From 9b58da986680a92b350f02cd31ff64f30fecd07c Mon Sep 17 00:00:00 2001 From: Bill Parker Date: Wed, 17 Jul 2013 15:30:35 -0700 Subject: Fix bug 10025 - Lack of Sanity Checking in calls to malloc()/calloc(). In reviewing various files in Samba-4.0.7, I found a number of instances where malloc()/calloc() were called without the checking the return value for a value of NULL, which would indicate failure. (NB. The changes needed to ccan, iniparser, popt and heimdal will be reported upstream, not patched inside Samba). Reviewed-by: Jeremy Allison Reviewed-by: Simo Source --- lib/ntdb/tools/growtdb-bench.c | 16 ++++++++++++++++ lib/ntdb/tools/ntdbtorture.c | 4 ++++ 2 files changed, 20 insertions(+) (limited to 'lib/ntdb') diff --git a/lib/ntdb/tools/growtdb-bench.c b/lib/ntdb/tools/growtdb-bench.c index 640f87af5a..aa5a406a54 100644 --- a/lib/ntdb/tools/growtdb-bench.c +++ b/lib/ntdb/tools/growtdb-bench.c @@ -48,12 +48,24 @@ int main(int argc, char *argv[]) idxkey.dsize = strlen("User index"); idxdata.dsize = 51; idxdata.dptr = calloc(idxdata.dsize, 1); + if (idxdata.dptr == NULL) { + fprintf(stderr, "Unable to allocate memory for idxdata.dptr\n"); + return -1; + } /* Create users. */ k.dsize = 48; k.dptr = calloc(k.dsize, 1); + if (k.dptr == NULL) { + fprintf(stderr, "Unable to allocate memory for k.dptr\n"); + return -1; + } d.dsize = 64; d.dptr = calloc(d.dsize, 1); + if (d.dptr == NULL) { + fprintf(stderr, "Unable to allocate memory for d.dptr\n"); + return -1; + } ntdb_transaction_start(ntdb); for (i = 0; i < users; i++) { @@ -79,6 +91,10 @@ int main(int argc, char *argv[]) * a group. */ gk.dsize = 48; gk.dptr = calloc(k.dsize, 1); + if (gk.dptr == NULL) { + fprintf(stderr, "Unable to allocate memory for gk.dptr\n"); + return -1; + } gk.dptr[gk.dsize-1] = 1; d.dsize = 32; diff --git a/lib/ntdb/tools/ntdbtorture.c b/lib/ntdb/tools/ntdbtorture.c index 3bcf3200f2..7ddb5c3acb 100644 --- a/lib/ntdb/tools/ntdbtorture.c +++ b/lib/ntdb/tools/ntdbtorture.c @@ -96,6 +96,10 @@ static char *randbuf(int len) char *buf; int i; buf = (char *)malloc(len+1); + if (buf == NULL) { + perror("randbuf: unable to allocate memory for buffer.\n"); + exit(1); + } for (i=0;i