summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2009-02-19 14:16:44 +0100
committerVolker Lendecke <vl@samba.org>2009-02-19 14:26:50 +0100
commitd0ee90ace9e63fd83c997503a694e4c87f8a7e0f (patch)
tree71e18838c2fc6dfd6922c0849ee39bf7fa8277fa /source3
parent7d44cd50e8b420c6981ff93f42085ff664b686c5 (diff)
downloadsamba-d0ee90ace9e63fd83c997503a694e4c87f8a7e0f.tar.gz
samba-d0ee90ace9e63fd83c997503a694e4c87f8a7e0f.tar.bz2
samba-d0ee90ace9e63fd83c997503a694e4c87f8a7e0f.zip
Fix a buffer handling bug when adding lots of registry keys
This is *ancient*... From 2002, and nobody noticed until someone added lots of shares using net conf... :-)
Diffstat (limited to 'source3')
-rw-r--r--source3/registry/reg_backend_db.c33
1 files changed, 24 insertions, 9 deletions
diff --git a/source3/registry/reg_backend_db.c b/source3/registry/reg_backend_db.c
index a9bb7b1730..612b448cac 100644
--- a/source3/registry/reg_backend_db.c
+++ b/source3/registry/reg_backend_db.c
@@ -536,21 +536,36 @@ static bool regdb_store_keys_internal(const char *key, REGSUBKEY_CTR *ctr)
/* pack all the strings */
for (i=0; i<num_subkeys; i++) {
- len += tdb_pack(buffer+len, buflen-len, "f",
- regsubkey_ctr_specific_key(ctr, i));
- if (len > buflen) {
- /* allocate some extra space */
- buffer = (uint8 *)SMB_REALLOC(buffer, len*2);
+ size_t thistime;
+
+ thistime = tdb_pack(buffer+len, buflen-len, "f",
+ regsubkey_ctr_specific_key(ctr, i));
+ if (len+thistime > buflen) {
+ size_t thistime2;
+ /*
+ * tdb_pack hasn't done anything because of the short
+ * buffer, allocate extra space.
+ */
+ buffer = SMB_REALLOC_ARRAY(buffer, uint8_t,
+ (len+thistime)*2);
if(buffer == NULL) {
DEBUG(0, ("regdb_store_keys: Failed to realloc "
- "memory of size [%d]\n", len*2));
+ "memory of size [%d]\n",
+ (len+thistime)*2));
+ ret = false;
+ goto done;
+ }
+ buflen = (len+thistime)*2;
+ thistime2 = tdb_pack(
+ buffer+len, buflen-len, "f",
+ regsubkey_ctr_specific_key(ctr, i));
+ if (thistime2 != thistime) {
+ DEBUG(0, ("tdb_pack failed\n"));
ret = false;
goto done;
}
- buflen = len*2;
- len = tdb_pack(buffer+len, buflen-len, "f",
- regsubkey_ctr_specific_key(ctr, i));
}
+ len += thistime;
}
/* finally write out the data */