summaryrefslogtreecommitdiff
path: root/source3/rpc_server
diff options
context:
space:
mode:
authorVolker Lendecke <vlendec@samba.org>2006-10-15 16:06:10 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 12:15:29 -0500
commit7b9ef5e8409cdfba121a0520fd5e3b10467c20b4 (patch)
treeaf24c6bca8937f1af5efd34633e82003dd561316 /source3/rpc_server
parent6ec00affb66cdbffb29d50c67379a5155beb6a9e (diff)
downloadsamba-7b9ef5e8409cdfba121a0520fd5e3b10467c20b4.tar.gz
samba-7b9ef5e8409cdfba121a0520fd5e3b10467c20b4.tar.bz2
samba-7b9ef5e8409cdfba121a0520fd5e3b10467c20b4.zip
r19292: Avoid some potential segfaults: In winreg_EnumValue all pointers are unique
pointers and can thus be independently NULL. Thanks, Volker (This used to be commit d48ac0726a931a7200c47a87f771b74826ab9c96)
Diffstat (limited to 'source3/rpc_server')
-rw-r--r--source3/rpc_server/srv_winreg_nt.c30
1 files changed, 21 insertions, 9 deletions
diff --git a/source3/rpc_server/srv_winreg_nt.c b/source3/rpc_server/srv_winreg_nt.c
index 090338a301..a892a9bb8d 100644
--- a/source3/rpc_server/srv_winreg_nt.c
+++ b/source3/rpc_server/srv_winreg_nt.c
@@ -613,19 +613,31 @@ WERROR _winreg_EnumValue(pipes_struct *p, struct policy_handle *handle, uint32_t
status = WERR_NOMEM;
}
- *value_length = regval_size( val );
- *type = val->type;
+ if (type != NULL) {
+ *type = val->type;
+ }
- if ( *data_size == 0 || !data ) {
- status = WERR_OK;
- } else if ( *value_length > *data_size ) {
- status = WERR_MORE_DATA;
- } else {
- memcpy( data, regval_data_p(val), *value_length );
+ if (data != NULL) {
+ if ((data_size == NULL) || (value_length == NULL)) {
+ status = WERR_INVALID_PARAM;
+ goto done;
+ }
+
+ if (regval_size(val) > *data_size) {
+ status = WERR_MORE_DATA;
+ goto done;
+ }
+
+ memcpy( data, regval_data_p(val), regval_size(val) );
status = WERR_OK;
}
- *data_size = *value_length;
+ if (value_length != NULL) {
+ *value_length = regval_size( val );
+ }
+ if (data_size != NULL) {
+ *data_size = regval_size( val );
+ }
done:
free_registry_value( val );