Allow STR_TERMINATE and -1 src_len for pull_ucs2_base_talloc().

Jeremy.
(This used to be commit 063358d87ac9a1d948c8d4b6358e926dd14bb3ac)

2 files changed, 40 insertions, 15 deletions

diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
index 0dfa88e87e..9592bbc287 100644
--- a/source3/lib/charcnv.c
+++ b/source3/lib/charcnv.c
@@ -592,7 +592,7 @@ size_t convert_string_allocate(TALLOC_CTX *ctx, charset_t from, charset_t to,
 					goto use_as_is;
 				break;
 			case E2BIG:
-				goto convert;		
+				goto convert;
 			case EILSEQ:
 				reason="Illegal multibyte sequence";
 				if (!conv_silent)
@@ -1503,6 +1503,12 @@ size_t pull_ucs2_base_talloc(TALLOC_CTX *ctx,
 			if (len < src_len/2)
 				len++;
 			src_len = len*2;
+		} else {
+			/*
+			 * src_len == -1 - alloc interface won't take this
+			 * so we must calculate.
+			 */
+			src_len = (strlen_w((const smb_ucs2_t *)src)+1)*sizeof(smb_ucs2_t);
 		}
 		/* Ensure we don't use an insane length from the client. */
 		if (src_len >= 1024*1024) {
diff --git a/source3/utils/net_rpc_registry.c b/source3/utils/net_rpc_registry.c
index a6d29946cd..2d335942a2 100644
--- a/source3/utils/net_rpc_registry.c
+++ b/source3/utils/net_rpc_registry.c
@@ -759,7 +759,7 @@ static int rpc_registry_save( int argc, const char **argv )
 static void dump_values( REGF_NK_REC *nk )
 {
 	int i, j;
-	pstring data_str;
+	char *data_str = NULL;
 	uint32 data_size, data;
 
 	if ( !nk->values )
@@ -772,7 +772,14 @@ static void dump_values( REGF_NK_REC *nk )
 		data_size = nk->values[i].data_size & ~VK_DATA_IN_OFFSET;
 		switch ( nk->values[i].type ) {
 			case REG_SZ:
-				rpcstr_pull( data_str, nk->values[i].data, sizeof(data_str), -1, STR_TERMINATE );
+				rpcstr_pull_talloc(talloc_tos(),
+						&data_str,
+						nk->values[i].data,
+						-1,
+						STR_TERMINATE);
+				if (!data_str) {
+					break;
+				}
 				d_printf( "%s", data_str );
 				break;
 			case REG_MULTI_SZ:
@@ -806,16 +813,19 @@ static void dump_values( REGF_NK_REC *nk )
 static bool dump_registry_tree( REGF_FILE *file, REGF_NK_REC *nk, const char *parent )
 {
 	REGF_NK_REC *key;
-	pstring regpath;
 
 	/* depth first dump of the registry tree */
 
 	while ( (key = regfio_fetch_subkey( file, nk )) ) {
-		pstr_sprintf( regpath, "%s\\%s", parent, key->keyname );
+		char *regpath;
+		if (asprintf(&regpath, "%s\\%s", parent, key->keyname) < 0) {
+			break;
+		}
 		d_printf("[%s]\n", regpath );
 		dump_values( key );
 		d_printf("\n");
 		dump_registry_tree( file, key, regpath );
+		SAFE_FREE(regpath);
 	}
 
 	return True;
@@ -829,10 +839,10 @@ static bool write_registry_tree( REGF_FILE *infile, REGF_NK_REC *nk,
 			         const char *parentpath )
 {
 	REGF_NK_REC *key, *subkey;
-	REGVAL_CTR *values;
-	REGSUBKEY_CTR *subkeys;
+	REGVAL_CTR *values = NULL;
+	REGSUBKEY_CTR *subkeys = NULL;
 	int i;
-	pstring path;
+	char *path = NULL;
 
 	if ( !( subkeys = TALLOC_ZERO_P( infile->mem_ctx, REGSUBKEY_CTR )) ) {
 		DEBUG(0,("write_registry_tree: talloc() failed!\n"));
@@ -841,36 +851,45 @@ static bool write_registry_tree( REGF_FILE *infile, REGF_NK_REC *nk,
 
 	if ( !(values = TALLOC_ZERO_P( subkeys, REGVAL_CTR )) ) {
 		DEBUG(0,("write_registry_tree: talloc() failed!\n"));
+		TALLOC_FREE(subkeys);
 		return False;
 	}
 
 	/* copy values into the REGVAL_CTR */
-	
+
 	for ( i=0; i<nk->num_values; i++ ) {
 		regval_ctr_addvalue( values, nk->values[i].valuename, nk->values[i].type,
 			(const char *)nk->values[i].data, (nk->values[i].data_size & ~VK_DATA_IN_OFFSET) );
 	}
 
 	/* copy subkeys into the REGSUBKEY_CTR */
-	
+
 	while ( (subkey = regfio_fetch_subkey( infile, nk )) ) {
 		regsubkey_ctr_addkey( subkeys, subkey->keyname );
 	}
-	
+
 	key = regfio_write_key( outfile, nk->keyname, values, subkeys, nk->sec_desc->sec_desc, parent );
 
 	/* write each one of the subkeys out */
 
-	pstr_sprintf( path, "%s%s%s", parentpath, parent ? "\\" : "", nk->keyname );
+	path = talloc_asprintf(subkeys,
+			"%s%s%s",
+			parentpath,
+			parent ? "\\" : "",
+			nk->keyname);
+	if (!path) {
+		TALLOC_FREE(subkeys);
+		return false;
+	}
+
 	nk->subkey_index = 0;
 	while ( (subkey = regfio_fetch_subkey( infile, nk )) ) {
 		write_registry_tree( infile, subkey, key, outfile, path );
 	}
 
-	TALLOC_FREE( subkeys );
-
 	d_printf("[%s]\n", path );
-	
+	TALLOC_FREE(subkeys);
+
 	return True;
 }