r9578: fixed an endless loop and memory leak in the QueryMultipleValues test

(This used to be commit ba909a64e92e9b2d2c8fd02fc9e9e0e7aa49dd0a)

1 files changed, 5 insertions, 3 deletions

diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index 404b90a1a9..bf183ee972 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -456,6 +456,7 @@ static BOOL test_QueryMultipleValues(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 {
 	struct winreg_QueryMultipleValues r;
 	NTSTATUS status;
+	uint32_t bufsize=0;
 
 	printf("Testing QueryMultipleValues\n");
 
@@ -469,9 +470,9 @@ static BOOL test_QueryMultipleValues(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 	r.in.num_values = 1;
 	r.in.buffer_size = r.out.buffer_size = talloc(mem_ctx, uint32_t);
-	*r.in.buffer_size = 0x00;
+	*r.in.buffer_size = bufsize;
 	do { 
-		*r.in.buffer_size += 0x20;
+		*r.in.buffer_size = bufsize;
 		r.in.buffer = r.out.buffer = talloc_zero_array(mem_ctx, uint8_t, 
 							       *r.in.buffer_size);
 
@@ -481,7 +482,8 @@ static BOOL test_QueryMultipleValues(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			printf("QueryMultipleValues failed - %s\n", nt_errstr(status));
 			return False;
 		}
-
+		talloc_free(r.in.buffer);
+		bufsize += 0x20;
 	} while (W_ERROR_EQUAL(r.out.result, WERR_MORE_DATA));
 
 	if (!W_ERROR_IS_OK(r.out.result)) {