r2671: we're getting too many errors caused by the talloc_realloc() API not

taking a context (so when you pass a NULL pointer you end up with
memory in a top level context). Fixed it by changing the API to take a
context. The context is only used if the pointer you are reallocing is
NULL.
(This used to be commit 8dc23821c9f54b2f13049b5e608a0cafb81aa540)

30 files changed, 84 insertions, 79 deletions

diff --git a/source4/include/talloc.h b/source4/include/talloc.h
index e329bdb308..635f77d043 100644
--- a/source4/include/talloc.h
+++ b/source4/include/talloc.h
@@ -34,10 +34,10 @@ typedef void TALLOC_CTX;
 
 /* useful macros for creating type checked pointers */
 #define talloc(ctx, size) talloc_named_const(ctx, size, __location__)
-#define talloc_realloc(ptr, size) _talloc_realloc(ptr, size, __location__)
+#define talloc_realloc(ctx, ptr, size) _talloc_realloc(ctx, ptr, size, __location__)
 #define talloc_p(ctx, type) (type *)talloc_named_const(ctx, sizeof(type), #type)
 #define talloc_array_p(ctx, type, count) (type *)talloc_array(ctx, sizeof(type), count, __location__)
-#define talloc_realloc_p(p, type, count) (type *)talloc_realloc_array(p, sizeof(type), count, __location__)
+#define talloc_realloc_p(ctx, p, type, count) (type *)talloc_realloc_array(ctx, p, sizeof(type), count, __location__)
 #define talloc_memdup(t, p, size) _talloc_memdup(t, p, size, __location__)
 
 #define talloc_destroy(ctx) talloc_free(ctx)
diff --git a/source4/lib/charcnv.c b/source4/lib/charcnv.c
index 2ee2bd9bae..33c49504d8 100644
--- a/source4/lib/charcnv.c
+++ b/source4/lib/charcnv.c
@@ -208,11 +208,7 @@ ssize_t convert_string_talloc(TALLOC_CTX *ctx, charset_t from, charset_t to,
 	outbuf = NULL;
 convert:
 	destlen = destlen * 2;
-	if (outbuf == NULL) {
-		ob = talloc_array_p(ctx, char, destlen);
-	} else {
-		ob = (char *)talloc_realloc(outbuf, destlen);
-	}
+	ob = (char *)talloc_realloc(ctx, outbuf, destlen);
 	if (!ob) {
 		DEBUG(0, ("convert_string_talloc: realloc failed!\n"));
 		talloc_free(outbuf);
@@ -245,7 +241,7 @@ convert:
 	
 	destlen = destlen - o_len;
 	/* +2 for mandetory null termination, UTF8 or UTF16 */
-	*dest = (char *)talloc_realloc(ob,destlen+2);
+	*dest = (char *)talloc_realloc(ctx, ob, destlen+2);
 	if (!*dest) {
 		DEBUG(0, ("convert_string_talloc: out of memory!\n"));
 		talloc_free(ob);
diff --git a/source4/lib/registry/common/reg_interface.c b/source4/lib/registry/common/reg_interface.c
index ec6188be71..ba92369194 100644
--- a/source4/lib/registry/common/reg_interface.c
+++ b/source4/lib/registry/common/reg_interface.c
@@ -190,7 +190,7 @@ WERROR reg_import_hive(struct registry_context *h, const char *backend, const ch
 
 	/* Add hive to context */
 	h->num_hives++;
-	h->hives = talloc_realloc_p(h->hives, struct registry_hive *, h->num_hives);
+	h->hives = talloc_realloc_p(h, h->hives, struct registry_hive *, h->num_hives);
 	h->hives[h->num_hives-1] = ret;
 
 	return WERR_OK;
diff --git a/source4/lib/registry/reg_backend_rpc/reg_backend_rpc.c b/source4/lib/registry/reg_backend_rpc/reg_backend_rpc.c
index 1c887fc411..3dd73162be 100644
--- a/source4/lib/registry/reg_backend_rpc/reg_backend_rpc.c
+++ b/source4/lib/registry/reg_backend_rpc/reg_backend_rpc.c
@@ -90,7 +90,7 @@ WERROR rpc_list_hives (TALLOC_CTX *mem_ctx, const char *location, const char *cr
 	int i = 0;
 	*hives = talloc_p(mem_ctx, char *);
 	for(i = 0; known_hives[i].name; i++) {
-		*hives = talloc_realloc_p(*hives, char *, i+2);
+		*hives = talloc_realloc_p(mem_ctx, *hives, char *, i+2);
 		(*hives)[i] = talloc_strdup(mem_ctx, known_hives[i].name);
 	}
 	(*hives)[i] = NULL;
diff --git a/source4/lib/socket/socket_ipv4.c b/source4/lib/socket/socket_ipv4.c
index c98e5534ca..88bf611b67 100644
--- a/source4/lib/socket/socket_ipv4.c
+++ b/source4/lib/socket/socket_ipv4.c
@@ -184,7 +184,7 @@ static NTSTATUS ipv4_tcp_accept(struct socket_context *sock, struct socket_conte
 }
 
 static NTSTATUS ipv4_tcp_recv(struct socket_context *sock, TALLOC_CTX *mem_ctx,
-					DATA_BLOB *blob, size_t wantlen, uint32_t flags)
+			      DATA_BLOB *blob, size_t wantlen, uint32_t flags)
 {
 	ssize_t gotlen;
 	void *buf;
@@ -235,7 +235,7 @@ static NTSTATUS ipv4_tcp_recv(struct socket_context *sock, TALLOC_CTX *mem_ctx,
 	}
 
 	blob->length = gotlen;
-	blob->data = talloc_realloc(buf, gotlen);
+	blob->data = talloc_realloc(mem_ctx, buf, gotlen);
 	if (!blob->data) {
 		return NT_STATUS_NO_MEMORY;
 	}
diff --git a/source4/lib/talloc.c b/source4/lib/talloc.c
index 8193f9c384..7266ff8a45 100644
--- a/source4/lib/talloc.c
+++ b/source4/lib/talloc.c
@@ -287,9 +287,10 @@ int talloc_free(void *ptr)
 
 
 /*
-  A talloc version of realloc 
+  A talloc version of realloc. The context argument is only used if
+  ptr is NULL
 */
-void *_talloc_realloc(void *ptr, size_t size, const char *name)
+void *_talloc_realloc(void *context, void *ptr, size_t size, const char *name)
 {
 	struct talloc_chunk *tc;
 	void *new_ptr;
@@ -302,7 +303,7 @@ void *_talloc_realloc(void *ptr, size_t size, const char *name)
 
 	/* realloc(NULL) is equavalent to malloc() */
 	if (ptr == NULL) {
-		return talloc_named_const(NULL, size, name);
+		return talloc_named_const(context, size, name);
 	}
 
 	tc = talloc_chunk_from_ptr(ptr);
@@ -550,7 +551,7 @@ static char *talloc_vasprintf_append(char *s,
 				     const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
 
 static char *talloc_vasprintf_append(char *s,
-			      const char *fmt, va_list ap)
+				     const char *fmt, va_list ap)
 {	
 	int len, s_len;
 	va_list ap2;
@@ -564,7 +565,7 @@ static char *talloc_vasprintf_append(char *s,
 	}
 	len = vsnprintf(NULL, 0, fmt, ap2);
 
-	s = talloc_realloc(s, s_len + len+1);
+	s = talloc_realloc(NULL, s, s_len + len+1);
 	if (!s) return NULL;
 
 	VA_COPY(ap2, ap);
@@ -607,13 +608,13 @@ void *talloc_array(void *ctx, size_t el_size, uint_t count, const char *name)
 /*
   realloc an array, checking for integer overflow in the array size
 */
-void *talloc_realloc_array(void *ptr, size_t el_size, uint_t count, const char *name)
+void *talloc_realloc_array(void *ctx, void *ptr, size_t el_size, uint_t count, const char *name)
 {
 	if (count == 0 ||
 	    count >= MAX_TALLOC_SIZE/el_size) {
 		return NULL;
 	}
-	ptr = talloc_realloc(ptr, el_size * count);
+	ptr = talloc_realloc(ctx, ptr, el_size * count);
 	if (ptr) {
 		talloc_set_name_const(ptr, name);
 	}
@@ -632,5 +633,5 @@ void *talloc_ldb_alloc(void *context, void *ptr, size_t size)
 		talloc_free(ptr);
 		return NULL;
 	}
-	return talloc_realloc(ptr, size);
+	return talloc_realloc(context, ptr, size);
 }
diff --git a/source4/lib/util_str.c b/source4/lib/util_str.c
index f8aadf8f59..0e58face16 100644
--- a/source4/lib/util_str.c
+++ b/source4/lib/util_str.c
@@ -1428,8 +1428,9 @@ BOOL add_string_to_array(TALLOC_CTX *mem_ctx,
 {
 	char *dup_str = talloc_strdup(mem_ctx, str);
 
-	*strings = talloc_realloc(*strings,
-				  ((*num)+1) * sizeof(**strings));
+	*strings = talloc_realloc_p(mem_ctx,
+				    *strings,
+				    const char *, ((*num)+1));
 
 	if ((*strings == NULL) || (dup_str == NULL))
 		return False;
diff --git a/source4/libcli/auth/spnego_parse.c b/source4/libcli/auth/spnego_parse.c
index 20b766a4e2..07dba61dde 100644
--- a/source4/libcli/auth/spnego_parse.c
+++ b/source4/libcli/auth/spnego_parse.c
@@ -51,7 +51,7 @@ static BOOL read_negTokenInit(ASN1_DATA *asn1, struct spnego_negTokenInit *token
 			for (i = 0; !asn1->has_error &&
 				     0 < asn1_tag_remaining(asn1); i++) {
 				token->mechTypes = 
-					talloc_realloc(token->mechTypes, (i + 2) *
+					talloc_realloc(NULL, token->mechTypes, (i + 2) *
 						       sizeof(*token->mechTypes));
 				asn1_read_OID(asn1, token->mechTypes + i);
 				if (token->mechTypes[i]) {
diff --git a/source4/libcli/clilist.c b/source4/libcli/clilist.c
index 529d4f81a3..2659e81419 100644
--- a/source4/libcli/clilist.c
+++ b/source4/libcli/clilist.c
@@ -83,7 +83,8 @@ static BOOL smbcli_list_new_callback(void *private, union smb_search_data *file)
 	file_info *tdl;
  
 	/* add file info to the dirlist pool */
-	tdl = talloc_realloc(state->dirlist,
+	tdl = talloc_realloc(state, 
+			     state->dirlist,
 			     state->dirlist_len + sizeof(struct file_info));
 
 	if (!tdl) {
@@ -225,7 +226,8 @@ static BOOL smbcli_list_old_callback(void *private, union smb_search_data *file)
 	file_info *tdl;
 	
 	/* add file info to the dirlist pool */
-	tdl = talloc_realloc(state->dirlist,
+	tdl = talloc_realloc(state,
+			     state->dirlist,
 			     state->dirlist_len + sizeof(struct file_info));
 
 	if (!tdl) {
diff --git a/source4/libcli/ldap/ldap.c b/source4/libcli/ldap/ldap.c
index a94a4f2f30..af21962265 100644
--- a/source4/libcli/ldap/ldap.c
+++ b/source4/libcli/ldap/ldap.c
@@ -179,9 +179,10 @@ static struct ldap_parse_tree *ldap_parse_filterlist(TALLOC_CTX *mem_ctx,
 
 	while (*s && (next = ldap_parse_filter(mem_ctx, &s))) {
 		struct ldap_parse_tree **e;
-		e = talloc_realloc(ret->u.list.elements,
-				   sizeof(struct ldap_parse_tree) *
-				   (ret->u.list.num_elements+1));
+		e = talloc_realloc_p(ret,
+				     ret->u.list.elements,
+				     struct ldap_parse_tree *,
+				     ret->u.list.num_elements+1);
 		if (!e) {
 			errno = ENOMEM;
 			return NULL;
diff --git a/source4/libcli/ldap/ldap_ldif.c b/source4/libcli/ldap/ldap_ldif.c
index 2ec3b827ce..8fe50b6d08 100644
--- a/source4/libcli/ldap/ldap_ldif.c
+++ b/source4/libcli/ldap/ldap_ldif.c
@@ -51,7 +51,7 @@ static char *next_chunk(TALLOC_CTX *mem_ctx,
 		if (chunk_size+1 >= alloc_size) {
 			char *c2;
 			alloc_size += 1024;
-			c2 = talloc_realloc(chunk, alloc_size);
+			c2 = talloc_realloc(mem_ctx, chunk, alloc_size);
 			if (!c2) {
 				errno = ENOMEM;
 				return NULL;
@@ -156,11 +156,12 @@ static int next_attr(char **s, const char **attr, struct ldap_val *value)
 }
 
 BOOL add_value_to_attrib(TALLOC_CTX *mem_ctx, struct ldap_val *value,
-				struct ldap_attribute *attrib)
+			 struct ldap_attribute *attrib)
 {
-	attrib->values = talloc_realloc(attrib->values,
-					sizeof(*attrib->values) *
-					(attrib->num_values+1));
+	attrib->values = talloc_realloc_p(mem_ctx, 
+					  attrib->values,
+					  DATA_BLOB,
+					  attrib->num_values+1);
 	if (attrib->values == NULL)
 		return False;
 
@@ -175,8 +176,10 @@ BOOL add_attrib_to_array_talloc(TALLOC_CTX *mem_ctx,
 				       struct ldap_attribute **attribs,
 				       int *num_attribs)
 {
-	*attribs = talloc_realloc(*attribs,
-				  sizeof(**attribs) * (*num_attribs+1));
+	*attribs = talloc_realloc_p(mem_ctx,
+				    *attribs,
+				    struct ldap_attribute,
+				    *num_attribs+1);
 
 	if (*attribs == NULL)
 		return False;
@@ -207,9 +210,10 @@ static BOOL fill_add_attributes(struct ldap_message *msg, char **chunk)
 		}
 
 		if (attrib == NULL) {
-			r->attributes = talloc_realloc(r->attributes,
-						       sizeof(*r->attributes) *
-						       (r->num_attributes+1));
+			r->attributes = talloc_realloc_p(msg->mem_ctx,
+							 r->attributes,
+							 struct ldap_attribute,
+							 r->num_attributes+1);
 			if (r->attributes == NULL)
 				return False;
 
@@ -231,8 +235,7 @@ BOOL add_mod_to_array_talloc(TALLOC_CTX *mem_ctx,
 				    struct ldap_mod **mods,
 				    int *num_mods)
 {
-	*mods = talloc_realloc(*mods,
-			       sizeof(**mods) * ((*num_mods)+1));
+	*mods = talloc_realloc_p(mem_ctx, *mods, struct ldap_mod, (*num_mods)+1);
 
 	if (*mods == NULL)
 		return False;
diff --git a/source4/libcli/raw/raweas.c b/source4/libcli/raw/raweas.c
index d78f10fe1a..e07fbcd288 100644
--- a/source4/libcli/raw/raweas.c
+++ b/source4/libcli/raw/raweas.c
@@ -128,7 +128,7 @@ NTSTATUS ea_pull_list(const DATA_BLOB *blob,
 		blob2.data = blob->data + ofs;
 		blob2.length = ea_size - ofs;
 
-		*eas = talloc_realloc(*eas, sizeof(**eas) * (n+1));
+		*eas = talloc_realloc(mem_ctx, *eas, sizeof(**eas) * (n+1));
 		if (! *eas) return NT_STATUS_NO_MEMORY;
 
 		len = ea_pull_struct(&blob2, mem_ctx, &(*eas)[n]);
diff --git a/source4/libcli/raw/rawfileinfo.c b/source4/libcli/raw/rawfileinfo.c
index aac8f2657b..cbb666b7ce 100644
--- a/source4/libcli/raw/rawfileinfo.c
+++ b/source4/libcli/raw/rawfileinfo.c
@@ -174,8 +174,10 @@ static NTSTATUS smb_raw_info_backend(struct smbcli_session *session,
 		while (blob->length - ofs >= 24) {
 			uint_t n = parms->stream_info.out.num_streams;
 			parms->stream_info.out.streams = 
-				talloc_realloc(parms->stream_info.out.streams,
-					       (n+1) * sizeof(parms->stream_info.out.streams[0]));
+				talloc_realloc_p(mem_ctx,
+						 parms->stream_info.out.streams,
+						 struct stream_struct,
+						 n+1);
 			if (!parms->stream_info.out.streams) {
 				return NT_STATUS_NO_MEMORY;
 			}
diff --git a/source4/libcli/raw/rawrequest.c b/source4/libcli/raw/rawrequest.c
index a94e796628..a15d681a5c 100644
--- a/source4/libcli/raw/rawrequest.c
+++ b/source4/libcli/raw/rawrequest.c
@@ -213,7 +213,7 @@ static void smbcli_req_grow_allocation(struct smbcli_request *req, uint_t new_si
 
 	/* we need to realloc */
 	req->out.allocated = req->out.size + delta + REQ_OVER_ALLOCATION;
-	buf2 = talloc_realloc(req->out.buffer, req->out.allocated);
+	buf2 = talloc_realloc(req, req->out.buffer, req->out.allocated);
 	if (buf2 == NULL) {
 		smb_panic("out of memory in req_grow_allocation");
 	}
@@ -911,7 +911,7 @@ size_t smbcli_blob_append_string(struct smbcli_session *session,
 
 	max_len = (strlen(str)+2) * MAX_BYTES_PER_CHAR;		
 
-	blob->data = talloc_realloc(blob->data, blob->length + max_len);
+	blob->data = talloc_realloc(mem_ctx, blob->data, blob->length + max_len);
 	if (!blob->data) {
 		return 0;
 	}
diff --git a/source4/libcli/util/asn1.c b/source4/libcli/util/asn1.c
index 3dc5abc09a..4ff335399a 100644
--- a/source4/libcli/util/asn1.c
+++ b/source4/libcli/util/asn1.c
@@ -32,7 +32,7 @@ BOOL asn1_write(ASN1_DATA *data, const void *p, int len)
 	if (data->has_error) return False;
 	if (data->length < data->ofs+len) {
 		uint8_t *newp;
-		newp = talloc_realloc(data->data, data->ofs+len);
+		newp = talloc_realloc(NULL, data->data, data->ofs+len);
 		if (!newp) {
 			asn1_free(data);
 			data->has_error = True;
diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index 13c74121a6..959616fc78 100644
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -179,7 +179,7 @@ NTSTATUS ndr_push_expand(struct ndr_push *ndr, uint32_t size)
 	if (size > ndr->alloc_size) {
 		ndr->alloc_size = size;
 	}
-	ndr->data = talloc_realloc(ndr->data, ndr->alloc_size);
+	ndr->data = talloc_realloc(ndr, ndr->data, ndr->alloc_size);
 	if (!ndr->data) {
 		return ndr_push_error(ndr, NDR_ERR_ALLOC, "Failed to push_expand to %u",
 				      ndr->alloc_size);
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 352db37d2b..d41eebbf2f 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -781,7 +781,8 @@ static void dcerpc_request_recv_data(struct dcerpc_pipe *p,
 	length = pkt.u.response.stub_and_verifier.length;
 
 	if (length > 0) {
-		req->payload.data = talloc_realloc(req->payload.data, 
+		req->payload.data = talloc_realloc(req, 
+						   req->payload.data, 
 						   req->payload.length + length);
 		if (!req->payload.data) {
 			req->status = NT_STATUS_NO_MEMORY;
diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c
index 09c5f3772c..7000bcd20d 100644
--- a/source4/librpc/rpc/dcerpc_smb.c
+++ b/source4/librpc/rpc/dcerpc_smb.c
@@ -92,7 +92,7 @@ static void smb_read_callback(struct smbcli_request *req)
 	}
 
 	/* initiate another read request, as we only got part of a fragment */
-	state->data.data = talloc_realloc(state->data.data, frag_length);
+	state->data.data = talloc_realloc(state, state->data.data, frag_length);
 
 	io->readx.in.mincnt = MIN(state->p->srv_max_xmit_frag, 
 				  frag_length - state->received);
diff --git a/source4/librpc/rpc/dcerpc_tcp.c b/source4/librpc/rpc/dcerpc_tcp.c
index acf3d58262..6940c7705d 100644
--- a/source4/librpc/rpc/dcerpc_tcp.c
+++ b/source4/librpc/rpc/dcerpc_tcp.c
@@ -141,7 +141,7 @@ static void tcp_process_recv(struct dcerpc_pipe *p)
 		}
 		frag_length = dcerpc_get_frag_length(&tcp->recv.data);
 
-		tcp->recv.data.data = talloc_realloc(tcp->recv.data.data,
+		tcp->recv.data.data = talloc_realloc(tcp, tcp->recv.data.data,
 						     frag_length);
 		if (tcp->recv.data.data == NULL) {
 			tcp_sock_dead(p, NT_STATUS_NO_MEMORY);
diff --git a/source4/ntvfs/ipc/ipc_rap.c b/source4/ntvfs/ipc/ipc_rap.c
index 32b2fa2181..840c389d6c 100644
--- a/source4/ntvfs/ipc/ipc_rap.c
+++ b/source4/ntvfs/ipc/ipc_rap.c
@@ -178,9 +178,10 @@ static NTSTATUS rap_push_string(struct ndr_push *data_push,
 	NDR_CHECK(ndr_push_uint16(data_push, heap->offset));
 	NDR_CHECK(ndr_push_uint16(data_push, 0));
 
-	heap->strings = talloc_realloc(heap->strings,
-				       sizeof(*heap->strings) *
-				       (heap->num_strings + 1));
+	heap->strings = talloc_realloc_p(heap->mem_ctx,
+					 heap->strings,
+					 const char *,
+					 heap->num_strings + 1);
 
 	if (heap->strings == NULL)
 		return NT_STATUS_NO_MEMORY;
diff --git a/source4/ntvfs/ntvfs_base.c b/source4/ntvfs/ntvfs_base.c
index 03873ce697..72f4759cd5 100644
--- a/source4/ntvfs/ntvfs_base.c
+++ b/source4/ntvfs/ntvfs_base.c
@@ -153,11 +153,8 @@ NTSTATUS ntvfs_init_connection(struct smbsrv_request *req)
 */
 void ntvfs_set_private(struct smbsrv_tcon *tcon, int depth, void *value)
 {
-	if (!tcon->ntvfs_private_list) {
-		tcon->ntvfs_private_list = talloc_array_p(tcon, void *, depth+1);
-	} else {
-		tcon->ntvfs_private_list = talloc_realloc_p(tcon->ntvfs_private_list, 
-							    void *, depth+1);
-	}
+	tcon->ntvfs_private_list = talloc_realloc_p(tcon, 
+						    tcon->ntvfs_private_list, 
+						    void *, depth+1);
 	tcon->ntvfs_private_list[depth] = value;
 }
diff --git a/source4/ntvfs/posix/pvfs_dirlist.c b/source4/ntvfs/posix/pvfs_dirlist.c
index 0137424dc4..85c307a1b2 100644
--- a/source4/ntvfs/posix/pvfs_dirlist.c
+++ b/source4/ntvfs/posix/pvfs_dirlist.c
@@ -89,11 +89,6 @@ NTSTATUS pvfs_list(struct pvfs_state *pvfs, struct pvfs_filename *name, struct p
 		return NT_STATUS_NO_MEMORY;
 	}
 	
-	dir->names = talloc(dir, 0);
-	if (!dir->names) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
 	odir = opendir(name->full_name);
 	if (!odir) { 
 		return pvfs_map_errno(pvfs, errno); 
@@ -110,7 +105,7 @@ NTSTATUS pvfs_list(struct pvfs_state *pvfs, struct pvfs_filename *name, struct p
 		
 		if (dir->count >= allocated) {
 			allocated = (allocated + 100) * 1.2;
-			dir->names = talloc_realloc_p(dir->names, const char *, allocated);
+			dir->names = talloc_realloc_p(dir, dir->names, const char *, allocated);
 			if (!dir->names) { 
 				closedir(odir);
 				return NT_STATUS_NO_MEMORY;
diff --git a/source4/ntvfs/simple/svfs.h b/source4/ntvfs/simple/svfs.h
index 33b7cb7011..d3bafb42e3 100644
--- a/source4/ntvfs/simple/svfs.h
+++ b/source4/ntvfs/simple/svfs.h
@@ -17,7 +17,7 @@ struct svfs_private {
 struct svfs_dir {
 	uint_t count;
 	char *unix_dir;
-	struct {
+	struct svfs_dirfile {
 		char *name;
 		struct stat st;
 	} *files;
diff --git a/source4/ntvfs/simple/svfs_util.c b/source4/ntvfs/simple/svfs_util.c
index 2e64920fc8..b6b7171487 100644
--- a/source4/ntvfs/simple/svfs_util.c
+++ b/source4/ntvfs/simple/svfs_util.c
@@ -61,7 +61,7 @@ struct svfs_dir *svfs_list_unix(TALLOC_CTX *mem_ctx, struct smbsrv_request *req,
 	uint_t allocated = 0;
 	char *low_mask;
 
-	dir = talloc(mem_ctx, sizeof(struct svfs_dir));
+	dir = talloc_p(mem_ctx, struct svfs_dir);
 	if (!dir) { return NULL; }
 
 	dir->count = 0;
@@ -105,7 +105,7 @@ struct svfs_dir *svfs_list_unix(TALLOC_CTX *mem_ctx, struct smbsrv_request *req,
 		
 		if (dir->count >= allocated) {
 			allocated = (allocated + 100) * 1.2;
-			dir->files = talloc_realloc(dir->files, allocated * sizeof(dir->files[0]));
+			dir->files = talloc_realloc_p(dir, dir->files, struct svfs_dirfile, allocated);
 			if (!dir->files) { 
 				closedir(odir);
 				return NULL;
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 46029ce8dc..5ab434baed 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -819,7 +819,7 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 		}
 
 		call->pkt.u.request.stub_and_verifier.data = 
-			talloc_realloc(call->pkt.u.request.stub_and_verifier.data, alloc_size);
+			talloc_realloc(call, call->pkt.u.request.stub_and_verifier.data, alloc_size);
 		if (!call->pkt.u.request.stub_and_verifier.data) {
 			return dcesrv_fault(call2, DCERPC_FAULT_OTHER);
 		}
@@ -874,7 +874,8 @@ NTSTATUS dcesrv_input(struct dcesrv_connection *dce_conn, const DATA_BLOB *data)
 {
 	NTSTATUS status;
 
-	dce_conn->partial_input.data = talloc_realloc(dce_conn->partial_input.data,
+	dce_conn->partial_input.data = talloc_realloc(dce_conn,
+						      dce_conn->partial_input.data,
 						      dce_conn->partial_input.length + data->length);
 	if (!dce_conn->partial_input.data) {
 		return NT_STATUS_NO_MEMORY;
diff --git a/source4/rpc_server/epmapper/rpc_epmapper.c b/source4/rpc_server/epmapper/rpc_epmapper.c
index 37f1c372e0..54a996e82a 100644
--- a/source4/rpc_server/epmapper/rpc_epmapper.c
+++ b/source4/rpc_server/epmapper/rpc_epmapper.c
@@ -123,13 +123,14 @@ static uint32_t build_ep_list(TALLOC_CTX *mem_ctx,
 	struct dcesrv_endpoint *d;
 	uint32_t total = 0;
 
-	(*eps) = talloc(mem_ctx, 0);
-	
+	*eps = NULL;
+
 	for (d=endpoint_list; d; d=d->next) {
 		struct dcesrv_if_list *iface;
 
 		for (iface=d->interface_list;iface;iface=iface->next) {
-			(*eps) = talloc_realloc_p(*eps, 
+			(*eps) = talloc_realloc_p(mem_ctx, 
+						  *eps, 
 						  struct dcesrv_ep_iface,
 						  total + 1);
 			if (!*eps) {
diff --git a/source4/smb_server/request.c b/source4/smb_server/request.c
index 3d78c0a55d..5c1694f18a 100644
--- a/source4/smb_server/request.c
+++ b/source4/smb_server/request.c
@@ -72,7 +72,7 @@ static void req_setup_chain_reply(struct smbsrv_request *req, uint_t wct, uint_t
 	/* over allocate by a small amount */
 	req->out.allocated = req->out.size + REQ_OVER_ALLOCATION; 
 
-	req->out.buffer = talloc_realloc(req->out.buffer, req->out.allocated);
+	req->out.buffer = talloc_realloc(req, req->out.buffer, req->out.allocated);
 	if (!req->out.buffer) {
 		smbsrv_terminate_connection(req->smb_conn, "allocation failed");
 	}
@@ -186,7 +186,7 @@ static void req_grow_allocation(struct smbsrv_request *req, uint_t new_size)
 
 	/* we need to realloc */
 	req->out.allocated = req->out.size + delta + REQ_OVER_ALLOCATION;
-	buf2 = talloc_realloc(req->out.buffer, req->out.allocated);
+	buf2 = talloc_realloc(req, req->out.buffer, req->out.allocated);
 	if (buf2 == NULL) {
 		smb_panic("out of memory in req_grow_allocation");
 	}
diff --git a/source4/smb_server/trans2.c b/source4/smb_server/trans2.c
index e681c9fe29..34e79061df 100644
--- a/source4/smb_server/trans2.c
+++ b/source4/smb_server/trans2.c
@@ -39,7 +39,7 @@ static void trans2_grow_data_allocation(struct smbsrv_request *req,
 	if (new_size <= trans->out.data.length) {
 		return;
 	}
-	trans->out.data.data = talloc_realloc(trans->out.data.data, new_size);
+	trans->out.data.data = talloc_realloc(req, trans->out.data.data, new_size);
 }
 
 
diff --git a/source4/torture/rap/rap.c b/source4/torture/rap/rap.c
index 7dc9e7fcbc..407aadbc0e 100644
--- a/source4/torture/rap/rap.c
+++ b/source4/torture/rap/rap.c
@@ -79,7 +79,8 @@ static void rap_cli_push_paramdesc(struct rap_call *call, char desc)
 	if (call->paramdesc != NULL)
 		len = strlen(call->paramdesc);
 
-	call->paramdesc = talloc_realloc(call->paramdesc,
+	call->paramdesc = talloc_realloc(call->mem_ctx,
+					 call->paramdesc,
 					 len+2);
 	call->paramdesc[len] = desc;
 	call->paramdesc[len+1] = '\0';
diff --git a/source4/torture/raw/search.c b/source4/torture/raw/search.c
index d0873e2ef4..e5c682575c 100644
--- a/source4/torture/raw/search.c
+++ b/source4/torture/raw/search.c
@@ -410,8 +410,10 @@ static BOOL multiple_search_callback(void *private, union smb_search_data *file)
 
 
 	data->count++;
-	data->list = talloc_realloc(data->list, 
-				    data->count * (sizeof(data->list[0])));
+	data->list = talloc_realloc_p(data->mem_ctx,
+				      data->list, 
+				      union smb_search_data,
+				      data->count);
 
 	data->list[data->count-1] = *file;