From d0ee90ace9e63fd83c997503a694e4c87f8a7e0f Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 19 Feb 2009 14:16:44 +0100 Subject: Fix a buffer handling bug when adding lots of registry keys This is *ancient*... From 2002, and nobody noticed until someone added lots of shares using net conf... :-) --- source3/registry/reg_backend_db.c | 33 ++++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/source3/registry/reg_backend_db.c b/source3/registry/reg_backend_db.c index a9bb7b1730..612b448cac 100644 --- a/source3/registry/reg_backend_db.c +++ b/source3/registry/reg_backend_db.c @@ -536,21 +536,36 @@ static bool regdb_store_keys_internal(const char *key, REGSUBKEY_CTR *ctr) /* pack all the strings */ for (i=0; i buflen) { - /* allocate some extra space */ - buffer = (uint8 *)SMB_REALLOC(buffer, len*2); + size_t thistime; + + thistime = tdb_pack(buffer+len, buflen-len, "f", + regsubkey_ctr_specific_key(ctr, i)); + if (len+thistime > buflen) { + size_t thistime2; + /* + * tdb_pack hasn't done anything because of the short + * buffer, allocate extra space. + */ + buffer = SMB_REALLOC_ARRAY(buffer, uint8_t, + (len+thistime)*2); if(buffer == NULL) { DEBUG(0, ("regdb_store_keys: Failed to realloc " - "memory of size [%d]\n", len*2)); + "memory of size [%d]\n", + (len+thistime)*2)); + ret = false; + goto done; + } + buflen = (len+thistime)*2; + thistime2 = tdb_pack( + buffer+len, buflen-len, "f", + regsubkey_ctr_specific_key(ctr, i)); + if (thistime2 != thistime) { + DEBUG(0, ("tdb_pack failed\n")); ret = false; goto done; } - buflen = len*2; - len = tdb_pack(buffer+len, buflen-len, "f", - regsubkey_ctr_specific_key(ctr, i)); } + len += thistime; } /* finally write out the data */ -- cgit