_misc_talloc = talloc_init();
+
+		if (len < MAX_STRINGLEN)
+			len = MAX_STRINGLEN;
+		str->buffer = talloc(parse_misc_talloc, len);
+		if (str->buffer == NULL)
+			smb_panic("init_string2: malloc fail\n");
+		memcpy(str->buffer, buf, len);
+  }
 }
 
 /*******************************************************************
@@ -768,12 +821,6 @@ BOOL smb_io_string2(char *desc, STRING2 *str2, uint32 buffer, prs_struct *ps, in
 		if(!prs_uint32("str_str_len", ps, depth, &str2->str_str_len))
 			return False;
 
-		/* oops! XXXX maybe issue a warning that this is happening... */
-		if (str2->str_max_len > MAX_STRINGLEN)
-			str2->str_max_len = MAX_STRINGLEN;
-		if (str2->str_str_len > MAX_STRINGLEN)
-			str2->str_str_len = MAX_STRINGLEN;
-
 		/* buffer advanced by indicated length of string
 		   NOT by searching for null-termination */
 		if(!prs_string2(True, "buffer     ", ps, depth, str2))
@@ -803,8 +850,19 @@ void init_unistr2(UNISTR2 *str, const char *buf, size_t len)
 	str->undoc       = 0;
 	str->uni_str_len = (uint32)len;
 
+    if (!parse_misc_talloc)
+		parse_misc_talloc = talloc_init();
+
+	if (len < MAX_UNISTRLEN)
+		len = MAX_UNISTRLEN;
+	len *= sizeof(uint16);
+
+    str->buffer = (uint16 *)talloc(parse_misc_talloc, len);
+	if (str->buffer == NULL)
+		smb_panic("init_unistr2: malloc fail\n");
+
 	/* store the string (null-terminated 8 bit chars into 16 bit chars) */
-	dos_struni2((char *)str->buffer, buf, sizeof(str->buffer));
+	dos_struni2((char *)str->buffer, buf, len);
 }
 
 /*******************************************************************
@@ -834,12 +892,6 @@ BOOL smb_io_unistr2(char *desc, UNISTR2 *uni2, uint32 buffer, prs_struct *ps, in
 		if(!prs_uint32("uni_str_len", ps, depth, &uni2->uni_str_len))
 			return False;
 
-		/* oops! XXXX maybe issue a warning that this is happening... */
-		if (uni2->uni_max_len > MAX_UNISTRLEN)
-			uni2->uni_max_len = MAX_UNISTRLEN;
-		if (uni2->uni_str_len > MAX_UNISTRLEN)
-			uni2->uni_str_len = MAX_UNISTRLEN;
-
 		/* buffer advanced by indicated length of string
 		   NOT by searching for null-termination */
 		if(!prs_unistr2(True, "buffer     ", ps, depth, uni2))
@@ -957,14 +1009,14 @@ static void init_clnt_srv(DOM_CLNT_SRV *log, char *logon_srv, char *comp_name)
 
 	if (logon_srv != NULL) {
 		log->undoc_buffer = 1;
-		init_unistr2(&(log->uni_logon_srv), logon_srv, strlen(logon_srv)+1);
+		init_unistr2(&log->uni_logon_srv, logon_srv, strlen(logon_srv)+1);
 	} else {
 		log->undoc_buffer = 0;
 	}
 
 	if (comp_name != NULL) {
 		log->undoc_buffer2 = 1;
-		init_unistr2(&(log->uni_comp_name), comp_name, strlen(comp_name)+1);
+		init_unistr2(&log->uni_comp_name, comp_name, strlen(comp_name)+1);
 	} else {
 		log->undoc_buffer2 = 0;
 	}