4 files changed, 5 insertions, 4 deletions
diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index 13c74121a6..959616fc78 100644
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -179,7 +179,7 @@ NTSTATUS ndr_push_expand(struct ndr_push *ndr, uint32_t size)
 	if (size > ndr->alloc_size) {
 		ndr->alloc_size = size;
 	}
-	ndr->data = talloc_realloc(ndr->data, ndr->alloc_size);
+	ndr->data = talloc_realloc(ndr, ndr->data, ndr->alloc_size);
 	if (!ndr->data) {
 		return ndr_push_error(ndr, NDR_ERR_ALLOC, "Failed to push_expand to %u",
 				      ndr->alloc_size);
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 352db37d2b..d41eebbf2f 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -781,7 +781,8 @@ static void dcerpc_request_recv_data(struct dcerpc_pipe *p,
 	length = pkt.u.response.stub_and_verifier.length;
 
 	if (length > 0) {
-		req->payload.data = talloc_realloc(req->payload.data, 
+		req->payload.data = talloc_realloc(req, 
+						   req->payload.data, 
 						   req->payload.length + length);
 		if (!req->payload.data) {
 			req->status = NT_STATUS_NO_MEMORY;
diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c
index 09c5f3772c..7000bcd20d 100644
--- a/source4/librpc/rpc/dcerpc_smb.c
+++ b/source4/librpc/rpc/dcerpc_smb.c
@@ -92,7 +92,7 @@ static void smb_read_callback(struct smbcli_request *req)
 	}
 
 	/* initiate another read request, as we only got part of a fragment */
-	state->data.data = talloc_realloc(state->data.data, frag_length);
+	state->data.data = talloc_realloc(state, state->data.data, frag_length);
 
 	io->readx.in.mincnt = MIN(state->p->srv_max_xmit_frag, 
 				  frag_length - state->received);
diff --git a/source4/librpc/rpc/dcerpc_tcp.c b/source4/librpc/rpc/dcerpc_tcp.c
index acf3d58262..6940c7705d 100644
--- a/source4/librpc/rpc/dcerpc_tcp.c
+++ b/source4/librpc/rpc/dcerpc_tcp.c
@@ -141,7 +141,7 @@ static void tcp_process_recv(struct dcerpc_pipe *p)
 		}
 		frag_length = dcerpc_get_frag_length(&tcp->recv.data);
 
-		tcp->recv.data.data = talloc_realloc(tcp->recv.data.data,
+		tcp->recv.data.data = talloc_realloc(tcp, tcp->recv.data.data,
 						     frag_length);
 		if (tcp->recv.data.data == NULL) {
 			tcp_sock_dead(p, NT_STATUS_NO_MEMORY);