librpc/gen_ndr

[metze/samba/wip.git] / source3 / librpc / gen_ndr / ndr_epmapper_c.c

diff --git a/source3/librpc/gen_ndr/ndr_epmapper_c.c b/source3/librpc/gen_ndr/ndr_epmapper_c.c
index 6965ce14c480f6e9c3b0d00e0e2c3a4ae6d87750..8d0de6329f5c47207a2e30b1e846cfc54188a701 100644 (file)
--- a/source3/librpc/gen_ndr/ndr_epmapper_c.c
+++ b/source3/librpc/gen_ndr/ndr_epmapper_c.c
@@ -632,11 +632,15 @@ static void dcerpc_epm_Lookup_done(struct tevent_req *subreq)
        /* Copy out parameters */
        *state->orig.out.entry_handle = *state->tmp.out.entry_handle;
        *state->orig.out.num_ents = *state->tmp.out.num_ents;
-       if ((*state->tmp.out.num_ents) > (state->tmp.in.max_ents)) {
-               tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
-               return;
+       {
+               size_t _copy_len_entries;
+               if ((*state->tmp.out.num_ents) > (state->tmp.in.max_ents)) {
+                       tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+                       return;
+               }
+               _copy_len_entries = *state->tmp.out.num_ents;
+               memcpy(state->orig.out.entries, state->tmp.out.entries, _copy_len_entries * sizeof(*state->orig.out.entries));
        }
-       memcpy(state->orig.out.entries, state->tmp.out.entries, (*state->tmp.out.num_ents) * sizeof(*state->orig.out.entries));
 
        /* Copy result */
        state->orig.out.result = state->tmp.out.result;
@@ -701,10 +705,14 @@ NTSTATUS dcerpc_epm_Lookup(struct dcerpc_binding_handle *h,
        /* Return variables */
        *_entry_handle = *r.out.entry_handle;
        *_num_ents = *r.out.num_ents;
-       if ((*r.out.num_ents) > (r.in.max_ents)) {
-               return NT_STATUS_INVALID_NETWORK_RESPONSE;
+       {
+               size_t _copy_len_entries;
+               if ((*r.out.num_ents) > (r.in.max_ents)) {
+                       return NT_STATUS_INVALID_NETWORK_RESPONSE;
+               }
+               _copy_len_entries = *r.out.num_ents;
+               memcpy(_entries, r.out.entries, _copy_len_entries * sizeof(*_entries));
        }
-       memcpy(_entries, r.out.entries, (*r.out.num_ents) * sizeof(*_entries));
 
        /* Return result */
        *result = r.out.result;
@@ -892,11 +900,15 @@ static void dcerpc_epm_Map_done(struct tevent_req *subreq)
        /* Copy out parameters */
        *state->orig.out.entry_handle = *state->tmp.out.entry_handle;
        *state->orig.out.num_towers = *state->tmp.out.num_towers;
-       if ((*state->tmp.out.num_towers) > (state->tmp.in.max_towers)) {
-               tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
-               return;
+       {
+               size_t _copy_len_towers;
+               if ((*state->tmp.out.num_towers) > (state->tmp.in.max_towers)) {
+                       tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+                       return;
+               }
+               _copy_len_towers = *state->tmp.out.num_towers;
+               memcpy(state->orig.out.towers, state->tmp.out.towers, _copy_len_towers * sizeof(*state->orig.out.towers));
        }
-       memcpy(state->orig.out.towers, state->tmp.out.towers, (*state->tmp.out.num_towers) * sizeof(*state->orig.out.towers));
 
        /* Copy result */
        state->orig.out.result = state->tmp.out.result;
@@ -957,10 +969,14 @@ NTSTATUS dcerpc_epm_Map(struct dcerpc_binding_handle *h,
        /* Return variables */
        *_entry_handle = *r.out.entry_handle;
        *_num_towers = *r.out.num_towers;
-       if ((*r.out.num_towers) > (r.in.max_towers)) {
-               return NT_STATUS_INVALID_NETWORK_RESPONSE;
+       {
+               size_t _copy_len_towers;
+               if ((*r.out.num_towers) > (r.in.max_towers)) {
+                       return NT_STATUS_INVALID_NETWORK_RESPONSE;
+               }
+               _copy_len_towers = *r.out.num_towers;
+               memcpy(_towers, r.out.towers, _copy_len_towers * sizeof(*_towers));
        }
-       memcpy(_towers, r.out.towers, (*r.out.num_towers) * sizeof(*_towers));
 
        /* Return result */
        *result = r.out.result;