4 files changed, 35 insertions, 0 deletions

diff --git a/source3/rpc_client/cli_ds.c b/source3/rpc_client/cli_ds.c
index 9c7ad84062..c01a551966 100644
--- a/source3/rpc_client/cli_ds.c
+++ b/source3/rpc_client/cli_ds.c
@@ -100,6 +100,10 @@ NTSTATUS rpccli_ds_enum_domain_trusts(struct rpc_pipe_client *cli,
 		*num_domains = r.num_domains;
 		*trusts = TALLOC_ARRAY(mem_ctx, struct ds_domain_trust, r.num_domains);
 
+		if (*trusts == NULL) {
+			return NT_STATUS_NO_MEMORY;
+		}
+
 		for ( i=0; i< *num_domains; i++ ) {
 			(*trusts)[i].flags = r.domains.trusts[i].flags;
 			(*trusts)[i].parent_index = r.domains.trusts[i].parent_index;
diff --git a/source3/rpc_client/cli_lsarpc.c b/source3/rpc_client/cli_lsarpc.c
index ac797243ed..deb97724a0 100644
--- a/source3/rpc_client/cli_lsarpc.c
+++ b/source3/rpc_client/cli_lsarpc.c
@@ -1177,6 +1177,12 @@ NTSTATUS rpccli_lsa_enum_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX
 	privileges = TALLOC_ARRAY( mem_ctx, fstring, *count );
 	names      = TALLOC_ARRAY( mem_ctx, char *, *count );
 
+	if ((privileges == NULL) || (names == NULL)) {
+		TALLOC_FREE(privileges);
+		TALLOC_FREE(names);
+		return NT_STATUS_NO_MEMORY;
+	}
+
 	for ( i=0; i<*count; i++ ) {
 		UNISTR4 *uni_string = &r.rights->strings[i];
 
diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c
index 1da7a47ea6..ea8db63642 100644
--- a/source3/rpc_client/cli_samr.c
+++ b/source3/rpc_client/cli_samr.c
@@ -1505,6 +1505,12 @@ NTSTATUS rpccli_samr_lookup_rids(struct rpc_pipe_client *cli,
 	*names = TALLOC_ARRAY(mem_ctx, char *, r.num_names1);
 	*name_types = TALLOC_ARRAY(mem_ctx, uint32, r.num_names1);
 
+	if ((*names == NULL) || (*name_types == NULL)) {
+		TALLOC_FREE(*names);
+		TALLOC_FREE(*name_types);
+		return NT_STATUS_NO_MEMORY;
+	}
+
 	for (i = 0; i < r.num_names1; i++) {
 		fstring tmp;
 
@@ -1564,6 +1570,12 @@ NTSTATUS rpccli_samr_lookup_names(struct rpc_pipe_client *cli, TALLOC_CTX *mem_c
 	*rids = TALLOC_ARRAY(mem_ctx, uint32, r.num_rids1);
 	*rid_types = TALLOC_ARRAY(mem_ctx, uint32, r.num_rids1);
 
+	if ((*rids == NULL) || (*rid_types == NULL)) {
+		TALLOC_FREE(*rids);
+		TALLOC_FREE(*rid_types);
+		return NT_STATUS_NO_MEMORY;
+	}
+
 	for (i = 0; i < r.num_rids1; i++) {
 		(*rids)[i] = r.rids[i];
 		(*rid_types)[i] = r.types[i];
diff --git a/source3/rpc_client/cli_srvsvc.c b/source3/rpc_client/cli_srvsvc.c
index 2c71d6b18e..0d50e94d57 100644
--- a/source3/rpc_client/cli_srvsvc.c
+++ b/source3/rpc_client/cli_srvsvc.c
@@ -108,6 +108,9 @@ WERROR rpccli_srvsvc_net_share_enum(struct rpc_pipe_client *cli, TALLOC_CTX *mem
 	switch(info_level) {
 	case 1:
 		ctr->share.info1 = TALLOC_ARRAY(mem_ctx, SRV_SHARE_INFO_1, ctr->num_entries);
+		if (ctr->share.info1 == NULL) {
+			return WERR_NOMEM;
+		}
 		
 		memset(ctr->share.info1, 0, sizeof(SRV_SHARE_INFO_1));
 
@@ -135,6 +138,9 @@ WERROR rpccli_srvsvc_net_share_enum(struct rpc_pipe_client *cli, TALLOC_CTX *mem
 		break;
 	case 2:
 		ctr->share.info2 = TALLOC_ARRAY(mem_ctx, SRV_SHARE_INFO_2, ctr->num_entries);
+		if (ctr->share.info2 == NULL) {
+			return WERR_NOMEM;
+		}
 		
 		memset(ctr->share.info2, 0, sizeof(SRV_SHARE_INFO_2));
 
@@ -169,6 +175,10 @@ WERROR rpccli_srvsvc_net_share_enum(struct rpc_pipe_client *cli, TALLOC_CTX *mem
 	/* adding info-level 502 here */
 	case 502:
 		ctr->share.info502 = TALLOC_ARRAY(mem_ctx, SRV_SHARE_INFO_502, ctr->num_entries);
+
+		if (ctr->share.info502 == NULL) {
+			return WERR_NOMEM;
+		}
 		
 		memset(ctr->share.info502, 0, sizeof(SRV_SHARE_INFO_502));
 
@@ -534,6 +544,9 @@ WERROR rpccli_srvsvc_net_file_enum(struct rpc_pipe_client *cli, TALLOC_CTX *mem_
 	switch(file_level) {
 	case 3:
 		ctr->file.info3 = TALLOC_ARRAY(mem_ctx, SRV_FILE_INFO_3, ctr->num_entries);
+		if (ctr->file.info3 == NULL) {
+			return WERR_NOMEM;
+		}
 
 		memset(ctr->file.info3, 0, 
 		       sizeof(SRV_FILE_INFO_3) * ctr->num_entries);