1 files changed, 44 insertions, 19 deletions

diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index 52cdbfcedd..aaba7300fc 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -126,8 +126,6 @@ BOOL next_token_nr(const char **ptr,char *buff, const char *sep, size_t bufsize)
 	return ret;	
 }
 
-static uint16 tmpbuf[sizeof(pstring)];
-
 void set_first_token(char *ptr)
 {
 	last_ptr = ptr;
@@ -394,9 +392,11 @@ BOOL strisnormal(const char *s, int case_default)
  NOTE: oldc and newc must be 7 bit characters
 **/
 
-void string_replace( pstring s, char oldc, char newc )
+void string_replace( char *s, char oldc, char newc )
 {
 	char *p;
+	smb_ucs2_t *tmp;
+	size_t src_len, len;
 
 	/* this is quite a common operation, so we want it to be
 	   fast. We optimise for the ascii case, knowing that all our
@@ -418,9 +418,14 @@ void string_replace( pstring s, char oldc, char newc )
 	/* With compose characters we must restart from the beginning. JRA. */
 	p = s;
 #endif
-	push_ucs2(NULL, tmpbuf, p, sizeof(tmpbuf), STR_TERMINATE);
-	string_replace_w(tmpbuf, UCS2_CHAR(oldc), UCS2_CHAR(newc));
-	pull_ucs2(NULL, p, tmpbuf, -1, sizeof(tmpbuf), STR_TERMINATE);
+	src_len = strlen(p);
+	len = push_ucs2_allocate(&tmp, p);
+	if (len == -1) {
+		return;
+	}
+	string_replace_w(tmp, UCS2_CHAR(oldc), UCS2_CHAR(newc));
+	pull_ucs2(NULL, p, tmp, src_len+1, -1, STR_TERMINATE);
+	SAFE_FREE(tmp);
 }
 
 /**
@@ -584,12 +589,22 @@ BOOL trim_string(char *s,const char *front,const char *back)
 
 BOOL strhasupper(const char *s)
 {
-	smb_ucs2_t *ptr;
-	push_ucs2(NULL, tmpbuf,s, sizeof(tmpbuf), STR_TERMINATE);
-	for(ptr=tmpbuf;*ptr;ptr++)
-		if(isupper_w(*ptr))
-			return True;
-	return(False);
+	smb_ucs2_t *tmp, *p;
+	BOOL ret;
+
+	if (push_ucs2_allocate(&tmp, s) == -1) {
+		return False;
+	}
+
+	for(p = tmp; *p != 0; p++) {
+		if(isupper_w(*p)) {
+			break;
+		}
+	}
+
+	ret = (*p != 0);
+	SAFE_FREE(tmp);
+	return ret;
 }
 
 /**
@@ -598,12 +613,22 @@ BOOL strhasupper(const char *s)
 
 BOOL strhaslower(const char *s)
 {
-	smb_ucs2_t *ptr;
-	push_ucs2(NULL, tmpbuf,s, sizeof(tmpbuf), STR_TERMINATE);
-	for(ptr=tmpbuf;*ptr;ptr++)
-		if(islower_w(*ptr))
-			return True;
-	return(False);
+	smb_ucs2_t *tmp, *p;
+	BOOL ret;
+
+	if (push_ucs2_allocate(&tmp, s) == -1) {
+		return False;
+	}
+
+	for(p = tmp; *p != 0; p++) {
+		if(islower_w(*p)) {
+			break;
+		}
+	}
+
+	ret = (*p != 0);
+	SAFE_FREE(tmp);
+	return ret;
 }
 
 /**
@@ -2628,7 +2653,7 @@ size_t utf16_len_n(const void *src, size_t n)
 char *escape_shell_string(const char *src)
 {
 	size_t srclen = strlen(src);
-	char *ret = SMB_MALLOC((srclen * 2) + 1);
+	char *ret = SMB_MALLOC_ARRAY(char, (srclen * 2) + 1);
 	char *dest = ret;
 	BOOL in_s_quote = False;
 	BOOL in_d_quote = False;