r4052: fixed a bunch of code to use the type safe _p allocation macros

(This used to be commit 80d15fa3402a9d1183467463f6b21c0b674bc442)

diff --git a/source4/auth/auth.c b/source4/auth/auth.c
index 1254e26a73ea90ce3a5e97a4fc510918616735d1..33f302038276d457358d0a59eecb8ba1c63953a4 100644 (file)
--- a/source4/auth/auth.c
+++ b/source4/auth/auth.c
@@ -400,7 +400,7 @@ NTSTATUS make_auth_context_fixed(TALLOC_CTX *mem_ctx,
 }
 
 /* the list of currently registered AUTH backends */
-static struct {
+static struct auth_backend {
        const struct auth_operations *ops;
 } *backends = NULL;
 static int num_backends;
@@ -423,7 +423,8 @@ NTSTATUS auth_register(const void *_ops)
                return NT_STATUS_OBJECT_NAME_COLLISION;
        }
 
-       backends = Realloc(backends, sizeof(backends[0]) * (num_backends+1));
+
+       backends = realloc_p(backends, struct auth_backend, num_backends+1);
        if (!backends) {
                smb_panic("out of memory in auth_register");
        }

diff --git a/source4/client/client.c b/source4/client/client.c
index d9e995f1806eee5df129c3da7484b879e046d47f..6af145c31e9a2e46298d4561c11c98e734ddcce0 100644 (file)
--- a/source4/client/client.c
+++ b/source4/client/client.c
@@ -1449,7 +1449,7 @@ static int file_find(struct file_list **list, const char *directory,
                                        return -1;
                                }
                        }
-                       entry = (struct file_list *) malloc(sizeof (struct file_list));
+                       entry = malloc_p(struct file_list);
                        if (!entry) {
                                d_printf("Out of memory in file_find\n");
                                closedir(dir);

diff --git a/source4/client/tree.c b/source4/client/tree.c
index 94fd93c21062c7bf5c5839d1715d49c4f8544573..9776ce2ef74d27b86b6204e71b667899d88ea933 100644 (file)
--- a/source4/client/tree.c
+++ b/source4/client/tree.c
@@ -129,7 +129,7 @@ char *get_path(GtkWidget *item)
 
 struct tree_data *make_tree_data(guint32 type, const char *name)
 {
-  struct tree_data *p = (struct tree_data *)malloc(sizeof(struct tree_data));
+  struct tree_data *p = malloc_p(struct tree_data);
 
   if (p) {
 

diff --git a/source4/lib/util.c b/source4/lib/util.c
index 2351a98eae2782eb454d7b0566d71562158d3b75..2d149e6e3dcbecb75eb47337e27ad7cb94cc8bcc 100644 (file)
--- a/source4/lib/util.c
+++ b/source4/lib/util.c
@@ -796,3 +796,20 @@ BOOL all_zero(const uint8_t *ptr, uint_t size)
        }
        return True;
 }
+
+/*
+  realloc an array, checking for integer overflow in the array size
+*/
+void *realloc_array(void *ptr, size_t el_size, unsigned count)
+{
+#define MAX_MALLOC_SIZE 0x7fffffff
+       if (count == 0 ||
+           count >= MAX_MALLOC_SIZE/el_size) {
+               return NULL;
+       }
+       if (!ptr) {
+               return malloc(el_size * count);
+       }
+       return realloc(ptr, el_size * count);
+}
+

diff --git a/source4/libads/ldap.c b/source4/libads/ldap.c
index 9de73fcd0a0452b57725693c96eb8f26ebeee32a..d4b363cae646261b32dc77552bfec012fd69055d 100644 (file)
--- a/source4/libads/ldap.c
+++ b/source4/libads/ldap.c
@@ -1592,7 +1592,7 @@ char **ads_pull_strings(ADS_STRUCT *ads,
 
        *num_values = ldap_count_values(values);
 
-       ret = talloc(mem_ctx, sizeof(char *) * (*num_values+1));
+       ret = talloc_array_p(mem_ctx, char *, *num_values+1);
        if (!ret) {
                ldap_value_free(values);
                return NULL;
@@ -1839,7 +1839,7 @@ int ads_pull_sids(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
        for (i=0; values[i]; i++)
                /* nop */ ;
 
-       (*sids) = talloc(mem_ctx, sizeof(DOM_SID) * i);
+       (*sids) = talloc_array_p(mem_ctx, DOM_SID, i);
        if (!(*sids)) {
                ldap_value_free_len(values);
                return 0;

diff --git a/source4/libcli/ldap/ldap_client.c b/source4/libcli/ldap/ldap_client.c
index 7a72734c570e4956a05e5236a279365e53cc952b..88c84d880ba3300b103a9fc2aae3346150efba63 100644 (file)
--- a/source4/libcli/ldap/ldap_client.c
+++ b/source4/libcli/ldap/ldap_client.c
@@ -195,7 +195,7 @@ BOOL ldap_send_msg(struct ldap_connection *conn, struct ldap_message *msg,
            (msg->type == LDAP_TAG_UnbindRequest))
                return True;
 
-       entry = malloc(sizeof(*entry)); 
+       entry = malloc_p(struct ldap_queue_entry);
 
        if (entry == NULL)
                return False;
@@ -243,7 +243,7 @@ static struct ldap_message *recv_from_queue(struct ldap_connection *conn,
 static void add_search_entry(struct ldap_connection *conn,
                             struct ldap_message *msg)
 {
-       struct ldap_queue_entry *e = malloc(sizeof *e);
+       struct ldap_queue_entry *e = malloc_p(struct ldap_queue_entry);
 
        if (e == NULL)
                return;

diff --git a/source4/libcli/namequery.c b/source4/libcli/namequery.c
index 85270c10019265f24fd5be672af978372399b5db..66154ef8f6549e4c9b2dadd90f8c4f7a1d274321 100644 (file)
--- a/source4/libcli/namequery.c
+++ b/source4/libcli/namequery.c
@@ -63,7 +63,7 @@ static struct node_status *parse_node_status(char *p, int *num_names)
 
        if (*num_names == 0) return NULL;
 
-       ret = (struct node_status *)malloc(sizeof(struct node_status)* (*num_names));
+       ret = malloc_array_p(struct node_status, *num_names);
        if (!ret) return NULL;
 
        p++;
@@ -619,7 +619,7 @@ static BOOL resolve_hosts(const char *name,
        if (((hp = sys_gethostbyname(name)) != NULL) && (hp->h_addr != NULL)) {
                struct ipv4_addr return_ip;
                putip((char *)&return_ip,(char *)hp->h_addr);
-               *return_iplist = (struct ipv4_addr *)malloc(sizeof(struct ipv4_addr));
+               *return_iplist = malloc_p(struct ipv4_addr);
                if(*return_iplist == NULL) {
                        DEBUG(3,("resolve_hosts: malloc fail !\n"));
                        return False;
@@ -657,7 +657,7 @@ static BOOL internal_resolve_name(TALLOC_CTX *mem_ctx, const char *name, int nam
   DEBUG(10, ("internal_resolve_name: looking up %s#%x\n", name, name_type));
 
   if (allzeros || allones || is_address) {
-       *return_iplist = (struct ipv4_addr *)malloc(sizeof(struct ipv4_addr));
+       *return_iplist = malloc_p(struct ipv4_addr);
        if(*return_iplist == NULL) {
                DEBUG(3,("internal_resolve_name: malloc fail !\n"));
                return False;
@@ -731,8 +731,7 @@ static BOOL internal_resolve_name(TALLOC_CTX *mem_ctx, const char *name, int nam
      controllers including the PDC in iplist[1..n].  Iterating over
      the iplist when the PDC is down will cause two sets of timeouts. */
 
-  if (*return_count && (nodupes_iplist = (struct ipv4_addr *)
-       malloc(sizeof(struct ipv4_addr) * (*return_count)))) {
+  if (*return_count && (nodupes_iplist = malloc_array_p(struct ipv4_addr, *return_count))) {
          int nodupes_count = 0;
 
          /* Iterate over return_iplist looking for duplicates */
@@ -1156,7 +1155,7 @@ BOOL get_dc_list(TALLOC_CTX *mem_ctx, const char *domain, struct ipv4_addr **ip_
                if ( (num_addresses == 0) && !done_auto_lookup )
                        return internal_resolve_name(mem_ctx, domain, 0x1C, ip_list, count);
 
-               return_iplist = (struct ipv4_addr *)malloc(num_addresses * sizeof(struct ipv4_addr));
+               return_iplist = malloc_array_p(struct ipv4_addr, num_addresses);
 
                if (return_iplist == NULL) {
                        DEBUG(3,("get_dc_list: malloc fail !\n"));

diff --git a/source4/libcli/nmblib.c b/source4/libcli/nmblib.c
index 06030f9aca16d1b7a7eea0744ce304f5f6a7282b..70c6fab8da9a83011878e5cf2682c0db00da9bf9 100644 (file)
--- a/source4/libcli/nmblib.c
+++ b/source4/libcli/nmblib.c
@@ -548,24 +548,21 @@ static struct packet_struct *copy_nmb_packet(struct packet_struct *packet)
 
   if (nmb->answers)
   {
-    if((copy_nmb->answers = (struct res_rec *)
-                  malloc(nmb->header.ancount * sizeof(struct res_rec))) == NULL)
+    if((copy_nmb->answers = malloc_array_p(struct res_rec, nmb->header.ancount)) == NULL)
       goto free_and_exit;
     memcpy((char *)copy_nmb->answers, (char *)nmb->answers, 
            nmb->header.ancount * sizeof(struct res_rec));
   }
   if (nmb->nsrecs)
   {
-    if((copy_nmb->nsrecs = (struct res_rec *)
-                  malloc(nmb->header.nscount * sizeof(struct res_rec))) == NULL)
+    if((copy_nmb->nsrecs = malloc_array_p(struct res_rec, nmb->header.nscount)) == NULL)
       goto free_and_exit;
     memcpy((char *)copy_nmb->nsrecs, (char *)nmb->nsrecs, 
            nmb->header.nscount * sizeof(struct res_rec));
   }
   if (nmb->additional)
   {
-    if((copy_nmb->additional = (struct res_rec *)
-                  malloc(nmb->header.arcount * sizeof(struct res_rec))) == NULL)
+    if((copy_nmb->additional = malloc_array_p(struct res_rec, nmb->header.arcount)) == NULL)
       goto free_and_exit;
     memcpy((char *)copy_nmb->additional, (char *)nmb->additional, 
            nmb->header.arcount * sizeof(struct res_rec));
@@ -591,7 +588,7 @@ static struct packet_struct *copy_dgram_packet(struct packet_struct *packet)
 { 
   struct packet_struct *pkt_copy;
 
-  if(( pkt_copy = (struct packet_struct *)malloc(sizeof(*packet))) == NULL)
+  if(( pkt_copy = malloc_p(struct packet_struct)) == NULL)
   {
     DEBUG(0,("copy_dgram_packet: malloc fail.\n"));
     return NULL;
@@ -663,7 +660,7 @@ struct packet_struct *parse_packet(char *buf,int length,
        struct packet_struct *p;
        BOOL ok=False;
 
-       p = (struct packet_struct *)malloc(sizeof(*p));
+       p = malloc_p(struct packet_struct);
        if (!p) return(NULL);
 
        p->next = NULL;

diff --git a/source4/librpc/idl/security.idl b/source4/librpc/idl/security.idl
index 1ef1783073e0f239032bd12f7c19e478f2630165..90ae3d3028c7a95fe1dbd759e1620155174e755f 100644 (file)
--- a/source4/librpc/idl/security.idl
+++ b/source4/librpc/idl/security.idl
@@ -184,7 +184,7 @@ interface security
        typedef [public] struct {
                uint16 revision;
                [value(ndr_size_security_acl(r))] uint16 size;
-               uint32 num_aces;
+               [range(0,1000)] uint32 num_aces;
                security_ace aces[num_aces];
        } security_acl;
 

diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index 71019030ac3f72c2b4181ade25b5bb222f367e0b..857e1712245613870a75b71423c3a765e1d359ca 100644 (file)
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -125,7 +125,7 @@ struct ndr_push *ndr_push_init_ctx(TALLOC_CTX *mem_ctx)
 {
        struct ndr_push *ndr;
 
-       ndr = talloc(mem_ctx, sizeof(*ndr));
+       ndr = talloc_p(mem_ctx, struct ndr_push);
        if (!ndr) {
                return NULL;
        }

diff --git a/source4/librpc/rpc/dcerpc_auth.c b/source4/librpc/rpc/dcerpc_auth.c
index 7e581992faf92379e4f612480abcbe1e4bb5de0d..844746e3223198d167b623c141b06b6b024e923b 100644 (file)
--- a/source4/librpc/rpc/dcerpc_auth.c
+++ b/source4/librpc/rpc/dcerpc_auth.c
@@ -70,7 +70,7 @@ NTSTATUS dcerpc_bind_auth3(struct dcerpc_pipe *p, uint8_t auth_type, uint8_t aut
                }
        }
 
-       p->security_state.auth_info = talloc(p, sizeof(*p->security_state.auth_info));
+       p->security_state.auth_info = talloc_p(p, struct dcerpc_auth);
        if (!p->security_state.auth_info) {
                status = NT_STATUS_NO_MEMORY;
                goto done;
@@ -150,7 +150,7 @@ NTSTATUS dcerpc_bind_alter(struct dcerpc_pipe *p, uint8_t auth_type, uint8_t aut
                }
        }
 
-       p->security_state.auth_info = talloc(p, sizeof(*p->security_state.auth_info));
+       p->security_state.auth_info = talloc_p(p, struct dcerpc_auth);
        if (!p->security_state.auth_info) {
                status = NT_STATUS_NO_MEMORY;
                goto done;

diff --git a/source4/ntvfs/common/opendb.c b/source4/ntvfs/common/opendb.c
index 8947a5d25575f38d4e6fb2c954a7e1ef0498fe56..57beba8c6873a44ab65896572f37d7160f69b6e7 100644 (file)
--- a/source4/ntvfs/common/opendb.c
+++ b/source4/ntvfs/common/opendb.c
@@ -222,7 +222,6 @@ NTSTATUS odb_open_file(struct odb_lock *lck, void *file_handle,
        struct odb_context *odb = lck->odb;
        TDB_DATA dbuf;
        struct odb_entry e;
-       char *tp;
        int i, count;
        struct odb_entry *elist;
                
@@ -249,13 +248,13 @@ NTSTATUS odb_open_file(struct odb_lock *lck, void *file_handle,
                }
        }
 
-       tp = Realloc(dbuf.dptr, (count+1) * sizeof(struct odb_entry));
-       if (tp == NULL) {
+       elist = realloc_p(dbuf.dptr, struct odb_entry, count+1);
+       if (elist == NULL) {
                if (dbuf.dptr) free(dbuf.dptr);
                return NT_STATUS_NO_MEMORY;
        }
 
-       dbuf.dptr = tp;
+       dbuf.dptr = (char *)elist;
        dbuf.dsize = (count+1) * sizeof(struct odb_entry);
 
        memcpy(dbuf.dptr + (count*sizeof(struct odb_entry)),
@@ -279,7 +278,6 @@ NTSTATUS odb_open_file_pending(struct odb_lock *lck, void *private)
        struct odb_context *odb = lck->odb;
        TDB_DATA dbuf;
        struct odb_entry e;
-       char *tp;
        struct odb_entry *elist;
        int count;
                
@@ -299,13 +297,13 @@ NTSTATUS odb_open_file_pending(struct odb_lock *lck, void *private)
        elist = (struct odb_entry *)dbuf.dptr;
        count = dbuf.dsize / sizeof(struct odb_entry);
 
-       tp = Realloc(dbuf.dptr, (count+1) * sizeof(struct odb_entry));
-       if (tp == NULL) {
+       elist = realloc_p(dbuf.dptr, struct odb_entry, count+1);
+       if (elist == NULL) {
                if (dbuf.dptr) free(dbuf.dptr);
                return NT_STATUS_NO_MEMORY;
        }
 
-       dbuf.dptr = tp;
+       dbuf.dptr = (char *)elist;
        dbuf.dsize = (count+1) * sizeof(struct odb_entry);
 
        memcpy(dbuf.dptr + (count*sizeof(struct odb_entry)),

diff --git a/source4/ntvfs/ntvfs_base.c b/source4/ntvfs/ntvfs_base.c
index 136ef14e4cc4f45a61517bdc9d72af8d4ed8daa4..ca6fbf0de8bad5490f07e52dced5f3d80eef4873 100644 (file)
--- a/source4/ntvfs/ntvfs_base.c
+++ b/source4/ntvfs/ntvfs_base.c
@@ -32,7 +32,7 @@
 /* the list of currently registered NTVFS backends, note that there
  * can be more than one backend with the same name, as long as they
  * have different typesx */
-static struct {
+static struct ntvfs_backend {
        const struct ntvfs_ops *ops;
 } *backends = NULL;
 static int num_backends;
@@ -57,7 +57,7 @@ NTSTATUS ntvfs_register(const void *_ops)
                return NT_STATUS_OBJECT_NAME_COLLISION;
        }
 
-       backends = Realloc(backends, sizeof(backends[0]) * (num_backends+1));
+       backends = realloc_p(backends, struct ntvfs_backend, num_backends+1);
        if (!backends) {
                smb_panic("out of memory in ntvfs_register");
        }

diff --git a/source4/param/params.c b/source4/param/params.c
index 2a0cd13682fa5e1385351444a0490812ed9fc32a..a31d8d1b605aff139d0d525fd14e178644d320ac 100644 (file)
--- a/source4/param/params.c
+++ b/source4/param/params.c
@@ -522,7 +522,7 @@ static myFILE *OpenConfFile( const char *FileName )
   int lvl = in_client?1:0;
   myFILE *ret;
 
-  ret = (myFILE *)malloc(sizeof(*ret));
+  ret = malloc_p(myFILE);
   if (!ret) return NULL;
 
   ret->buf = file_load(FileName, &ret->size);

diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 3d34a7e1c0c1257ed175d5f8af2164100a91370f..d11d5dddd8788b6882df32a6809935d66e81a7b5 100644 (file)
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -1086,7 +1086,7 @@ static void dcesrv_exit(struct server_service *service, const char *reason)
 
 /* the list of currently registered DCERPC endpoint servers.
  */
-static struct {
+static struct ep_server {
        struct dcesrv_endpoint_server *ep_server;
 } *ep_servers = NULL;
 static int num_ep_servers;
@@ -1110,7 +1110,7 @@ NTSTATUS dcerpc_register_ep_server(const void *_ep_server)
                return NT_STATUS_OBJECT_NAME_COLLISION;
        }
 
-       ep_servers = Realloc(ep_servers, sizeof(ep_servers[0]) * (num_ep_servers+1));
+       ep_servers = realloc_p(ep_servers, struct ep_server, num_ep_servers+1);
        if (!ep_servers) {
                smb_panic("out of memory in dcerpc_register");
        }

diff --git a/source4/rpc_server/spoolss/dcesrv_spoolss.c b/source4/rpc_server/spoolss/dcesrv_spoolss.c
index 028471a715ab22ad82cbd9f939776d4a2e545192..17c23dcba84f56decd6dbbcf5330647a04788eae 100644 (file)
--- a/source4/rpc_server/spoolss/dcesrv_spoolss.c
+++ b/source4/rpc_server/spoolss/dcesrv_spoolss.c
@@ -33,7 +33,7 @@ static WERROR spoolss_EnumPrinters1(TALLOC_CTX *mem_ctx,
        struct spoolss_PrinterInfo1 *info;
        int i;
 
-       info = talloc(mem_ctx, num_msgs * sizeof(struct spoolss_PrinterInfo1));
+       info = talloc_array_p(mem_ctx, struct spoolss_PrinterInfo1, num_msgs);
 
        if (!info)
                return WERR_NOMEM;
@@ -59,7 +59,7 @@ static WERROR spoolss_EnumPrinters2(TALLOC_CTX *mem_ctx,
        struct spoolss_PrinterInfo2 *info;
        int i;
 
-       info = talloc(mem_ctx, num_msgs * sizeof(struct spoolss_PrinterInfo1));
+       info = talloc_array_p(mem_ctx, struct spoolss_PrinterInfo2, num_msgs);
 
        if (!info)
                return WERR_NOMEM;
@@ -102,7 +102,7 @@ static WERROR spoolss_EnumPrinters5(TALLOC_CTX *mem_ctx,
        struct spoolss_PrinterInfo5 *info;
        int i;
 
-       info = talloc(mem_ctx, num_msgs * sizeof(struct spoolss_PrinterInfo1));
+       info = talloc_array_p(mem_ctx, struct spoolss_PrinterInfo5, num_msgs);
 
        if (!info)
                return WERR_NOMEM;

diff --git a/source4/rpc_server/srvsvc/dcesrv_srvsvc.c b/source4/rpc_server/srvsvc/dcesrv_srvsvc.c
index d5ecd84f1a1635d4f753f6b96424865af603b20a..0679ac6e42bdac38d4d4f0ae45e0b641679c8068 100644 (file)
--- a/source4/rpc_server/srvsvc/dcesrv_srvsvc.c
+++ b/source4/rpc_server/srvsvc/dcesrv_srvsvc.c
@@ -904,7 +904,9 @@ static WERROR srvsvc_NetShareEnum(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
                if (r->out.ctr.ctr0->count == 0) break;
 
-               r->out.ctr.ctr0->array = talloc(mem_ctx, r->out.ctr.ctr0->count*sizeof(struct srvsvc_NetShareInfo0));
+               r->out.ctr.ctr0->array = talloc_array_p(mem_ctx, 
+                                                       struct srvsvc_NetShareInfo0, 
+                                                       r->out.ctr.ctr0->count);
                WERR_TALLOC_CHECK(r->out.ctr.ctr0->array);
 
                for (i=0;i<r->out.ctr.ctr0->count;i++) {
@@ -926,7 +928,9 @@ static WERROR srvsvc_NetShareEnum(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
                if (r->out.ctr.ctr1->count == 0) break;
 
-               r->out.ctr.ctr1->array = talloc(mem_ctx, r->out.ctr.ctr1->count*sizeof(struct srvsvc_NetShareInfo1));
+               r->out.ctr.ctr1->array = talloc_array_p(mem_ctx, 
+                                                       struct srvsvc_NetShareInfo1, 
+                                                       r->out.ctr.ctr1->count);
                WERR_TALLOC_CHECK(r->out.ctr.ctr1->array);
 
                for (i=0;i<r->out.ctr.ctr1->count;i++) {
@@ -949,7 +953,9 @@ static WERROR srvsvc_NetShareEnum(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
                if (r->out.ctr.ctr2->count == 0) break;
 
-               r->out.ctr.ctr2->array = talloc(mem_ctx, r->out.ctr.ctr2->count*sizeof(struct srvsvc_NetShareInfo2));
+               r->out.ctr.ctr2->array = talloc_array_p(mem_ctx, 
+                                                       struct srvsvc_NetShareInfo2,
+                                                       r->out.ctr.ctr2->count);
                WERR_TALLOC_CHECK(r->out.ctr.ctr2->array);
 
                for (i=0;i<r->out.ctr.ctr2->count;i++) {
@@ -977,7 +983,9 @@ static WERROR srvsvc_NetShareEnum(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
                if (r->out.ctr.ctr501->count == 0) break;
 
-               r->out.ctr.ctr501->array = talloc(mem_ctx, r->out.ctr.ctr501->count*sizeof(struct srvsvc_NetShareInfo501));
+               r->out.ctr.ctr501->array = talloc_array_p(mem_ctx, 
+                                                         struct srvsvc_NetShareInfo501,
+                                                         r->out.ctr.ctr501->count);
                WERR_TALLOC_CHECK(r->out.ctr.ctr501->array);
 
                for (i=0;i<r->out.ctr.ctr501->count;i++) {
@@ -1001,7 +1009,9 @@ static WERROR srvsvc_NetShareEnum(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
                if (r->out.ctr.ctr502->count == 0) break;
 
-               r->out.ctr.ctr502->array = talloc(mem_ctx, r->out.ctr.ctr502->count*sizeof(struct srvsvc_NetShareInfo502));
+               r->out.ctr.ctr502->array = talloc_array_p(mem_ctx, 
+                                                         struct srvsvc_NetShareInfo502,
+                                                         r->out.ctr.ctr502->count);
                WERR_TALLOC_CHECK(r->out.ctr.ctr502->array);
 
                for (i=0;i<r->out.ctr.ctr502->count;i++) {

diff --git a/source4/torture/locktest.c b/source4/torture/locktest.c
index d25625df1e067c1e6923e93068c8094eb65f99af..9c7c3632596da9aa1e8da87c85b282b661abb1f8 100644 (file)
--- a/source4/torture/locktest.c
+++ b/source4/torture/locktest.c
@@ -317,7 +317,7 @@ static void test_locks(char *share[NSERVERS])
        ZERO_STRUCT(fnum);
        ZERO_STRUCT(cli);
 
-       recorded = (struct record *)malloc(sizeof(*recorded) * numops);
+       recorded = malloc_array_p(struct record, numops);
 
        for (n=0; n<numops; n++) {
 #if PRESETS

diff --git a/source4/torture/locktest2.c b/source4/torture/locktest2.c
index 7d729ca94132866a9a8b09efb9efe655c6bb16ac..46254ad5e37d9085a66f64ad92a119b92d0353ae 100644 (file)
--- a/source4/torture/locktest2.c
+++ b/source4/torture/locktest2.c
@@ -359,7 +359,7 @@ static void test_locks(char *share1, char *share2, char *nfspath1, char *nfspath
        ZERO_STRUCT(fnum);
        ZERO_STRUCT(cli);
 
-       recorded = (struct record *)malloc(sizeof(*recorded) * numops);
+       recorded = malloc_array_p(struct record, numops);
 
        for (n=0; n<numops; n++) {
                recorded[n].conn = random() % NCONNECTIONS;

diff --git a/source4/torture/nsstest.c b/source4/torture/nsstest.c
index a82fa05203e270ab3d850f1a45d18881f4b0978e..376edada56a1134b3f7d284ff29a999b8118a930 100644 (file)
--- a/source4/torture/nsstest.c
+++ b/source4/torture/nsstest.c
@@ -292,7 +292,7 @@ static void nss_test_initgroups(char *name, gid_t gid)
        int i;
        NSS_STATUS status;
 
-       groups = (gid_t *)malloc(size * sizeof(gid_t));
+       groups = (gid_t *)malloc_array_p(gid_t, size);
        groups[0] = gid;
 
        status = nss_initgroups(name, gid, &groups, &start, &size);

diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c
index 83fb02f9d385b6d3e45135fda3c26e83e883cf31..f816b5dc1a0d2903114fdb19e19e1507e698fac5 100644 (file)
--- a/source4/torture/rpc/lsa.c
+++ b/source4/torture/rpc/lsa.c
@@ -118,7 +118,7 @@ static BOOL test_LookupNames(struct dcerpc_pipe *p,
        sids.count = 0;
        sids.sids = NULL;
 
-       names = talloc(mem_ctx, tnames->count * sizeof(names[0]));
+       names = talloc_array_p(mem_ctx, struct lsa_String, tnames->count);
        for (i=0;i<tnames->count;i++) {
                init_lsa_String(&names[i], tnames->names[i].name.string);
        }
@@ -160,7 +160,7 @@ static BOOL test_LookupNames2(struct dcerpc_pipe *p,
        sids.count = 0;
        sids.sids = NULL;
 
-       names = talloc(mem_ctx, tnames->count * sizeof(names[0]));
+       names = talloc_array_p(mem_ctx, struct lsa_String, tnames->count);
        for (i=0;i<tnames->count;i++) {
                init_lsa_String(&names[i], tnames->names[i].name.string);
        }

diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 0fa1bccace8108f98488103e2accb3e955f22312..c7456e2fdad3e67b84cdaa3266742bda138caeb5 100644 (file)
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -2136,7 +2136,7 @@ static BOOL test_EnumDomainUsers(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
        printf("Testing LookupNames\n");
        n.in.domain_handle = handle;
        n.in.num_names = r.out.sam->count;
-       n.in.names = talloc(mem_ctx, r.out.sam->count * sizeof(struct samr_String));
+       n.in.names = talloc_array_p(mem_ctx, struct samr_String, r.out.sam->count);
        for (i=0;i<r.out.sam->count;i++) {
                n.in.names[i] = r.out.sam->entries[i].name;
        }
@@ -2150,7 +2150,7 @@ static BOOL test_EnumDomainUsers(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
        printf("Testing LookupRids\n");
        lr.in.domain_handle = handle;
        lr.in.num_rids = r.out.sam->count;
-       lr.in.rids = talloc(mem_ctx, r.out.sam->count * sizeof(uint32_t));
+       lr.in.rids = talloc_array_p(mem_ctx, uint32_t, r.out.sam->count);
        for (i=0;i<r.out.sam->count;i++) {
                lr.in.rids[i] = r.out.sam->entries[i].idx;
        }

diff --git a/source4/torture/torture.c b/source4/torture/torture.c
index f5b45021c5f4c154930e1fff2fa8b93a443248aa..af5c9a2f8eee0bf6fef14b3f6db8d9fd3e075b6a 100644 (file)
--- a/source4/torture/torture.c
+++ b/source4/torture/torture.c
@@ -1422,7 +1422,7 @@ static BOOL run_pipe_number(void)
 
        printf("Opening %d connections\n", torture_numops);
        
-       cli = malloc(sizeof(struct smbcli_state *) * torture_numops);
+       cli = malloc_array_p(struct smbcli_state *, torture_numops);
 
        for (i=0;i<torture_numops;i++) {
                if (!torture_open_connection(&cli[i])) {