summaryrefslogtreecommitdiff
path: root/source3/rpc_server
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2006-03-07 06:31:04 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 11:10:59 -0500
commit894358a8f3e338b339b6c37233edef794b312087 (patch)
tree2dade0771837ba267d365af24d551c3084f0f948 /source3/rpc_server
parent1d5ed2bde9a67083c9b73c7eb6fb966c0e824ab2 (diff)
downloadsamba-894358a8f3e338b339b6c37233edef794b312087.tar.gz
samba-894358a8f3e338b339b6c37233edef794b312087.tar.bz2
samba-894358a8f3e338b339b6c37233edef794b312087.zip
r13915: Fixed a very interesting class of realloc() bugs found by Coverity.
realloc can return NULL in one of two cases - (1) the realloc failed, (2) realloc succeeded but the new size requested was zero, in which case this is identical to a free() call. The error paths dealing with these two cases should be different, but mostly weren't. Secondly the standard idiom for dealing with realloc when you know the new size is non-zero is the following : tmp = realloc(p, size); if (!tmp) { SAFE_FREE(p); return error; } else { p = tmp; } However, there were *many* *many* places in Samba where we were using the old (broken) idiom of : p = realloc(p, size) if (!p) { return error; } which will leak the memory pointed to by p on realloc fail. This commit (hopefully) fixes all these cases by moving to a standard idiom of : p = SMB_REALLOC(p, size) if (!p) { return error; } Where if the realloc returns null due to the realloc failing or size == 0 we *guarentee* that the storage pointed to by p has been freed. This allows me to remove a lot of code that was dealing with the standard (more verbose) method that required a tmp pointer. This is almost always what you want. When a realloc fails you never usually want the old memory, you want to free it and get into your error processing asap. For the 11 remaining cases where we really do need to keep the old pointer I have invented the new macro SMB_REALLOC_KEEP_OLD_ON_ERROR, which can be used as follows : tmp = SMB_REALLOC_KEEP_OLD_ON_ERROR(p, size); if (!tmp) { SAFE_FREE(p); return error; } else { p = tmp; } SMB_REALLOC_KEEP_OLD_ON_ERROR guarentees never to free the pointer p, even on size == 0 or realloc fail. All this is done by a hidden extra argument to Realloc(), BOOL free_old_on_error which is set appropriately by the SMB_REALLOC and SMB_REALLOC_KEEP_OLD_ON_ERROR macros (and their array counterparts). It remains to be seen what this will do to our Coverity bug count :-). Jeremy. (This used to be commit 1d710d06a214f3f1740e80e0bffd6aab44aac2b0)
Diffstat (limited to 'source3/rpc_server')
-rw-r--r--source3/rpc_server/srv_pipe.c5
-rw-r--r--source3/rpc_server/srv_spoolss_nt.c55
2 files changed, 24 insertions, 36 deletions
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 67fb89ef79..eb7fd25daa 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -1032,7 +1032,7 @@ NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *s
rpc_lookup will still be valid afterwards. It could then succeed if
called again later */
rpc_lookup_size++;
- rpc_entry = SMB_REALLOC_ARRAY(rpc_lookup, struct rpc_table, rpc_lookup_size);
+ rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
if (NULL == rpc_entry) {
rpc_lookup_size--;
DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
@@ -1046,6 +1046,9 @@ NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *s
rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
rpc_entry->pipe.srv = SMB_STRDUP(srv);
rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
+ if (!rpc_entry->cmds) {
+ return NT_STATUS_NO_MEMORY;
+ }
memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
rpc_entry->n_cmds += size;
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 938658c479..cc51df98c1 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -3540,7 +3540,7 @@ static BOOL construct_notify_printer_info(Printer_entry *print_hnd, SPOOL_NOTIFY
uint16 type;
uint16 field;
- SPOOL_NOTIFY_INFO_DATA *current_data, *tid;
+ SPOOL_NOTIFY_INFO_DATA *current_data;
NT_PRINTER_INFO_LEVEL *printer = NULL;
print_queue_struct *queue=NULL;
@@ -3561,11 +3561,10 @@ static BOOL construct_notify_printer_info(Printer_entry *print_hnd, SPOOL_NOTIFY
if (!search_notify(type, field, &j) )
continue;
- if((tid=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
+ if((info->data=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n"));
return False;
- } else
- info->data = tid;
+ }
current_data = &info->data[info->count];
@@ -3601,7 +3600,7 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue,
uint16 type;
uint16 field;
- SPOOL_NOTIFY_INFO_DATA *current_data, *tid;
+ SPOOL_NOTIFY_INFO_DATA *current_data;
DEBUG(4,("construct_notify_jobs_info\n"));
@@ -3617,11 +3616,10 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue,
if (!search_notify(type, field, &j) )
continue;
- if((tid=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
+ if((info->data=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
DEBUG(2,("construct_notify_jobs_info: failed to enlarg buffer info->data!\n"));
return False;
}
- else info->data = tid;
current_data=&(info->data[info->count]);
@@ -4296,7 +4294,7 @@ static WERROR enum_all_printers_info_1(uint32 flags, RPC_BUFFER *buffer, uint32
int snum;
int i;
int n_services=lp_numservices();
- PRINTER_INFO_1 *tp, *printers=NULL;
+ PRINTER_INFO_1 *printers=NULL;
PRINTER_INFO_1 current_prt;
WERROR result = WERR_OK;
@@ -4307,13 +4305,11 @@ static WERROR enum_all_printers_info_1(uint32 flags, RPC_BUFFER *buffer, uint32
DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
if (construct_printer_info_1(NULL, flags, &current_prt, snum)) {
- if((tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_1, *returned +1)) == NULL) {
+ if((printers=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_1, *returned +1)) == NULL) {
DEBUG(2,("enum_all_printers_info_1: failed to enlarge printers buffer!\n"));
- SAFE_FREE(printers);
*returned=0;
return WERR_NOMEM;
}
- else printers = tp;
DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_1\n", *returned));
memcpy(&printers[*returned], &current_prt, sizeof(PRINTER_INFO_1));
@@ -4484,7 +4480,7 @@ static WERROR enum_all_printers_info_2(RPC_BUFFER *buffer, uint32 offered, uint3
int snum;
int i;
int n_services=lp_numservices();
- PRINTER_INFO_2 *tp, *printers=NULL;
+ PRINTER_INFO_2 *printers=NULL;
PRINTER_INFO_2 current_prt;
WERROR result = WERR_OK;
@@ -4492,18 +4488,15 @@ static WERROR enum_all_printers_info_2(RPC_BUFFER *buffer, uint32 offered, uint3
if (lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) {
DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
- if (construct_printer_info_2(NULL, &current_prt, snum))
- {
- if ( !(tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_2, *returned +1)) ) {
+ if (construct_printer_info_2(NULL, &current_prt, snum)) {
+ if ( !(printers=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_2, *returned +1)) ) {
DEBUG(2,("enum_all_printers_info_2: failed to enlarge printers buffer!\n"));
- SAFE_FREE(printers);
*returned = 0;
return WERR_NOMEM;
}
- DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_2\n", *returned));
+ DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_2\n", *returned + 1));
- printers = tp;
memcpy(&printers[*returned], &current_prt, sizeof(PRINTER_INFO_2));
(*returned)++;
@@ -5074,7 +5067,6 @@ static uint32 init_unistr_array(uint16 **uni_array, fstring *char_array, const c
int j=0;
const char *v;
pstring line;
- uint16 *tuary;
DEBUG(6,("init_unistr_array\n"));
*uni_array=NULL;
@@ -5102,12 +5094,11 @@ static uint32 init_unistr_array(uint16 **uni_array, fstring *char_array, const c
/* add one extra unit16 for the second terminating NULL */
- if ( (tuary=SMB_REALLOC_ARRAY(*uni_array, uint16, j+1+strlen(line)+2)) == NULL ) {
+ if ( (*uni_array=SMB_REALLOC_ARRAY(*uni_array, uint16, j+1+strlen(line)+2)) == NULL ) {
DEBUG(2,("init_unistr_array: Realloc error\n" ));
return 0;
- } else
- *uni_array = tuary;
-
+ }
+
if ( !strlen(v) )
break;
@@ -6699,7 +6690,7 @@ static WERROR enumprinterdrivers_level1(fstring servername, fstring architecture
uint32 version;
fstring *list = NULL;
NT_PRINTER_DRIVER_INFO_LEVEL driver;
- DRIVER_INFO_1 *tdi1, *driver_info_1=NULL;
+ DRIVER_INFO_1 *driver_info_1=NULL;
WERROR result = WERR_OK;
*returned=0;
@@ -6713,13 +6704,11 @@ static WERROR enumprinterdrivers_level1(fstring servername, fstring architecture
return WERR_NOMEM;
if(ndrivers != 0) {
- if((tdi1=SMB_REALLOC_ARRAY(driver_info_1, DRIVER_INFO_1, *returned+ndrivers )) == NULL) {
+ if((driver_info_1=SMB_REALLOC_ARRAY(driver_info_1, DRIVER_INFO_1, *returned+ndrivers )) == NULL) {
DEBUG(0,("enumprinterdrivers_level1: failed to enlarge driver info buffer!\n"));
- SAFE_FREE(driver_info_1);
SAFE_FREE(list);
return WERR_NOMEM;
}
- else driver_info_1 = tdi1;
}
for (i=0; i<ndrivers; i++) {
@@ -6782,7 +6771,7 @@ static WERROR enumprinterdrivers_level2(fstring servername, fstring architecture
uint32 version;
fstring *list = NULL;
NT_PRINTER_DRIVER_INFO_LEVEL driver;
- DRIVER_INFO_2 *tdi2, *driver_info_2=NULL;
+ DRIVER_INFO_2 *driver_info_2=NULL;
WERROR result = WERR_OK;
*returned=0;
@@ -6796,13 +6785,11 @@ static WERROR enumprinterdrivers_level2(fstring servername, fstring architecture
return WERR_NOMEM;
if(ndrivers != 0) {
- if((tdi2=SMB_REALLOC_ARRAY(driver_info_2, DRIVER_INFO_2, *returned+ndrivers )) == NULL) {
+ if((driver_info_2=SMB_REALLOC_ARRAY(driver_info_2, DRIVER_INFO_2, *returned+ndrivers )) == NULL) {
DEBUG(0,("enumprinterdrivers_level2: failed to enlarge driver info buffer!\n"));
- SAFE_FREE(driver_info_2);
SAFE_FREE(list);
return WERR_NOMEM;
}
- else driver_info_2 = tdi2;
}
for (i=0; i<ndrivers; i++) {
@@ -6866,7 +6853,7 @@ static WERROR enumprinterdrivers_level3(fstring servername, fstring architecture
uint32 version;
fstring *list = NULL;
NT_PRINTER_DRIVER_INFO_LEVEL driver;
- DRIVER_INFO_3 *tdi3, *driver_info_3=NULL;
+ DRIVER_INFO_3 *driver_info_3=NULL;
WERROR result = WERR_OK;
*returned=0;
@@ -6880,13 +6867,11 @@ static WERROR enumprinterdrivers_level3(fstring servername, fstring architecture
return WERR_NOMEM;
if(ndrivers != 0) {
- if((tdi3=SMB_REALLOC_ARRAY(driver_info_3, DRIVER_INFO_3, *returned+ndrivers )) == NULL) {
+ if((driver_info_3=SMB_REALLOC_ARRAY(driver_info_3, DRIVER_INFO_3, *returned+ndrivers )) == NULL) {
DEBUG(0,("enumprinterdrivers_level3: failed to enlarge driver info buffer!\n"));
- SAFE_FREE(driver_info_3);
SAFE_FREE(list);
return WERR_NOMEM;
}
- else driver_info_3 = tdi3;
}
for (i=0; i<ndrivers; i++) {