r4088: Get medieval on our ass about malloc.... :-). Take control of all our allocation

functions so we can funnel through some well known functions. Should help greatly with
malloc checking.
HEAD patch to follow.
Jeremy.
(This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)

14 files changed, 211 insertions, 219 deletions

diff --git a/source3/rpc_server/srv_dfs_nt.c b/source3/rpc_server/srv_dfs_nt.c
index a3b06bb6e1..7334eef85b 100644
--- a/source3/rpc_server/srv_dfs_nt.c
+++ b/source3/rpc_server/srv_dfs_nt.c
@@ -81,9 +81,7 @@ WERROR _dfs_add(pipes_struct *p, DFS_Q_DFS_ADD* q_u, DFS_R_DFS_ADD *r_u)
 
 	vfs_ChDir(p->conn,p->conn->connectpath);
 
-	jn.referral_list = (struct referral*) talloc(p->mem_ctx, jn.referral_count 
-				* sizeof(struct referral));
-
+	jn.referral_list = TALLOC_ARRAY(p->mem_ctx, struct referral, jn.referral_count);
 	if(jn.referral_list == NULL) {
 		DEBUG(0,("init_reply_dfs_add: talloc failed for referral list!\n"));
 		return WERR_DFS_INTERNAL_ERROR;
@@ -245,8 +243,7 @@ static BOOL init_reply_dfs_info_3(TALLOC_CTX *ctx, struct junction_map* j, DFS_I
 		dfs3[i].ptr_storages = 1;
      
 		/* also enumerate the storages */
-		dfs3[i].storages = (DFS_STORAGE_INFO*) talloc(ctx, j[i].referral_count * 
-						sizeof(DFS_STORAGE_INFO));
+		dfs3[i].storages = TALLOC_ARRAY(ctx, DFS_STORAGE_INFO, j[i].referral_count);
 		if (!dfs3[i].storages)
 			return False;
 
@@ -285,7 +282,7 @@ static WERROR init_reply_dfs_ctr(TALLOC_CTX *ctx, uint32 level,
 	case 1:
 		{
 		DFS_INFO_1* dfs1;
-		dfs1 = (DFS_INFO_1*) talloc(ctx, num_jn * sizeof(DFS_INFO_1));
+		dfs1 = TALLOC_ARRAY(ctx, DFS_INFO_1, num_jn);
 		if (!dfs1)
 			return WERR_NOMEM;
 		init_reply_dfs_info_1(jn, dfs1, num_jn);
@@ -295,7 +292,7 @@ static WERROR init_reply_dfs_ctr(TALLOC_CTX *ctx, uint32 level,
 	case 2:
 		{
 		DFS_INFO_2* dfs2;
-		dfs2 = (DFS_INFO_2*) talloc(ctx, num_jn * sizeof(DFS_INFO_2));
+		dfs2 = TALLOC_ARRAY(ctx, DFS_INFO_2, num_jn);
 		if (!dfs2)
 			return WERR_NOMEM;
 		init_reply_dfs_info_2(jn, dfs2, num_jn);
@@ -305,7 +302,7 @@ static WERROR init_reply_dfs_ctr(TALLOC_CTX *ctx, uint32 level,
 	case 3:
 		{
 		DFS_INFO_3* dfs3;
-		dfs3 = (DFS_INFO_3*) talloc(ctx, num_jn * sizeof(DFS_INFO_3));
+		dfs3 = TALLOC_ARRAY(ctx, DFS_INFO_3, num_jn);
 		if (!dfs3)
 			return WERR_NOMEM;
 		init_reply_dfs_info_3(ctx, jn, dfs3, num_jn);
@@ -336,7 +333,7 @@ WERROR _dfs_enum(pipes_struct *p, DFS_Q_DFS_ENUM *q_u, DFS_R_DFS_ENUM *r_u)
 	r_u->reshnd.ptr_hnd = 1;
 	r_u->reshnd.handle = num_jn;
   
-	r_u->ctr = (DFS_INFO_CTR*)talloc(p->mem_ctx, sizeof(DFS_INFO_CTR));
+	r_u->ctr = TALLOC_P(p->mem_ctx, DFS_INFO_CTR);
 	if (!r_u->ctr)
 		return WERR_NOMEM;
 	ZERO_STRUCTP(r_u->ctr);
diff --git a/source3/rpc_server/srv_echo_nt.c b/source3/rpc_server/srv_echo_nt.c
index ddb76b3a21..86fcce28c7 100644
--- a/source3/rpc_server/srv_echo_nt.c
+++ b/source3/rpc_server/srv_echo_nt.c
@@ -44,7 +44,7 @@ void _echo_data(pipes_struct *p, ECHO_Q_ECHO_DATA *q_u,
 {
 	DEBUG(10, ("_echo_data\n"));
 
-	r_u->data = talloc(p->mem_ctx, q_u->size);
+	r_u->data = TALLOC(p->mem_ctx, q_u->size);
 	r_u->size = q_u->size;
 	memcpy(r_u->data, q_u->data, q_u->size);
 }
@@ -68,7 +68,7 @@ void _source_data(pipes_struct *p, ECHO_Q_SOURCE_DATA *q_u,
 
 	DEBUG(10, ("_source_data\n"));
 
-	r_u->data = talloc(p->mem_ctx, q_u->size);
+	r_u->data = TALLOC(p->mem_ctx, q_u->size);
 	r_u->size = q_u->size;
 
 	for (i = 0; i < r_u->size; i++)
diff --git a/source3/rpc_server/srv_lsa_ds_nt.c b/source3/rpc_server/srv_lsa_ds_nt.c
index f6e8eed9a9..d0b7a299be 100644
--- a/source3/rpc_server/srv_lsa_ds_nt.c
+++ b/source3/rpc_server/srv_lsa_ds_nt.c
@@ -41,7 +41,7 @@ static NTSTATUS fill_dsrole_dominfo_basic(TALLOC_CTX *ctx, DSROLE_PRIMARY_DOMAIN
 
 	DEBUG(10,("fill_dsrole_dominfo_basic: enter\n"));
 
-	if ( !(basic = talloc_zero(ctx, sizeof(DSROLE_PRIMARY_DOMAIN_INFO_BASIC))) ) {
+	if ( !(basic = TALLOC_ZERO_P(ctx, DSROLE_PRIMARY_DOMAIN_INFO_BASIC)) ) {
 		DEBUG(0,("fill_dsrole_dominfo_basic: FATAL error!  talloc_xero() failed\n"));
 		return NT_STATUS_NO_MEMORY;
 	}
diff --git a/source3/rpc_server/srv_lsa_hnd.c b/source3/rpc_server/srv_lsa_hnd.c
index 2ec62e2c57..0f9f239a02 100644
--- a/source3/rpc_server/srv_lsa_hnd.c
+++ b/source3/rpc_server/srv_lsa_hnd.c
@@ -70,7 +70,7 @@ BOOL init_pipe_handle_list(pipes_struct *p, char *pipe_name)
 		 * Create list.
 		 */
 
-		if ((hl = (struct handle_list *)malloc(sizeof(struct handle_list))) == NULL)
+		if ((hl = SMB_MALLOC_P(struct handle_list)) == NULL)
 			return False;
 		ZERO_STRUCTP(hl);
 
@@ -112,7 +112,7 @@ BOOL create_policy_hnd(pipes_struct *p, POLICY_HND *hnd, void (*free_fn)(void *)
 		return False;
 	}
 
-	pol = (struct policy *)malloc(sizeof(*p));
+	pol = SMB_MALLOC_P(struct policy);
 	if (!pol) {
 		DEBUG(0,("create_policy_hnd: ERROR: out of memory!\n"));
 		return False;
diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index 498b83a4c9..fcd574971f 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -232,14 +232,12 @@ static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME
 	/* Allocate memory for list of names */
 
 	if (num_entries > 0) {
-		if (!(trn->name = (LSA_TRANS_NAME *)talloc(ctx, sizeof(LSA_TRANS_NAME) *
-							  num_entries))) {
+		if (!(trn->name = TALLOC_ARRAY(ctx, LSA_TRANS_NAME, num_entries))) {
 			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
 			return;
 		}
 
-		if (!(trn->uni_name = (UNISTR2 *)talloc(ctx, sizeof(UNISTR2) * 
-							num_entries))) {
+		if (!(trn->uni_name = TALLOC_ARRAY(ctx, UNISTR2, num_entries))) {
 			DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
 			return;
 		}
@@ -418,7 +416,7 @@ NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL
 
 
 	/* associate the domain SID with the (unique) handle. */
-	if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
+	if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
 		return NT_STATUS_NO_MEMORY;
 
 	ZERO_STRUCTP(info);
@@ -463,7 +461,7 @@ NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *
 	}
 
 	/* associate the domain SID with the (unique) handle. */
-	if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
+	if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
 		return NT_STATUS_NO_MEMORY;
 
 	ZERO_STRUCTP(info);
@@ -550,7 +548,7 @@ NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INF
 		info->id2.auditing_enabled = 1;
 		info->id2.count1 = 7;
 		info->id2.count2 = 7;
-		if ((info->id2.auditsettings = (uint32 *)talloc(p->mem_ctx,7*sizeof(uint32))) == NULL)
+		if ((info->id2.auditsettings = TALLOC_ARRAY(p->mem_ctx,uint32, 7)) == NULL)
 			return NT_STATUS_NO_MEMORY;
 		for (i = 0; i < 7; i++)
 			info->id2.auditsettings[i] = 3;
@@ -649,8 +647,8 @@ NTSTATUS _lsa_lookup_sids(pipes_struct *p, LSA_Q_LOOKUP_SIDS *q_u, LSA_R_LOOKUP_
 		DEBUG(5,("_lsa_lookup_sids: truncating SID lookup list to %d\n", num_entries));
 	}
 
-	ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
-	names = (LSA_TRANS_NAME_ENUM *)talloc_zero(p->mem_ctx, sizeof(LSA_TRANS_NAME_ENUM));
+	ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
+	names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM);
 
 	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
 		r_u->status = NT_STATUS_INVALID_HANDLE;
@@ -698,8 +696,8 @@ NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP
 		DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
 	}
 		
-	ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
-	rids = (DOM_RID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_RID2)*num_entries);
+	ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
+	rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, num_entries);
 
 	if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
 		r_u->status = NT_STATUS_INVALID_HANDLE;
@@ -768,7 +766,7 @@ NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIV
 	if (enum_context >= PRIV_ALL_INDEX)
 		return NT_STATUS_NO_MORE_ENTRIES;
 
-	entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX));
+	entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, PRIV_ALL_INDEX);
 	if (entries==NULL)
 		return NT_STATUS_NO_MEMORY;
 
@@ -887,8 +885,8 @@ NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENU
 	if (q_u->enum_context >= num_entries)
 		return NT_STATUS_NO_MORE_ENTRIES;
 
-	sids->ptr_sid = (uint32 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(uint32));
-	sids->sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(DOM_SID2));
+	sids->ptr_sid = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_entries-q_u->enum_context);
+	sids->sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_entries-q_u->enum_context);
 
 	if (sids->ptr_sid==NULL || sids->sid==NULL) {
 		SAFE_FREE(map);
@@ -960,7 +958,7 @@ NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENAC
 		return NT_STATUS_ACCESS_DENIED;
 
 	/* associate the user/group SID with the (unique) handle. */
-	if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
+	if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
 		return NT_STATUS_NO_MEMORY;
 
 	ZERO_STRUCTP(info);
diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c
index a3157435f3..2bc0cf301e 100644
--- a/source3/rpc_server/srv_netlog_nt.c
+++ b/source3/rpc_server/srv_netlog_nt.c
@@ -579,7 +579,7 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *
 	SAM_ACCOUNT *sampw;
 	struct auth_context *auth_context = NULL;
 	        
-	usr_info = (NET_USER_INFO_3 *)talloc(p->mem_ctx, sizeof(NET_USER_INFO_3));
+	usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
 	if (!usr_info)
 		return NT_STATUS_NO_MEMORY;
 
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index bcf5eb533f..01e91ce6c5 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -775,7 +775,7 @@ BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 			int 			n_fns = 0;
 			PIPE_RPC_FNS		*context_fns;
 			
-			if ( !(context_fns = malloc(sizeof(PIPE_RPC_FNS))) ) {
+			if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 				DEBUG(0,("check_bind_req: malloc() failed!\n"));
 				return False;
 			}
@@ -831,8 +831,8 @@ NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *s
         /* We use a temporary variable because this call can fail and 
            rpc_lookup will still be valid afterwards.  It could then succeed if
            called again later */
-        rpc_entry = realloc(rpc_lookup, 
-                            ++rpc_lookup_size*sizeof(struct rpc_table));
+	rpc_lookup_size++;
+        rpc_entry = SMB_REALLOC_ARRAY(rpc_lookup, struct rpc_table, rpc_lookup_size);
         if (NULL == rpc_entry) {
                 rpc_lookup_size--;
                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
@@ -843,13 +843,10 @@ NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *s
         
         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
         ZERO_STRUCTP(rpc_entry);
-        rpc_entry->pipe.clnt = strdup(clnt);
-        rpc_entry->pipe.srv = strdup(srv);
-        rpc_entry->cmds = realloc(rpc_entry->cmds, 
-                                  (rpc_entry->n_cmds + size) *
-                                  sizeof(struct api_struct));
-        memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
-               size * sizeof(struct api_struct));
+        rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
+        rpc_entry->pipe.srv = SMB_STRDUP(srv);
+        rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
+        memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
         rpc_entry->n_cmds += size;
         
         return NT_STATUS_OK;
@@ -1585,9 +1582,7 @@ BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
 	if ((DEBUGLEVEL >= 10) && 
 	    (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
 		size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
-		char *data;
-
-		data = malloc(data_len);
+		char *data = SMB_MALLOC(data_len);
 
 		DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
 		if (data) {
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index 562b55b8f7..8720a4df68 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -204,8 +204,7 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 	for (p = Pipes; p; p = p->next)
 		DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));  
 
-	p = (smb_np_struct *)malloc(sizeof(*p));
-
+	p = SMB_MALLOC_P(smb_np_struct);
 	if (!p) {
 		DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 		return NULL;
@@ -283,10 +282,9 @@ static void *make_internal_rpc_pipe_p(char *pipe_name,
 		return NULL;
 	}
 
-	p = (pipes_struct *)malloc(sizeof(*p));
+	p = SMB_MALLOC_P(pipes_struct);
 
-	if (!p)
-	{
+	if (!p) {
 		DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 		return NULL;
 	}
diff --git a/source3/rpc_server/srv_reg_nt.c b/source3/rpc_server/srv_reg_nt.c
index a4e3638be6..dc9db47c66 100644
--- a/source3/rpc_server/srv_reg_nt.c
+++ b/source3/rpc_server/srv_reg_nt.c
@@ -97,7 +97,7 @@ static NTSTATUS open_registry_key(pipes_struct *p, POLICY_HND *hnd, REGISTRY_KEY
 	if ( subkey_len && subkeyname2[subkey_len-1] == '\\' )
 		subkeyname2[subkey_len-1] = '\0';
 
-	if ((regkey=(REGISTRY_KEY*)malloc(sizeof(REGISTRY_KEY))) == NULL)
+	if ((regkey=SMB_MALLOC_P(REGISTRY_KEY)) == NULL)
 		return NT_STATUS_NO_MEMORY;
 		
 	ZERO_STRUCTP( regkey );
@@ -373,7 +373,7 @@ NTSTATUS _reg_info(pipes_struct *p, REG_Q_INFO *q_u, REG_R_INFO *r_u)
 	/* couple of hard coded registry values */
 	
 	if ( strequal(name, "RefusePasswordChange") ) {
-		if ( (val = (REGISTRY_VALUE*)malloc(sizeof(REGISTRY_VALUE))) == NULL ) {
+		if ( (val = SMB_MALLOC_P(REGISTRY_VALUE)) == NULL ) {
 			DEBUG(0,("_reg_info: malloc() failed!\n"));
 			return NT_STATUS_NO_MEMORY;
 		}
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 0c52e859ca..5f74df420a 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -137,7 +137,7 @@ static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
 
 	mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
 
-	if ((info = (struct samr_info *)talloc(mem_ctx, sizeof(struct samr_info))) == NULL)
+	if ((info = TALLOC_P(mem_ctx, struct samr_info)) == NULL)
 		return NULL;
 
 	ZERO_STRUCTP(info);
@@ -255,8 +255,8 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask, BOO
 		if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) {
 		
 			DEBUG(10,("load_sampwd_entries: allocating more memory\n"));
-			pwd_array=(SAM_ACCOUNT *)talloc_realloc(mem_ctx, info->disp_info.disp_user_info, 
-			                  (info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(SAM_ACCOUNT));
+			pwd_array=TALLOC_REALLOC_ARRAY(mem_ctx, info->disp_info.disp_user_info, SAM_ACCOUNT,
+			                  info->disp_info.num_user_account+MAX_SAM_ENTRIES);
 
 			if (pwd_array==NULL)
 				return NT_STATUS_NO_MEMORY;
@@ -322,7 +322,7 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
 
 	info->disp_info.num_group_account=group_entries;
 
-	grp_array=(DOMAIN_GRP *)talloc(mem_ctx, info->disp_info.num_group_account*sizeof(DOMAIN_GRP));
+	grp_array=TALLOC_ARRAY(mem_ctx, DOMAIN_GRP, info->disp_info.num_group_account);
 	if (group_entries!=0 && grp_array==NULL) {
 		DEBUG(1, ("load_group_domain_entries: talloc() failed for grp_array!\n"));
 		SAFE_FREE(map);
@@ -716,9 +716,9 @@ static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UN
 	if (num_entries == 0)
 		return NT_STATUS_OK;
 
-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_entries);
+	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_entries);
 
-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_entries);
+	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_entries);
 
 	if (sam == NULL || uni_name == NULL) {
 		DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));
@@ -871,9 +871,8 @@ static void make_group_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNIST
 	if (num_sam_entries == 0)
 		return;
 
-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
-
-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
+	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
+	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
 
 	if (sam == NULL || uni_name == NULL) {
 		DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
@@ -923,7 +922,7 @@ static NTSTATUS get_group_domain_entries( TALLOC_CTX *ctx,
 		num_entries=max_entries;
 	}
 
-	*d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP));
+	*d_grp=TALLOC_ZERO_ARRAY(ctx, DOMAIN_GRP, num_entries);
 	if (num_entries!=0 && *d_grp==NULL){
 		SAFE_FREE(map);
 		return NT_STATUS_NO_MEMORY;
@@ -969,7 +968,7 @@ static NTSTATUS get_alias_entries( TALLOC_CTX *ctx, DOMAIN_GRP **d_grp,
 	if (*p_num_entries == 0)
 		return NT_STATUS_OK;
 
-	*d_grp = talloc(ctx, sizeof(DOMAIN_GRP) * (*p_num_entries));
+	*d_grp = TALLOC_ARRAY(ctx, DOMAIN_GRP, *p_num_entries);
 
 	if (*d_grp == NULL) {
 		SAFE_FREE(info);
@@ -1187,7 +1186,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
 		DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to only %d entries\n", max_entries));
 	}
 
-	if (!(ctr = (SAM_DISPINFO_CTR *)talloc_zero(p->mem_ctx,sizeof(SAM_DISPINFO_CTR))))
+	if (!(ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_DISPINFO_CTR)))
 		return NT_STATUS_NO_MEMORY;
 
 	ZERO_STRUCTP(ctr);
@@ -1196,7 +1195,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
 	switch (q_u->switch_level) {
 	case 0x1:
 		if (max_entries) {
-			if (!(ctr->sam.info1 = (SAM_DISPINFO_1 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_1))))
+			if (!(ctr->sam.info1 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_1,max_entries)))
 				return NT_STATUS_NO_MEMORY;
 		}
 		disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context, 
@@ -1206,7 +1205,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
 		break;
 	case 0x2:
 		if (max_entries) {
-			if (!(ctr->sam.info2 = (SAM_DISPINFO_2 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_2))))
+			if (!(ctr->sam.info2 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_2,max_entries)))
 				return NT_STATUS_NO_MEMORY;
 		}
 		disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context, 
@@ -1216,7 +1215,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
 		break;
 	case 0x3:
 		if (max_entries) {
-			if (!(ctr->sam.info3 = (SAM_DISPINFO_3 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_3))))
+			if (!(ctr->sam.info3 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_3,max_entries)))
 				return NT_STATUS_NO_MEMORY;
 		}
 		disp_ret = init_sam_dispinfo_3(p->mem_ctx, ctr->sam.info3, max_entries, enum_context, info->disp_info.disp_group_info);
@@ -1225,7 +1224,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
 		break;
 	case 0x4:
 		if (max_entries) {
-			if (!(ctr->sam.info4 = (SAM_DISPINFO_4 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_4))))
+			if (!(ctr->sam.info4 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_4,max_entries)))
 				return NT_STATUS_NO_MEMORY;
 		}
 		disp_ret = init_sam_dispinfo_4(p->mem_ctx, ctr->sam.info4, max_entries, enum_context, info->disp_info.disp_user_info);
@@ -1234,7 +1233,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
 		break;
 	case 0x5:
 		if (max_entries) {
-			if (!(ctr->sam.info5 = (SAM_DISPINFO_5 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_5))))
+			if (!(ctr->sam.info5 = TALLOC_ZERO_ARRAY(p->mem_ctx,SAM_DISPINFO_5,max_entries)))
 				return NT_STATUS_NO_MEMORY;
 		}
 		disp_ret = init_sam_dispinfo_5(p->mem_ctx, ctr->sam.info5, max_entries, enum_context, info->disp_info.disp_group_info);
@@ -1512,11 +1511,11 @@ static BOOL make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names, fstring nam
 	*pp_hdr_name = NULL;
 
 	if (num_names != 0) {
-		hdr_name = (UNIHDR *)talloc_zero(ctx, sizeof(UNIHDR)*num_names);
+		hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR, num_names);
 		if (hdr_name == NULL)
 			return False;
 
-		uni_name = (UNISTR2 *)talloc_zero(ctx,sizeof(UNISTR2)*num_names);
+		uni_name = TALLOC_ZERO_ARRAY(ctx,UNISTR2, num_names);
 		if (uni_name == NULL)
 			return False;
 	}
@@ -1562,7 +1561,7 @@ NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOK
 	}
 
 	if (num_rids) {
-		if ((group_attrs = (uint32 *)talloc_zero(p->mem_ctx, num_rids * sizeof(uint32))) == NULL)
+		if ((group_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids )) == NULL)
 			return NT_STATUS_NO_MEMORY;
  	}
  
@@ -1854,7 +1853,7 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
 
 	DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
 
-	ctr = (SAM_USERINFO_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_USERINFO_CTR));
+	ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_USERINFO_CTR);
 	if (!ctr)
 		return NT_STATUS_NO_MEMORY;
 
@@ -1865,7 +1864,7 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
 
 	switch (q_u->switch_value) {
 	case 0x10:
-		ctr->info.id10 = (SAM_USER_INFO_10 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_10));
+		ctr->info.id10 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_10);
 		if (ctr->info.id10 == NULL)
 			return NT_STATUS_NO_MEMORY;
 
@@ -1883,11 +1882,7 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
             expire.low = 0xffffffff;
             expire.high = 0x7fffffff;
 
-            ctr->info.id = (SAM_USER_INFO_11 *)talloc_zero(p->mem_ctx,
-                                    sizeof
-                                    (*ctr->
-                                     info.
-                                     id11));
+            ctr->info.id = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_11));
 	    ZERO_STRUCTP(ctr->info.id11);
             init_sam_user_info11(ctr->info.id11, &expire,
                          "BROOKFIELDS$",    /* name */
@@ -1900,7 +1895,7 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
 #endif
 
 	case 0x12:
-		ctr->info.id12 = (SAM_USER_INFO_12 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_12));
+		ctr->info.id12 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_12);
 		if (ctr->info.id12 == NULL)
 			return NT_STATUS_NO_MEMORY;
 
@@ -1909,7 +1904,7 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
 		break;
 		
 	case 20:
-		ctr->info.id20 = (SAM_USER_INFO_20 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_20));
+		ctr->info.id20 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_20);
 		if (ctr->info.id20 == NULL)
 			return NT_STATUS_NO_MEMORY;
 		if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))
@@ -1917,7 +1912,7 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
 		break;
 
 	case 21:
-		ctr->info.id21 = (SAM_USER_INFO_21 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_21));
+		ctr->info.id21 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_21);
 		if (ctr->info.id21 == NULL)
 			return NT_STATUS_NO_MEMORY;
 		if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21, 
@@ -2025,8 +2020,7 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S
 					&(sids[i]), &rid))
 			continue;
 
-		gids = talloc_realloc(p->mem_ctx, gids,
-				      sizeof(*gids) * (num_gids+1));
+		gids = TALLOC_REALLOC_ARRAY(p->mem_ctx, gids, DOM_GID, num_gids+1);
 		gids[num_gids].attr=7;
 		gids[num_gids].g_rid = rid;
 		num_gids += 1;
@@ -2064,7 +2058,7 @@ NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SA
 
 	uint32 num_users=0, num_groups=0, num_aliases=0;
 
-	if ((ctr = (SAM_UNK_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_UNK_CTR))) == NULL)
+	if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
 		return NT_STATUS_NO_MEMORY;
 
 	ZERO_STRUCTP(ctr);
@@ -2549,8 +2543,8 @@ static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam,
 	if (num_sam_entries == 0)
 		return True;
 
-	sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
-	uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
+	sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
+	uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
 
 	if (sam == NULL || uni_name == NULL)
 		return False;
@@ -3193,7 +3187,7 @@ NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u,
 	    !sid_check_is_builtin(&info->sid))
 		return NT_STATUS_OBJECT_TYPE_MISMATCH;
 
-	members = talloc(p->mem_ctx, sizeof(DOM_SID) * q_u->num_sids1);
+	members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, q_u->num_sids1);
 
 	if (members == NULL)
 		return NT_STATUS_NO_MEMORY;
@@ -3219,8 +3213,7 @@ NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u,
 		if (!sid_peek_check_rid(&info->sid, &aliases[i], &rid))
 			continue;
 
-		rids = talloc_realloc(p->mem_ctx, rids,
-				      sizeof(*rids) * (num_groups+1));
+		rids = TALLOC_REALLOC_ARRAY(p->mem_ctx, rids, uint32, num_groups+1);
 
 		if (rids == NULL)
 			return NT_STATUS_NO_MEMORY;
@@ -3264,7 +3257,7 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
 	if (!pdb_enum_aliasmem(&alias_sid, &sids, &num_sids))
 		return NT_STATUS_NO_SUCH_ALIAS;
 
-	sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_SID2) * num_sids);	
+	sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_sids);	
 	if (num_sids!=0 && sid == NULL) {
 		SAFE_FREE(sids);
 		return NT_STATUS_NO_MEMORY;
@@ -3290,7 +3283,7 @@ static void add_uid_to_array_unique(uid_t uid, uid_t **uids, int *num)
 			return;
 	}
 	
-	*uids = Realloc(*uids, (*num+1) * sizeof(uid_t));
+	*uids = SMB_REALLOC_ARRAY(*uids, uid_t, *num+1);
 
 	if (*uids == NULL)
 		return;
@@ -3387,8 +3380,8 @@ NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_
 	if(!get_memberuids(gid, &uids, &num))
 		return NT_STATUS_NO_SUCH_GROUP;
 
-	rid=talloc_zero(p->mem_ctx, sizeof(uint32)*num);
-	attr=talloc_zero(p->mem_ctx, sizeof(uint32)*num);
+	rid=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num);
+	attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num);
 	
 	if (num!=0 && (rid==NULL || attr==NULL))
 		return NT_STATUS_NO_MEMORY;
@@ -3978,7 +3971,7 @@ NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAM
 	if (!ret)
 		return NT_STATUS_INVALID_HANDLE;
 
-	ctr=(GROUP_INFO_CTR *)talloc_zero(p->mem_ctx, sizeof(GROUP_INFO_CTR));
+	ctr=TALLOC_ZERO_P(p->mem_ctx, GROUP_INFO_CTR);
 	if (ctr==NULL)
 		return NT_STATUS_NO_MEMORY;
 
@@ -4309,7 +4302,7 @@ NTSTATUS _samr_unknown_2e(pipes_struct *p, SAMR_Q_UNKNOWN_2E *q_u, SAMR_R_UNKNOW
 
 	uint32 account_policy_temp;
 
-	if ((ctr = (SAM_UNK_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_UNK_CTR))) == NULL)
+	if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
 		return NT_STATUS_NO_MEMORY;
 
 	ZERO_STRUCTP(ctr);
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index aba7e6c22f..78b5fb61fa 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -238,7 +238,7 @@ static SPOOL_NOTIFY_OPTION *dup_spool_notify_option(SPOOL_NOTIFY_OPTION *sp)
 	if (!sp)
 		return NULL;
 
-	new_sp = (SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION));
+	new_sp = SMB_MALLOC_P(SPOOL_NOTIFY_OPTION);
 	if (!new_sp)
 		return NULL;
 
@@ -585,7 +585,7 @@ static BOOL open_printer_hnd(pipes_struct *p, POLICY_HND *hnd, char *name, uint3
 
 	DEBUG(10,("open_printer_hnd: name [%s]\n", name));
 
-	if((new_printer=(Printer_entry *)malloc(sizeof(Printer_entry))) == NULL)
+	if((new_printer=SMB_MALLOC_P(Printer_entry)) == NULL)
 		return False;
 
 	ZERO_STRUCTP(new_printer);
@@ -733,7 +733,7 @@ static void notify_string(struct spoolss_notify_msg *msg,
 	init_unistr2(&unistr, msg->notify.data, UNI_STR_TERMINATE);
 
 	data->notify_data.data.length = msg->len * 2;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, msg->len * 2);
+	data->notify_data.data.string = TALLOC_ARRAY(mem_ctx, uint16, msg->len);
 
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -770,7 +770,7 @@ static void notify_system_time(struct spoolss_notify_msg *msg,
 		return;
 
 	data->notify_data.data.length = prs_offset(&ps);
-	data->notify_data.data.string = talloc(mem_ctx, prs_offset(&ps));
+	data->notify_data.data.string = TALLOC(mem_ctx, prs_offset(&ps));
 
 	prs_copy_all_data_out((char *)data->notify_data.data.string, &ps);
 
@@ -928,7 +928,7 @@ static int notify_msg_ctr_addmsg( SPOOLSS_NOTIFY_MSG_CTR *ctr, SPOOLSS_NOTIFY_MS
 	if ( i == ctr->num_groups ) {
 		ctr->num_groups++;
 
-		if ( !(groups = talloc_realloc( ctr->ctx, ctr->msg_groups, sizeof(SPOOLSS_NOTIFY_MSG_GROUP)*ctr->num_groups)) ) {
+		if ( !(groups = TALLOC_REALLOC_ARRAY( ctr->ctx, ctr->msg_groups, SPOOLSS_NOTIFY_MSG_GROUP, ctr->num_groups)) ) {
 			DEBUG(0,("notify_msg_ctr_addmsg: talloc_realloc() failed!\n"));
 			return 0;
 		}
@@ -946,7 +946,7 @@ static int notify_msg_ctr_addmsg( SPOOLSS_NOTIFY_MSG_CTR *ctr, SPOOLSS_NOTIFY_MS
 	
 	msg_grp->num_msgs++;
 	
-	if ( !(msg_list =  talloc_realloc( ctr->ctx, msg_grp->msgs, sizeof(SPOOLSS_NOTIFY_MSG)*msg_grp->num_msgs )) ) {
+	if ( !(msg_list = TALLOC_REALLOC_ARRAY( ctr->ctx, msg_grp->msgs, SPOOLSS_NOTIFY_MSG, msg_grp->num_msgs )) ) {
 		DEBUG(0,("notify_msg_ctr_addmsg: talloc_realloc() failed for new message [%d]!\n", msg_grp->num_msgs));
 		return 0;
 	}
@@ -958,7 +958,7 @@ static int notify_msg_ctr_addmsg( SPOOLSS_NOTIFY_MSG_CTR *ctr, SPOOLSS_NOTIFY_MS
 	/* need to allocate own copy of data */
 	
 	if ( msg->len != 0 ) 
-		msg_grp->msgs[new_slot].notify.data = talloc_memdup( ctr->ctx, msg->notify.data, msg->len );
+		msg_grp->msgs[new_slot].notify.data = TALLOC_MEMDUP( ctr->ctx, msg->notify.data, msg->len );
 	
 	return ctr->num_groups;
 }
@@ -1016,7 +1016,7 @@ static void send_notify2_changes( SPOOLSS_NOTIFY_MSG_CTR *ctr, uint32 idx )
 		
 		/* allocate the max entries possible */
 		
-		data = talloc( mem_ctx, msg_group->num_msgs*sizeof(SPOOL_NOTIFY_INFO_DATA) );
+		data = TALLOC_ARRAY( mem_ctx, SPOOL_NOTIFY_INFO_DATA, msg_group->num_msgs);
 		ZERO_STRUCTP(data);
 		
 		/* build the array of change notifications */
@@ -1436,7 +1436,7 @@ static DEVICEMODE* dup_devicemode(TALLOC_CTX *ctx, DEVICEMODE *devmode)
 	
 	/* bulk copy first */
 	
-	d = talloc_memdup(ctx, devmode, sizeof(DEVICEMODE));
+	d = TALLOC_MEMDUP(ctx, devmode, sizeof(DEVICEMODE));
 	if (!d)
 		return NULL;
 		
@@ -1444,7 +1444,7 @@ static DEVICEMODE* dup_devicemode(TALLOC_CTX *ctx, DEVICEMODE *devmode)
 	
 	len = unistrlen(devmode->devicename.buffer);
 	if (len != -1) {
-		d->devicename.buffer = talloc(ctx, len*2);
+		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
 		if (unistrcpy(d->devicename.buffer, devmode->devicename.buffer) != len)
 			return NULL;
 	}
@@ -1452,12 +1452,12 @@ static DEVICEMODE* dup_devicemode(TALLOC_CTX *ctx, DEVICEMODE *devmode)
 
 	len = unistrlen(devmode->formname.buffer);
 	if (len != -1) {
-		d->devicename.buffer = talloc(ctx, len*2);
+		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
 		if (unistrcpy(d->formname.buffer, devmode->formname.buffer) != len)
 			return NULL;
 	}
 
-	d->private = talloc_memdup(ctx, devmode->private, devmode->driverextra);
+	d->private = TALLOC_MEMDUP(ctx, devmode->private, devmode->driverextra);
 	
 	return d;
 }
@@ -1894,7 +1894,7 @@ BOOL convert_devicemode(const char *printername, const DEVICEMODE *devmode,
 	if ((devmode->driverextra != 0) && (devmode->private != NULL)) {
 		SAFE_FREE(nt_devmode->private);
 		nt_devmode->driverextra=devmode->driverextra;
-		if((nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8))) == NULL)
+		if((nt_devmode->private=SMB_MALLOC_ARRAY(uint8, nt_devmode->driverextra)) == NULL)
 			return False;
 		memcpy(nt_devmode->private, devmode->private, nt_devmode->driverextra);
 	}
@@ -2235,11 +2235,11 @@ static WERROR get_printer_dataex( TALLOC_CTX *ctx, NT_PRINTER_INFO_LEVEL *printe
 		
 		/* special case for 0 length values */
 		if ( data_len ) {
-			if ( (*data  = (uint8 *)talloc_memdup(ctx, regval_data_p(val), data_len)) == NULL )
+			if ( (*data  = (uint8 *)TALLOC_MEMDUP(ctx, regval_data_p(val), data_len)) == NULL )
 				return WERR_NOMEM;
 		}
 		else {
-			if ( (*data  = (uint8 *)talloc_zero(ctx, in_size)) == NULL )
+			if ( (*data  = (uint8 *)TALLOC_ZERO(ctx, in_size)) == NULL )
 				return WERR_NOMEM;
 		}
 	}
@@ -2286,7 +2286,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 		
 	if (!StrCaseCmp(value, "W3SvcInstalled")) {
 		*type = 0x4;
-		if((*data = (uint8 *)talloc_zero(ctx, 4*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC_ZERO(ctx, 4*sizeof(uint8) )) == NULL)
 			return WERR_NOMEM;
 		*needed = 0x4;
 		return WERR_OK;
@@ -2294,7 +2294,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 
 	if (!StrCaseCmp(value, "BeepEnabled")) {
 		*type = 0x4;
-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC(ctx, 4*sizeof(uint8) )) == NULL)
 			return WERR_NOMEM;
 		SIVAL(*data, 0, 0x00);
 		*needed = 0x4;			
@@ -2303,7 +2303,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 
 	if (!StrCaseCmp(value, "EventLog")) {
 		*type = 0x4;
-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
 			return WERR_NOMEM;
 		/* formally was 0x1b */
 		SIVAL(*data, 0, 0x0);
@@ -2313,7 +2313,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 
 	if (!StrCaseCmp(value, "NetPopup")) {
 		*type = 0x4;
-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
 			return WERR_NOMEM;
 		SIVAL(*data, 0, 0x00);
 		*needed = 0x4;
@@ -2322,7 +2322,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 
 	if (!StrCaseCmp(value, "MajorVersion")) {
 		*type = 0x4;
-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
 			return WERR_NOMEM;
 
 		/* Windows NT 4.0 seems to not allow uploading of drivers
@@ -2341,7 +2341,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 
 	if (!StrCaseCmp(value, "MinorVersion")) {
 		*type = 0x4;
-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
 			return WERR_NOMEM;
 		SIVAL(*data, 0, 0);
 		*needed = 0x4;
@@ -2359,7 +2359,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 		*type = 0x3;
 		*needed = 0x114;
 
-		if((*data = (uint8 *)talloc(ctx, (*needed)*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC(ctx, *needed)) == NULL)
 			return WERR_NOMEM;
 		ZERO_STRUCTP( *data );
 		
@@ -2378,7 +2378,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 		const char *string="C:\\PRINTERS";
 		*type = 0x1;			
 		*needed = 2*(strlen(string)+1);		
-		if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+		if((*data  = (uint8 *)TALLOC(ctx, (*needed > in_size) ? *needed:in_size )) == NULL)
 			return WERR_NOMEM;
 		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
 		
@@ -2394,7 +2394,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 		const char *string="Windows NT x86";
 		*type = 0x1;			
 		*needed = 2*(strlen(string)+1);	
-		if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+		if((*data  = (uint8 *)TALLOC(ctx, (*needed > in_size) ? *needed:in_size )) == NULL)
 			return WERR_NOMEM;
 		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
 		for (i=0; i<strlen(string); i++) {
@@ -2406,7 +2406,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 
 	if (!StrCaseCmp(value, "DsPresent")) {
 		*type = 0x4;
-		if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
+		if((*data = (uint8 *)TALLOC(ctx, 4 )) == NULL)
 			return WERR_NOMEM;
 		SIVAL(*data, 0, 0x01);
 		*needed = 0x4;
@@ -2420,7 +2420,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint
 			return WERR_BADFILE;
 		*type = 0x1;			
 		*needed = 2*(strlen(hostname)+1);	
-		if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+		if((*data  = (uint8 *)TALLOC(ctx, (*needed > in_size) ? *needed:in_size )) == NULL)
 			return WERR_NOMEM;
 		memset(*data, 0, (*needed > in_size) ? *needed:in_size);
 		for (i=0; i<strlen(hostname); i++) {
@@ -2495,7 +2495,7 @@ WERROR _spoolss_getprinterdata(pipes_struct *p, SPOOL_Q_GETPRINTERDATA *q_u, SPO
 		if ( strequal(value, "ChangeId") ) {
 			*type = REG_DWORD;
 			*needed = sizeof(uint32);
-			if ( (*data = (uint8*)talloc(p->mem_ctx, sizeof(uint32))) == NULL) {
+			if ( (*data = (uint8*)TALLOC(p->mem_ctx, sizeof(uint32))) == NULL) {
 				status = WERR_NOMEM;
 				goto done;
 			}
@@ -2517,7 +2517,7 @@ done:
 		/* reply this param doesn't exist */
 		
 		if ( *out_size ) {
-			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL) {
+			if((*data=(uint8 *)TALLOC_ZERO_ARRAY(p->mem_ctx, uint8, *out_size)) == NULL) {
 				if ( printer ) 
 					free_a_printer( &printer, 2 );
 				return WERR_NOMEM;
@@ -2764,7 +2764,7 @@ void spoolss_notify_server_name(int snum,
 	len = rpcstr_push(temp, printer->info_2->servername, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -2799,7 +2799,7 @@ void spoolss_notify_printer_name(int snum,
 	len = rpcstr_push(temp, p, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -2825,7 +2825,7 @@ void spoolss_notify_share_name(int snum,
 	len = rpcstr_push(temp, lp_servicename(snum), sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -2853,7 +2853,7 @@ void spoolss_notify_port_name(int snum,
 	len = rpcstr_push(temp, printer->info_2->portname, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -2880,7 +2880,7 @@ void spoolss_notify_driver_name(int snum,
 	len = rpcstr_push(temp, printer->info_2->drivername, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -2909,7 +2909,7 @@ void spoolss_notify_comment(int snum,
 		len = rpcstr_push(temp, printer->info_2->comment, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -2936,7 +2936,7 @@ void spoolss_notify_location(int snum,
 	len = rpcstr_push(temp, printer->info_2->location,sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -2975,7 +2975,7 @@ void spoolss_notify_sepfile(int snum,
 	len = rpcstr_push(temp, printer->info_2->sepfile, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3002,7 +3002,7 @@ void spoolss_notify_print_processor(int snum,
 	len = rpcstr_push(temp,  printer->info_2->printprocessor, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3029,7 +3029,7 @@ void spoolss_notify_parameters(int snum,
 	len = rpcstr_push(temp,  printer->info_2->parameters, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3056,7 +3056,7 @@ void spoolss_notify_datatype(int snum,
 	len = rpcstr_push(temp, printer->info_2->datatype, sizeof(pstring)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3216,7 +3216,7 @@ static void spoolss_notify_username(int snum,
 	len = rpcstr_push(temp, queue->fs_user, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3256,7 +3256,7 @@ static void spoolss_notify_job_name(int snum,
 	len = rpcstr_push(temp, queue->fs_file, sizeof(temp)-2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3306,7 +3306,7 @@ static void spoolss_notify_job_status_string(int snum,
 	len = rpcstr_push(temp, p, sizeof(temp) - 2, STR_TERMINATE);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 	
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3404,7 +3404,7 @@ static void spoolss_notify_submitted_time(int snum,
 	len = sizeof(SYSTEMTIME);
 
 	data->notify_data.data.length = len;
-	data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+	data->notify_data.data.string = (uint16 *)TALLOC(mem_ctx, len);
 
 	if (!data->notify_data.data.string) {
 		data->notify_data.data.length = 0;
@@ -3626,7 +3626,7 @@ static BOOL construct_notify_printer_info(Printer_entry *print_hnd, SPOOL_NOTIFY
 		if (!search_notify(type, field, &j) )
 			continue;
 
-		if((tid=(SPOOL_NOTIFY_INFO_DATA *)Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+		if((tid=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
 			DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n"));
 			return False;
 		} else 
@@ -3682,7 +3682,7 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue,
 		if (!search_notify(type, field, &j) )
 			continue;
 
-		if((tid=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+		if((tid=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
 			DEBUG(2,("construct_notify_jobs_info: failed to enlarg buffer info->data!\n"));
 			return False;
 		}
@@ -3966,7 +3966,7 @@ static BOOL construct_printer_info_0(Printer_entry *print_hnd, PRINTER_INFO_0 *p
 
 	/* it's the first time, add it to the list */
 	if (session_counter==NULL) {
-		if((session_counter=(counter_printer_0 *)malloc(sizeof(counter_printer_0))) == NULL) {
+		if((session_counter=SMB_MALLOC_P(counter_printer_0)) == NULL) {
 			free_a_printer(&ntprinter, 2);
 			return False;
 		}
@@ -4160,7 +4160,7 @@ DEVICEMODE *construct_dev_mode(int snum)
 		goto done;
 	}
 
-	if ((devmode = (DEVICEMODE *)malloc(sizeof(DEVICEMODE))) == NULL) {
+	if ((devmode = SMB_MALLOC_P(DEVICEMODE)) == NULL) {
 		DEBUG(2,("construct_dev_mode: malloc fail.\n"));
 		goto done;
 	}
@@ -4257,7 +4257,7 @@ static BOOL construct_printer_info_3(Printer_entry *print_hnd, PRINTER_INFO_3 **
 		return False;
 
 	*pp_printer = NULL;
-	if ((printer = (PRINTER_INFO_3 *)malloc(sizeof(PRINTER_INFO_3))) == NULL) {
+	if ((printer = SMB_MALLOC_P(PRINTER_INFO_3)) == NULL) {
 		DEBUG(2,("construct_printer_info_3: malloc fail.\n"));
 		return False;
 	}
@@ -4386,7 +4386,7 @@ static WERROR enum_all_printers_info_1(uint32 flags, NEW_BUFFER *buffer, uint32
 			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
 
 			if (construct_printer_info_1(NULL, flags, &current_prt, snum)) {
-				if((tp=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_1))) == NULL) {
+				if((tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_1, *returned +1)) == NULL) {
 					DEBUG(2,("enum_all_printers_info_1: failed to enlarge printers buffer!\n"));
 					SAFE_FREE(printers);
 					*returned=0;
@@ -4475,7 +4475,7 @@ static WERROR enum_all_printers_info_1_remote(fstring name, NEW_BUFFER *buffer,
 	 * undocumented RPC call.
 	 */
 	
-	if((printer=(PRINTER_INFO_1 *)malloc(sizeof(PRINTER_INFO_1))) == NULL)
+	if((printer=SMB_MALLOC_P(PRINTER_INFO_1)) == NULL)
 		return WERR_NOMEM;
 
 	*returned=1;
@@ -4559,7 +4559,7 @@ static WERROR enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint3
 			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
 				
 			if (construct_printer_info_2(NULL, &current_prt, snum)) {
-				if((tp=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_2))) == NULL) {
+				if((tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_2, *returned +1)) == NULL) {
 					DEBUG(2,("enum_all_printers_info_2: failed to enlarge printers buffer!\n"));
 					SAFE_FREE(printers);
 					*returned = 0;
@@ -4735,7 +4735,7 @@ static WERROR getprinter_level_0(Printer_entry *print_hnd, int snum, NEW_BUFFER
 {
 	PRINTER_INFO_0 *printer=NULL;
 
-	if((printer=(PRINTER_INFO_0*)malloc(sizeof(PRINTER_INFO_0))) == NULL)
+	if((printer=SMB_MALLOC_P(PRINTER_INFO_0)) == NULL)
 		return WERR_NOMEM;
 
 	construct_printer_info_0(print_hnd, printer, snum);
@@ -4768,7 +4768,7 @@ static WERROR getprinter_level_1(Printer_entry *print_hnd, int snum, NEW_BUFFER
 {
 	PRINTER_INFO_1 *printer=NULL;
 
-	if((printer=(PRINTER_INFO_1*)malloc(sizeof(PRINTER_INFO_1))) == NULL)
+	if((printer=SMB_MALLOC_P(PRINTER_INFO_1)) == NULL)
 		return WERR_NOMEM;
 
 	construct_printer_info_1(print_hnd, PRINTER_ENUM_ICON8, printer, snum);
@@ -4801,7 +4801,7 @@ static WERROR getprinter_level_2(Printer_entry *print_hnd, int snum, NEW_BUFFER
 {
 	PRINTER_INFO_2 *printer=NULL;
 
-	if((printer=(PRINTER_INFO_2*)malloc(sizeof(PRINTER_INFO_2)))==NULL)
+	if((printer=SMB_MALLOC_P(PRINTER_INFO_2))==NULL)
 		return WERR_NOMEM;
 	
 	construct_printer_info_2(print_hnd, printer, snum);
@@ -4868,7 +4868,7 @@ static WERROR getprinter_level_4(Printer_entry *print_hnd, int snum, NEW_BUFFER
 {
 	PRINTER_INFO_4 *printer=NULL;
 
-	if((printer=(PRINTER_INFO_4*)malloc(sizeof(PRINTER_INFO_4)))==NULL)
+	if((printer=SMB_MALLOC_P(PRINTER_INFO_4))==NULL)
 		return WERR_NOMEM;
 
 	if (!construct_printer_info_4(print_hnd, printer, snum))
@@ -4902,7 +4902,7 @@ static WERROR getprinter_level_5(Printer_entry *print_hnd, int snum, NEW_BUFFER
 {
 	PRINTER_INFO_5 *printer=NULL;
 
-	if((printer=(PRINTER_INFO_5*)malloc(sizeof(PRINTER_INFO_5)))==NULL)
+	if((printer=SMB_MALLOC_P(PRINTER_INFO_5))==NULL)
 		return WERR_NOMEM;
 
 	if (!construct_printer_info_5(print_hnd, printer, snum))
@@ -4933,7 +4933,7 @@ static WERROR getprinter_level_7(Printer_entry *print_hnd, int snum, NEW_BUFFER
 {
 	PRINTER_INFO_7 *printer=NULL;
 
-	if((printer=(PRINTER_INFO_7*)malloc(sizeof(PRINTER_INFO_7)))==NULL)
+	if((printer=SMB_MALLOC_P(PRINTER_INFO_7))==NULL)
 		return WERR_NOMEM;
 
 	if (!construct_printer_info_7(print_hnd, printer, snum))
@@ -5135,7 +5135,7 @@ static uint32 init_unistr_array(uint16 **uni_array, fstring *char_array, const c
 
 		/* add one extra unit16 for the second terminating NULL */
 		
-		if ( (tuary=Realloc(*uni_array, (j+1+strlen(line)+2)*sizeof(uint16))) == NULL ) {
+		if ( (tuary=SMB_REALLOC_ARRAY(*uni_array, uint16, j+1+strlen(line)+2)) == NULL ) {
 			DEBUG(2,("init_unistr_array: Realloc error\n" ));
 			return 0;
 		} else
@@ -5411,7 +5411,7 @@ static WERROR getprinterdriver2_level1(fstring servername, fstring architecture,
 	DRIVER_INFO_1 *info=NULL;
 	WERROR status;
 	
-	if((info=(DRIVER_INFO_1 *)malloc(sizeof(DRIVER_INFO_1))) == NULL)
+	if((info=SMB_MALLOC_P(DRIVER_INFO_1)) == NULL)
 		return WERR_NOMEM;
 	
 	status=construct_printer_driver_info_1(info, snum, servername, architecture, version);
@@ -5448,7 +5448,7 @@ static WERROR getprinterdriver2_level2(fstring servername, fstring architecture,
 	DRIVER_INFO_2 *info=NULL;
 	WERROR status;
 	
-	if((info=(DRIVER_INFO_2 *)malloc(sizeof(DRIVER_INFO_2))) == NULL)
+	if((info=SMB_MALLOC_P(DRIVER_INFO_2)) == NULL)
 		return WERR_NOMEM;
 	
 	status=construct_printer_driver_info_2(info, snum, servername, architecture, version);
@@ -6434,7 +6434,7 @@ static WERROR enumjobs_level1(print_queue_struct *queue, int snum,
 	JOB_INFO_1 *info;
 	int i;
 	
-	info=(JOB_INFO_1 *)malloc(*returned*sizeof(JOB_INFO_1));
+	info=SMB_MALLOC_ARRAY(JOB_INFO_1,*returned);
 	if (info==NULL) {
 		SAFE_FREE(queue);
 		*returned=0;
@@ -6484,7 +6484,7 @@ static WERROR enumjobs_level2(print_queue_struct *queue, int snum,
 	WERROR result;
 	DEVICEMODE *devmode = NULL;
 	
-	info=(JOB_INFO_2 *)malloc(*returned*sizeof(JOB_INFO_2));
+	info=SMB_MALLOC_ARRAY(JOB_INFO_2,*returned);
 	if (info==NULL) {
 		*returned=0;
 		result = WERR_NOMEM;
@@ -6676,7 +6676,7 @@ static WERROR enumprinterdrivers_level1(fstring servername, fstring architecture
 			return WERR_NOMEM;
 
 		if(ndrivers != 0) {
-			if((tdi1=(DRIVER_INFO_1 *)Realloc(driver_info_1, (*returned+ndrivers) * sizeof(DRIVER_INFO_1))) == NULL) {
+			if((tdi1=SMB_REALLOC_ARRAY(driver_info_1, DRIVER_INFO_1, *returned+ndrivers )) == NULL) {
 				DEBUG(0,("enumprinterdrivers_level1: failed to enlarge driver info buffer!\n"));
 				SAFE_FREE(driver_info_1);
 				SAFE_FREE(list);
@@ -6755,7 +6755,7 @@ static WERROR enumprinterdrivers_level2(fstring servername, fstring architecture
 			return WERR_NOMEM;
 
 		if(ndrivers != 0) {
-			if((tdi2=(DRIVER_INFO_2 *)Realloc(driver_info_2, (*returned+ndrivers) * sizeof(DRIVER_INFO_2))) == NULL) {
+			if((tdi2=SMB_REALLOC_ARRAY(driver_info_2, DRIVER_INFO_2, *returned+ndrivers )) == NULL) {
 				DEBUG(0,("enumprinterdrivers_level2: failed to enlarge driver info buffer!\n"));
 				SAFE_FREE(driver_info_2);
 				SAFE_FREE(list);
@@ -6835,7 +6835,7 @@ static WERROR enumprinterdrivers_level3(fstring servername, fstring architecture
 			return WERR_NOMEM;
 
 		if(ndrivers != 0) {
-			if((tdi3=(DRIVER_INFO_3 *)Realloc(driver_info_3, (*returned+ndrivers) * sizeof(DRIVER_INFO_3))) == NULL) {
+			if((tdi3=SMB_REALLOC_ARRAY(driver_info_3, DRIVER_INFO_3, *returned+ndrivers )) == NULL) {
 				DEBUG(0,("enumprinterdrivers_level3: failed to enlarge driver info buffer!\n"));
 				SAFE_FREE(driver_info_3);
 				SAFE_FREE(list);
@@ -6988,7 +6988,7 @@ WERROR _spoolss_enumforms(pipes_struct *p, SPOOL_Q_ENUMFORMS *q_u, SPOOL_R_ENUMF
 
 	switch (level) {
 	case 1:
-		if ((forms_1=(FORM_1 *)malloc(*numofforms * sizeof(FORM_1))) == NULL) {
+		if ((forms_1=SMB_MALLOC_ARRAY(FORM_1, *numofforms)) == NULL) {
 			*numofforms=0;
 			return WERR_NOMEM;
 		}
@@ -7192,7 +7192,7 @@ static WERROR enumports_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *need
 		close(fd);
 
 		if(numlines) {
-			if((ports=(PORT_INFO_1 *)malloc( numlines * sizeof(PORT_INFO_1) )) == NULL) {
+			if((ports=SMB_MALLOC_ARRAY( PORT_INFO_1, numlines )) == NULL) {
 				DEBUG(10,("Returning WERR_NOMEM [%s]\n", 
 					  dos_errstr(WERR_NOMEM)));
 				file_lines_free(qlines);
@@ -7212,7 +7212,7 @@ static WERROR enumports_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *need
 	} else {
 		*returned = 1; /* Sole Samba port returned. */
 
-		if((ports=(PORT_INFO_1 *)malloc( sizeof(PORT_INFO_1) )) == NULL)
+		if((ports=SMB_MALLOC_P(PORT_INFO_1)) == NULL)
 			return WERR_NOMEM;
 	
 		DEBUG(10,("enumports_level_1: port name %s\n", SAMBA_PRINTER_PORT_NAME));
@@ -7291,7 +7291,7 @@ static WERROR enumports_level_2(NEW_BUFFER *buffer, uint32 offered, uint32 *need
 		close(fd);
 
 		if(numlines) {
-			if((ports=(PORT_INFO_2 *)malloc( numlines * sizeof(PORT_INFO_2) )) == NULL) {
+			if((ports=SMB_MALLOC_ARRAY( PORT_INFO_2, numlines)) == NULL) {
 				file_lines_free(qlines);
 				return WERR_NOMEM;
 			}
@@ -7310,7 +7310,7 @@ static WERROR enumports_level_2(NEW_BUFFER *buffer, uint32 offered, uint32 *need
 
 		*returned = 1;
 
-		if((ports=(PORT_INFO_2 *)malloc( sizeof(PORT_INFO_2) )) == NULL)
+		if((ports=SMB_MALLOC_P(PORT_INFO_2)) == NULL)
 			return WERR_NOMEM;
 	
 		DEBUG(10,("enumports_level_2: port name %s\n", SAMBA_PRINTER_PORT_NAME));
@@ -7390,7 +7390,7 @@ static WERROR spoolss_addprinterex_level_2( pipes_struct *p, const UNISTR2 *uni_
 	int	snum;
 	WERROR err = WERR_OK;
 
-	if ((printer = (NT_PRINTER_INFO_LEVEL *)malloc(sizeof(NT_PRINTER_INFO_LEVEL))) == NULL) {
+	if ((printer = SMB_MALLOC_P(NT_PRINTER_INFO_LEVEL)) == NULL) {
 		DEBUG(0,("spoolss_addprinterex_level_2: malloc fail.\n"));
 		return WERR_NOMEM;
 	}
@@ -7719,7 +7719,7 @@ static WERROR getprinterdriverdir_level_1(UNISTR2 *name, UNISTR2 *uni_environmen
 	if (!(short_archi = get_short_archi(long_archi)))
 		return WERR_INVALID_ENVIRONMENT;
 
-	if((info=(DRIVER_DIRECTORY_1 *)malloc(sizeof(DRIVER_DIRECTORY_1))) == NULL)
+	if((info=SMB_MALLOC_P(DRIVER_DIRECTORY_1)) == NULL)
 		return WERR_NOMEM;
 
 	slprintf(path, sizeof(path)-1, "\\\\%s\\print$\\%s", pservername, short_archi);
@@ -7887,7 +7887,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 
 		*out_max_value_len=(in_value_len/sizeof(uint16));
 		
-		if((*out_value=(uint16 *)talloc_zero(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL)
+		if((*out_value=(uint16 *)TALLOC_ZERO(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL)
 		{
 			result = WERR_NOMEM;
 			goto done;
@@ -7902,7 +7902,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 		
 		/* only allocate when given a non-zero data_len */
 		
-		if ( in_data_len && ((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) )
+		if ( in_data_len && ((*data_out=(uint8 *)TALLOC_ZERO(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) )
 		{
 			result = WERR_NOMEM;
 			goto done;
@@ -7923,7 +7923,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 	
 		/* name */
 		*out_max_value_len=(in_value_len/sizeof(uint16));
-		if ( (*out_value = (uint16 *)talloc_zero(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL ) 
+		if ( (*out_value = (uint16 *)TALLOC_ZERO(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL ) 
 		{
 			result = WERR_NOMEM;
 			goto done;
@@ -7938,7 +7938,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 		/* data - counted in bytes */
 
 		*out_max_data_len = in_data_len;
-		if ( (*data_out = (uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) 
+		if ( (*data_out = (uint8 *)TALLOC_ZERO(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) 
 		{
 			result = WERR_NOMEM;
 			goto done;
@@ -8323,7 +8323,7 @@ static WERROR enumprintprocessors_level_1(NEW_BUFFER *buffer, uint32 offered, ui
 {
 	PRINTPROCESSOR_1 *info_1=NULL;
 	
-	if((info_1 = (PRINTPROCESSOR_1 *)malloc(sizeof(PRINTPROCESSOR_1))) == NULL)
+	if((info_1 = SMB_MALLOC_P(PRINTPROCESSOR_1)) == NULL)
 		return WERR_NOMEM;
 
 	(*returned) = 0x1;
@@ -8390,7 +8390,7 @@ static WERROR enumprintprocdatatypes_level_1(NEW_BUFFER *buffer, uint32 offered,
 {
 	PRINTPROCDATATYPE_1 *info_1=NULL;
 	
-	if((info_1 = (PRINTPROCDATATYPE_1 *)malloc(sizeof(PRINTPROCDATATYPE_1))) == NULL)
+	if((info_1 = SMB_MALLOC_P(PRINTPROCDATATYPE_1)) == NULL)
 		return WERR_NOMEM;
 
 	(*returned) = 0x1;
@@ -8450,7 +8450,7 @@ static WERROR enumprintmonitors_level_1(NEW_BUFFER *buffer, uint32 offered, uint
 {
 	PRINTMONITOR_1 *info_1=NULL;
 	
-	if((info_1 = (PRINTMONITOR_1 *)malloc(sizeof(PRINTMONITOR_1))) == NULL)
+	if((info_1 = SMB_MALLOC_P(PRINTMONITOR_1)) == NULL)
 		return WERR_NOMEM;
 
 	(*returned) = 0x1;
@@ -8482,7 +8482,7 @@ static WERROR enumprintmonitors_level_2(NEW_BUFFER *buffer, uint32 offered, uint
 {
 	PRINTMONITOR_2 *info_2=NULL;
 	
-	if((info_2 = (PRINTMONITOR_2 *)malloc(sizeof(PRINTMONITOR_2))) == NULL)
+	if((info_2 = SMB_MALLOC_P(PRINTMONITOR_2)) == NULL)
 		return WERR_NOMEM;
 
 	(*returned) = 0x1;
@@ -8557,7 +8557,7 @@ static WERROR getjob_level_1(print_queue_struct **queue, int count, int snum,
 	BOOL found=False;
 	JOB_INFO_1 *info_1=NULL;
 
-	info_1=(JOB_INFO_1 *)malloc(sizeof(JOB_INFO_1));
+	info_1=SMB_MALLOC_P(JOB_INFO_1);
 
 	if (info_1 == NULL) {
 		return WERR_NOMEM;
@@ -8608,7 +8608,7 @@ static WERROR getjob_level_2(print_queue_struct **queue, int count, int snum,
 	DEVICEMODE 	*devmode = NULL;
 	NT_DEVICEMODE	*nt_devmode = NULL;
 
-	info_2=(JOB_INFO_2 *)malloc(sizeof(JOB_INFO_2));
+	info_2=SMB_MALLOC_P(JOB_INFO_2);
 
 	ZERO_STRUCTP(info_2);
 
@@ -8640,7 +8640,7 @@ static WERROR getjob_level_2(print_queue_struct **queue, int count, int snum,
 	if ( !(nt_devmode=print_job_devmode( lp_const_servicename(snum), jobid )) )
 		devmode = construct_dev_mode(snum);
 	else {
-		if ((devmode = (DEVICEMODE *)malloc(sizeof(DEVICEMODE))) != NULL) {
+		if ((devmode = SMB_MALLOC_P(DEVICEMODE)) != NULL) {
 			ZERO_STRUCTP( devmode );
 			convert_nt_devicemode( devmode, nt_devmode );
 		}
@@ -8818,7 +8818,7 @@ done:
 		
 		if ( *out_size ) 
 		{
-			if( (*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL ) {
+			if( (*data=(uint8 *)TALLOC_ZERO(p->mem_ctx, *out_size*sizeof(uint8))) == NULL ) {
 				status = WERR_NOMEM;
 				goto done;
 			}
@@ -9177,7 +9177,7 @@ WERROR _spoolss_enumprinterdataex(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATAEX *q_
 	num_entries = regval_ctr_numvals( &p_data->keys[key_index].values );
 	if ( num_entries )
 	{
-		if ( (enum_values=talloc(p->mem_ctx, num_entries*sizeof(PRINTER_ENUM_VALUES))) == NULL )
+		if ( (enum_values=TALLOC_ARRAY(p->mem_ctx, PRINTER_ENUM_VALUES, num_entries)) == NULL )
 		{
 			DEBUG(0,("_spoolss_enumprinterdataex: talloc() failed to allocate memory for [%lu] bytes!\n",
 				(unsigned long)num_entries*sizeof(PRINTER_ENUM_VALUES)));
@@ -9209,7 +9209,7 @@ WERROR _spoolss_enumprinterdataex(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATAEX *q_
 		
 		data_len = regval_size( val );
 		if ( data_len ) {
-			if ( !(enum_values[i].data = talloc_memdup(p->mem_ctx, regval_data_p(val), data_len)) ) 
+			if ( !(enum_values[i].data = TALLOC_MEMDUP(p->mem_ctx, regval_data_p(val), data_len)) ) 
 			{
 				DEBUG(0,("talloc_memdup failed to allocate memory [data_len=%d] for data!\n", 
 					data_len ));
@@ -9272,7 +9272,7 @@ static WERROR getprintprocessordirectory_level_1(UNISTR2 *name,
 	if (!get_short_archi(long_archi))
 		return WERR_INVALID_ENVIRONMENT;
 
-	if((info=(PRINTPROCESSOR_DIRECTORY_1 *)malloc(sizeof(PRINTPROCESSOR_DIRECTORY_1))) == NULL)
+	if((info=SMB_MALLOC_P(PRINTPROCESSOR_DIRECTORY_1)) == NULL)
 		return WERR_NOMEM;
 
 	pstrcpy(path, "C:\\WINNT\\System32\\spool\\PRTPROCS\\W32X86");
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index 9837ea2a97..af4c94800a 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -522,10 +522,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 	switch (info_level) {
 	case 0:
 	{
-		SRV_SHARE_INFO_0 *info0;
+		SRV_SHARE_INFO_0 *info0 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_0, num_entries);
 		int i = 0;
 
-		info0 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_0));
+		if (!info0) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -540,10 +542,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 1:
 	{
-		SRV_SHARE_INFO_1 *info1;
+		SRV_SHARE_INFO_1 *info1 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1, num_entries);
 		int i = 0;
 
-		info1 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1));
+		if (!info1) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -557,10 +561,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 2:
 	{
-		SRV_SHARE_INFO_2 *info2;
+		SRV_SHARE_INFO_2 *info2 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_2, num_entries);
 		int i = 0;
 
-		info2 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_2));
+		if (!info2) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -574,10 +580,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 501:
 	{
-		SRV_SHARE_INFO_501 *info501;
+		SRV_SHARE_INFO_501 *info501 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_501, num_entries);
 		int i = 0;
 	
-		info501 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_501));
+		if (!info501) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -591,10 +599,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 502:
 	{
-		SRV_SHARE_INFO_502 *info502;
+		SRV_SHARE_INFO_502 *info502 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_502, num_entries);
 		int i = 0;
 
-		info502 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_502));
+		if (!info502) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -610,10 +620,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 	
 	case 1004:
 	{
-		SRV_SHARE_INFO_1004 *info1004;
+		SRV_SHARE_INFO_1004 *info1004 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1004, num_entries);
 		int i = 0;
 
-		info1004 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1004));
+		if (!info1004) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -627,10 +639,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 1005:
 	{
-		SRV_SHARE_INFO_1005 *info1005;
+		SRV_SHARE_INFO_1005 *info1005 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1005, num_entries);
 		int i = 0;
 
-		info1005 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1005));
+		if (!info1005) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -644,10 +658,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 1006:
 	{
-		SRV_SHARE_INFO_1006 *info1006;
+		SRV_SHARE_INFO_1006 *info1006 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1006, num_entries);
 		int i = 0;
 
-		info1006 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1006));
+		if (!info1006) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -661,10 +677,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 1007:
 	{
-		SRV_SHARE_INFO_1007 *info1007;
+		SRV_SHARE_INFO_1007 *info1007 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1007, num_entries);
 		int i = 0;
 
-		info1007 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1007));
+		if (!info1007) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -678,10 +696,12 @@ static BOOL init_srv_share_info_ctr(pipes_struct *p, SRV_SHARE_INFO_CTR *ctr,
 
 	case 1501:
 	{
-		SRV_SHARE_INFO_1501 *info1501;
+		SRV_SHARE_INFO_1501 *info1501 = TALLOC_ARRAY(ctx, SRV_SHARE_INFO_1501, num_entries);
 		int i = 0;
 
-		info1501 = talloc(ctx, num_entries * sizeof(SRV_SHARE_INFO_1501));
+		if (!info1501) {
+			return False;
+		}
 
 		for (snum = *resume_hnd; snum < num_services; snum++) {
 			if (lp_browseable(snum) && lp_snum_ok(snum) && (all_shares || !is_hidden_share(snum)) ) {
@@ -1132,8 +1152,7 @@ static WERROR init_srv_file_info_ctr(pipes_struct *p, SRV_FILE_INFO_CTR *ctr,
 		int i;
 		if (*total_entries > 0) {
 			ctr->ptr_entries = 1;
-			ctr->file.info3 = talloc(ctx, ctr->num_entries * 
-						 sizeof(SRV_FILE_INFO_3));
+			ctr->file.info3 = TALLOC_ARRAY(ctx, SRV_FILE_INFO_3, ctr->num_entries);
 		}
 		for (i=0 ;i<ctr->num_entries;i++) {
 			init_srv_file_info3(&ctr->file.info3[i].info_3, i+*resume_hnd, 0x35, 0, "\\PIPE\\samr", "dummy user");
@@ -1184,7 +1203,7 @@ net server get info
 WERROR _srv_net_srv_get_info(pipes_struct *p, SRV_Q_NET_SRV_GET_INFO *q_u, SRV_R_NET_SRV_GET_INFO *r_u)
 {
 	WERROR status = WERR_OK;
-	SRV_INFO_CTR *ctr = (SRV_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_INFO_CTR));
+	SRV_INFO_CTR *ctr = TALLOC_P(p->mem_ctx, SRV_INFO_CTR);
 
 	if (!ctr)
 		return WERR_NOMEM;
@@ -1287,7 +1306,7 @@ WERROR _srv_net_conn_enum(pipes_struct *p, SRV_Q_NET_CONN_ENUM *q_u, SRV_R_NET_C
 {
 	DEBUG(5,("srv_net_conn_enum: %d\n", __LINE__));
 
-	r_u->ctr = (SRV_CONN_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_CONN_INFO_CTR));
+	r_u->ctr = TALLOC_P(p->mem_ctx, SRV_CONN_INFO_CTR);
 	if (!r_u->ctr)
 		return WERR_NOMEM;
 
@@ -1312,7 +1331,7 @@ WERROR _srv_net_sess_enum(pipes_struct *p, SRV_Q_NET_SESS_ENUM *q_u, SRV_R_NET_S
 {
 	DEBUG(5,("_srv_net_sess_enum: %d\n", __LINE__));
 
-	r_u->ctr = (SRV_SESS_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_SESS_INFO_CTR));
+	r_u->ctr = TALLOC_P(p->mem_ctx, SRV_SESS_INFO_CTR);
 	if (!r_u->ctr)
 		return WERR_NOMEM;
 
@@ -1795,7 +1814,7 @@ WERROR _srv_net_remote_tod(pipes_struct *p, SRV_Q_NET_REMOTE_TOD *q_u, SRV_R_NET
 	struct tm *t;
 	time_t unixdate = time(NULL);
 
-	tod = (TIME_OF_DAY_INFO *)talloc(p->mem_ctx, sizeof(TIME_OF_DAY_INFO));
+	tod = TALLOC_P(p->mem_ctx, TIME_OF_DAY_INFO);
 	if (!tod)
 		return WERR_NOMEM;
 
@@ -2114,16 +2133,8 @@ WERROR _srv_net_disk_enum(pipes_struct *p, SRV_Q_NET_DISK_ENUM *q_u, SRV_R_NET_D
 
 	r_u->disk_enum_ctr.unknown = 0; 
 
-	{
-		DISK_INFO *dinfo;
-
-		int dinfo_size = MAX_SERVER_DISK_ENTRIES * sizeof(*dinfo);
-	  
-		if(!(dinfo =  talloc(ctx, dinfo_size))) {
-			return WERR_NOMEM;
-		}
-
-		r_u->disk_enum_ctr.disk_info = dinfo;
+	if(!(r_u->disk_enum_ctr.disk_info =  TALLOC_ARRAY(ctx, DISK_INFO, MAX_SERVER_DISK_ENTRIES))) {
+		return WERR_NOMEM;
 	}
 
 	r_u->disk_enum_ctr.disk_info_ptr = r_u->disk_enum_ctr.disk_info ? 1 : 0;
diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c
index 2689d89972..802e7673a4 100644
--- a/source3/rpc_server/srv_util.c
+++ b/source3/rpc_server/srv_util.c
@@ -90,7 +90,7 @@ NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
 	DOM_GID *gids;
 	int i;
 
-	gids = (DOM_GID *)talloc(mem_ctx, sizeof(*gids) * nt_token->num_sids);
+	gids = TALLOC_ARRAY(mem_ctx, DOM_GID, nt_token->num_sids);
 
 	if (!gids) {
 		return NT_STATUS_NO_MEMORY;
diff --git a/source3/rpc_server/srv_wkssvc_nt.c b/source3/rpc_server/srv_wkssvc_nt.c
index 25fa029237..6528e63225 100644
--- a/source3/rpc_server/srv_wkssvc_nt.c
+++ b/source3/rpc_server/srv_wkssvc_nt.c
@@ -65,7 +65,7 @@ NTSTATUS _wks_query_info(pipes_struct *p, WKS_Q_QUERY_INFO *q_u, WKS_R_QUERY_INF
 
 	DEBUG(5,("_wks_query_info: %d\n", __LINE__));
 
-	wks100 = (WKS_INFO_100 *)talloc_zero(p->mem_ctx, sizeof(WKS_INFO_100));
+	wks100 = TALLOC_ZERO_P(p->mem_ctx, WKS_INFO_100);
 
 	if (!wks100)
 		return NT_STATUS_NO_MEMORY;