dynamic mem allocation in net_srv_transport_enum() parsing.

(This used to be commit 6b919ebb4ed8c0082d8bffb299766bff9e718faf)

4 files changed, 69 insertions, 9 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index d6b7abba95..3b318b437d 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -619,6 +619,9 @@ char *uni_strncpy(char *destbuf, const char *srcbuf, int len);
 uint32 buffer2_to_uint32(const BUFFER2 *str);
 void buffer2_to_multistr(char *dest, const BUFFER2 *str, size_t maxlen);
 void buffer4_to_str(char *dest, const BUFFER4 *str, size_t maxlen);
+BOOL copy_unistr2(UNISTR2 *str, const UNISTR2 *from);
+UNISTR2 *unistr2_dup(const UNISTR2 *name);
+void unistr2_free(UNISTR2 *name);
 
 /*The following definitions come from  libsmb/clientgen.c  */
 
@@ -2220,9 +2223,6 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth);
 BOOL make_buffer2(BUFFER2 *str, const char *buf, int len);
 BOOL smb_io_buffer2(char *desc,  BUFFER2 *buf2, uint32 buffer, prs_struct *ps, int depth);
 BOOL make_buf_unistr2(UNISTR2 *str, uint32 *ptr, char *buf);
-BOOL copy_unistr2(UNISTR2 *str, const UNISTR2 *from);
-UNISTR2 *unistr2_dup(const UNISTR2 *name);
-void unistr2_free(UNISTR2 *name);
 BOOL make_string2(STRING2 *str, char *buf, int len);
 BOOL smb_io_string2(char *desc,  STRING2 *str2, uint32 buffer, prs_struct *ps, int depth);
 BOOL make_unistr2(UNISTR2 *str, const char *buf, int len);
@@ -3031,6 +3031,8 @@ BOOL make_srv_tprt_info0(TPRT_INFO_0 *tp0,
 				uint32 num_vcs, uint32 trans_addr_len,
 				char *trans_name, char *trans_addr,
 				char *addr_name);
+void free_srv_tprt_info_0(SRV_TPRT_INFO_0 *tp0);
+void free_srv_tprt_ctr(SRV_TPRT_INFO_CTR *ctr);
 BOOL make_srv_q_net_tprt_enum(SRV_Q_NET_TPRT_ENUM *q_n, 
 				char *srv_name, 
 				uint32 tprt_level, SRV_TPRT_INFO_CTR *ctr,
diff --git a/source3/include/rpc_srvsvc.h b/source3/include/rpc_srvsvc.h
index b875f2a2d6..0472f6c546 100644
--- a/source3/include/rpc_srvsvc.h
+++ b/source3/include/rpc_srvsvc.h
@@ -282,8 +282,8 @@ typedef struct srv_tprt_info_0_info
 	uint32 ptr_tprt_info;                        /* Buffer */
 	uint32 num_entries_read2;                    /* EntriesRead */
 
-	TPRT_INFO_0     info_0    [MAX_TPRT_ENTRIES]; /* transport entry pointers */
-	TPRT_INFO_0_STR info_0_str[MAX_TPRT_ENTRIES]; /* transport entry strings */
+	TPRT_INFO_0     *info_0; /* transport entry pointers */
+	TPRT_INFO_0_STR *info_0_str; /* transport entry strings */
 
 } SRV_TPRT_INFO_0;
 
diff --git a/source3/rpc_parse/parse_srv.c b/source3/rpc_parse/parse_srv.c
index c27f58ac26..c0530f8987 100644
--- a/source3/rpc_parse/parse_srv.c
+++ b/source3/rpc_parse/parse_srv.c
@@ -1207,13 +1207,25 @@ static BOOL srv_io_srv_tprt_info_0(char *desc,  SRV_TPRT_INFO_0 *tp0, prs_struct
 	{
 		uint32 i;
 		uint32 num_entries = tp0->num_entries_read;
-		if (num_entries > MAX_TPRT_ENTRIES)
-		{
-			num_entries = MAX_TPRT_ENTRIES; /* report this! */
-		}
 
 		prs_uint32("num_entries_read2", ps, depth, &(tp0->num_entries_read2));
 
+		if (ps->io)
+		{
+			/* reading */
+			tp0->info_0 = (TPRT_INFO_0*)malloc(num_entries *
+			              sizeof(tp0->info_0[0]));
+
+			tp0->info_0_str = (TPRT_INFO_0_STR*)malloc(num_entries *
+			              sizeof(tp0->info_0_str[0]));
+
+			if (tp0->info_0 == NULL || tp0->info_0_str == NULL)
+			{
+				free_srv_tprt_info_0(tp0);
+				return False;
+			}
+		}
+
 		for (i = 0; i < num_entries; i++)
 		{
 			prs_grow(ps);
@@ -1231,10 +1243,33 @@ static BOOL srv_io_srv_tprt_info_0(char *desc,  SRV_TPRT_INFO_0 *tp0, prs_struct
 		prs_align(ps);
 	}
 
+	if (!ps->io)
+	{
+		/* writing */
+		free_srv_tprt_info_0(tp0);
+	}
+
 	return True;
 }
 
 /*******************************************************************
+frees a structure.
+********************************************************************/
+void free_srv_tprt_info_0(SRV_TPRT_INFO_0 *tp0)
+{
+	if (tp0->info_0 != NULL)
+	{
+		free(tp0->info_0);
+		tp0->info_0 = NULL;
+	}
+	if (tp0->info_0_str != NULL)
+	{
+		free(tp0->info_0_str);
+		tp0->info_0_str = NULL;
+	}
+}
+
+/*******************************************************************
 reads or writes a structure.
 ********************************************************************/
 static BOOL srv_io_srv_tprt_ctr(char *desc,  SRV_TPRT_INFO_CTR *ctr, prs_struct *ps, int depth)
@@ -1273,6 +1308,27 @@ static BOOL srv_io_srv_tprt_ctr(char *desc,  SRV_TPRT_INFO_CTR *ctr, prs_struct
 /*******************************************************************
 reads or writes a structure.
 ********************************************************************/
+void free_srv_tprt_ctr(SRV_TPRT_INFO_CTR *ctr)
+{
+	switch (ctr->switch_value)
+	{
+		case 0:
+		{
+			free_srv_tprt_info_0(&(ctr->tprt.info0));
+			break;
+		}
+		default:
+		{
+			DEBUG(5,("no transport info at switch_value %d\n",
+				 ctr->switch_value));
+			break;
+		}
+	}
+}
+
+/*******************************************************************
+reads or writes a structure.
+********************************************************************/
 BOOL make_srv_q_net_tprt_enum(SRV_Q_NET_TPRT_ENUM *q_n, 
 				char *srv_name, 
 				uint32 tprt_level, SRV_TPRT_INFO_CTR *ctr,
diff --git a/source3/rpcclient/cmd_srvsvc.c b/source3/rpcclient/cmd_srvsvc.c
index d6f4f33653..b856d2ff5c 100644
--- a/source3/rpcclient/cmd_srvsvc.c
+++ b/source3/rpcclient/cmd_srvsvc.c
@@ -161,6 +161,8 @@ void cmd_srv_enum_tprt(struct client_info *info)
 	{
 		DEBUG(5,("cmd_srv_enum_tprt: query failed\n"));
 	}
+
+	free_srv_tprt_ctr(&ctr);
 }
 
 /****************************************************************************