r874: This patch is a pile of work on NTLMSSP:

Samba's NTLMSSP code is now fully talloc based, which should go a long
way to cleaning up the memory leaks in this code.  This also avoids a
lot of extra copies of data, as we now allocate the 'return' blobs on
a caller-supplied context.

I have also been doing a lot of work towards NTLM2 signing and
sealing.  I have this working for sealing, but not for the verifier
(MD5 integrity check on the stream) which is still incorrect.

(I can aim a rpcecho sinkdata from a Win2k3 box to my server, and the
data arrives intact, but the signature check fails.  It does however
match the test values I have...).

The new torture test is cludged in - when we get a unit test suite
back, I'll happliy put it in the 'right' place....

Andrew Bartlett
(This used to be commit 399e2e2b1149b8d1c070aa7f0d5131c0b577d2b9)

1 files changed, 19 insertions, 13 deletions

diff --git a/source4/libcli/auth/ntlmssp_parse.c b/source4/libcli/auth/ntlmssp_parse.c
index 4b3043aec8..6ddaeebb06 100644
--- a/source4/libcli/auth/ntlmssp_parse.c
+++ b/source4/libcli/auth/ntlmssp_parse.c
@@ -40,7 +40,7 @@
   d = word (4 bytes)
   C = constant ascii string
  */
-BOOL msrpc_gen(DATA_BLOB *blob,
+BOOL msrpc_gen(TALLOC_CTX *mem_ctx, DATA_BLOB *blob,
 	       const char *format, ...)
 {
 	int i, n;
@@ -91,7 +91,7 @@ BOOL msrpc_gen(DATA_BLOB *blob,
 	va_end(ap);
 
 	/* allocate the space, then scan the format again to fill in the values */
-	*blob = data_blob(NULL, head_size + data_size);
+	*blob = data_blob_talloc(mem_ctx, NULL, head_size + data_size);
 
 	head_ofs = 0;
 	data_ofs = head_size;
@@ -182,12 +182,12 @@ if ((head_ofs + amount) > blob->length) { \
   C = constant ascii string
  */
 
-BOOL msrpc_parse(const DATA_BLOB *blob,
+BOOL msrpc_parse(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob,
 		 const char *format, ...)
 {
 	int i;
 	va_list ap;
-	char **ps, *s;
+	const char **ps, *s;
 	DATA_BLOB *b;
 	size_t head_ofs = 0;
 	uint16 len1, len2;
@@ -206,7 +206,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 
 			ps = va_arg(ap, char **);
 			if (len1 == 0 && len2 == 0) {
-				*ps = smb_xstrdup("");
+				*ps = "";
 			} else {
 				/* make sure its in the right format - be strict */
 				if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
@@ -223,9 +223,12 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 					pull_string(NULL, p, blob->data + ptr, sizeof(p), 
 						    len1, 
 						    STR_UNICODE|STR_NOALIGN);
-					(*ps) = smb_xstrdup(p);
+					(*ps) = talloc_strdup(mem_ctx, p);
+					if (!(*ps)) {
+						return False;
+					}
 				} else {
-					(*ps) = smb_xstrdup("");
+					(*ps) = "";
 				}
 			}
 			break;
@@ -238,7 +241,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 			ps = va_arg(ap, char **);
 			/* make sure its in the right format - be strict */
 			if (len1 == 0 && len2 == 0) {
-				*ps = smb_xstrdup("");
+				*ps = "";
 			} else {
 				if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
 					return False;
@@ -251,9 +254,12 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 					pull_string(NULL, p, blob->data + ptr, sizeof(p), 
 						    len1, 
 						    STR_ASCII|STR_NOALIGN);
-					(*ps) = smb_xstrdup(p);
+					(*ps) = talloc_strdup(mem_ctx, p);
+					if (!(*ps)) {
+						return False;
+					}
 				} else {
-					(*ps) = smb_xstrdup("");
+					(*ps) = "";
 				}
 			}
 			break;
@@ -265,7 +271,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 
 			b = (DATA_BLOB *)va_arg(ap, void *);
 			if (len1 == 0 && len2 == 0) {
-				*b = data_blob(NULL, 0);
+				*b = data_blob_talloc(mem_ctx, NULL, 0);
 			} else {
 				/* make sure its in the right format - be strict */
 				if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
@@ -275,7 +281,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 				if (blob->data + ptr < (uint8 *)ptr || blob->data + ptr < blob->data)
 					return False;	
 			
-				*b = data_blob(blob->data + ptr, len1);
+				*b = data_blob_talloc(mem_ctx, blob->data + ptr, len1);
 			}
 			break;
 		case 'b':
@@ -286,7 +292,7 @@ BOOL msrpc_parse(const DATA_BLOB *blob,
 			if (blob->data + head_ofs < (uint8 *)head_ofs || blob->data + head_ofs < blob->data)
 				return False;	
 			
-			*b = data_blob(blob->data + head_ofs, len1);
+			*b = data_blob_talloc(mem_ctx, blob->data + head_ofs, len1);
 			head_ofs += len1;
 			break;
 		case 'd':