r13915: Fixed a very interesting class of realloc() bugs found by Coverity.

realloc can return NULL in one of two cases - (1) the realloc failed,
(2) realloc succeeded but the new size requested was zero, in which
case this is identical to a free() call.

The error paths dealing with these two cases should be different,
but mostly weren't. Secondly the standard idiom for dealing with
realloc when you know the new size is non-zero is the following :

 tmp = realloc(p, size);
 if (!tmp) {
    SAFE_FREE(p);
    return error;
 } else {
    p = tmp;
 }

However, there were *many* *many* places in Samba where we were
using the old (broken) idiom of :

 p = realloc(p, size)
 if (!p) {
    return error;
 }

which will leak the memory pointed to by p on realloc fail.

This commit (hopefully) fixes all these cases by moving to
a standard idiom of :

 p = SMB_REALLOC(p, size)
 if (!p) {
    return error;
 }

Where if the realloc returns null due to the realloc failing
or size == 0 we *guarentee* that the storage pointed to by p
has been freed. This allows me to remove a lot of code that
was dealing with the standard (more verbose) method that required
a tmp pointer. This is almost always what you want. When a
realloc fails you never usually want the old memory, you
want to free it and get into your error processing asap.

For the 11 remaining cases where we really do need to keep the
old pointer I have invented the new macro SMB_REALLOC_KEEP_OLD_ON_ERROR,
which can be used as follows :

 tmp = SMB_REALLOC_KEEP_OLD_ON_ERROR(p, size);
 if (!tmp) {
    SAFE_FREE(p);
    return error;
 } else {
    p = tmp;
 }

SMB_REALLOC_KEEP_OLD_ON_ERROR guarentees never to free the
pointer p, even on size == 0 or realloc fail. All this is
done by a hidden extra argument to Realloc(), BOOL free_old_on_error
which is set appropriately by the SMB_REALLOC and SMB_REALLOC_KEEP_OLD_ON_ERROR
macros (and their array counterparts).

It remains to be seen what this will do to our Coverity bug count :-).

Jeremy.

6 files changed, 34 insertions, 51 deletions

diff --git a/source/libsmb/asn1.c b/source/libsmb/asn1.c
index 09998407941..072fd302830 100644
--- a/source/libsmb/asn1.c
+++ b/source/libsmb/asn1.c
@@ -31,14 +31,11 @@ BOOL asn1_write(ASN1_DATA *data, const void *p, int len)
 {
 	if (data->has_error) return False;
 	if (data->length < data->ofs+len) {
-		uint8 *newp;
-		newp = SMB_REALLOC(data->data, data->ofs+len);
-		if (!newp) {
-			SAFE_FREE(data->data);
+		data->data = SMB_REALLOC(data->data, data->ofs+len);
+		if (!data->data) {
 			data->has_error = True;
 			return False;
 		}
-		data->data = newp;
 		data->length = data->ofs+len;
 	}
 	memcpy(data->data + data->ofs, p, len);
diff --git a/source/libsmb/clilist.c b/source/libsmb/clilist.c
index 252dafcfa8b..1bd30c36e3c 100644
--- a/source/libsmb/clilist.c
+++ b/source/libsmb/clilist.c
@@ -179,7 +179,7 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 	pstring mask;
 	file_info finfo;
 	int i;
-	char *tdl, *dirlist = NULL;
+	char *dirlist = NULL;
 	int dirlist_len = 0;
 	int total_received = -1;
 	BOOL First = True;
@@ -338,15 +338,13 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute,
 
 		/* grab the data for later use */
 		/* and add them to the dirlist pool */
-		tdl = SMB_REALLOC(dirlist,dirlist_len + data_len);
+		dirlist = SMB_REALLOC(dirlist,dirlist_len + data_len);
 
-		if (!tdl) {
+		if (!dirlist) {
 			DEBUG(0,("cli_list_new: Failed to expand dirlist\n"));
 			SAFE_FREE(rdata);
 			SAFE_FREE(rparam);
 			break;
-		} else {
-			dirlist = tdl;
 		}
 
 		memcpy(dirlist+dirlist_len,p,data_len);
@@ -421,7 +419,7 @@ int cli_list_old(struct cli_state *cli,const char *Mask,uint16 attribute,
 	int num_asked = (cli->max_xmit - 100)/DIR_STRUCT_SIZE;
 	int num_received = 0;
 	int i;
-	char *tdl, *dirlist = NULL;
+	char *dirlist = NULL;
 	pstring mask;
 	
 	ZERO_ARRAY(status);
@@ -466,14 +464,11 @@ int cli_list_old(struct cli_state *cli,const char *Mask,uint16 attribute,
 
 		first = False;
 
-		tdl = SMB_REALLOC(dirlist,(num_received + received)*DIR_STRUCT_SIZE);
-
-		if (!tdl) {
+		dirlist = SMB_REALLOC(dirlist,(num_received + received)*DIR_STRUCT_SIZE);
+		if (!dirlist) {
 			DEBUG(0,("cli_list_old: failed to expand dirlist"));
-			SAFE_FREE(dirlist);
 			return 0;
 		}
-		else dirlist = tdl;
 
 		p = smb_buf(cli->inbuf) + 3;
 
diff --git a/source/libsmb/clireadwrite.c b/source/libsmb/clireadwrite.c
index a080bd3c64d..650822bf8ed 100644
--- a/source/libsmb/clireadwrite.c
+++ b/source/libsmb/clireadwrite.c
@@ -262,9 +262,14 @@ static BOOL cli_issue_write(struct cli_state *cli, int fnum, off_t offset,
 
 	if (size > cli->bufsize) {
 		cli->outbuf = SMB_REALLOC(cli->outbuf, size + 1024);
+		if (!cli->outbuf) {
+			return False;
+		}
 		cli->inbuf = SMB_REALLOC(cli->inbuf, size + 1024);
-		if (cli->outbuf == NULL || cli->inbuf == NULL)
+		if (cli->inbuf == NULL) {
+			SAFE_FREE(cli->outbuf);
 			return False;
+		}
 		cli->bufsize = size + 1024;
 	}
 
diff --git a/source/libsmb/clitrans.c b/source/libsmb/clitrans.c
index 5d3710b92e2..8296f7e94c1 100644
--- a/source/libsmb/clitrans.c
+++ b/source/libsmb/clitrans.c
@@ -169,8 +169,6 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 	unsigned int total_param=0;
 	unsigned int this_data,this_param;
 	NTSTATUS status;
-	char *tdata;
-	char *tparam;
 
 	*data_len = *param_len = 0;
 
@@ -209,25 +207,21 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans,
 
 	/* allocate it */
 	if (total_data!=0) {
-		tdata = SMB_REALLOC(*data,total_data);
-		if (!tdata) {
+		*data = SMB_REALLOC(*data,total_data);
+		if (!(*data)) {
 			DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 			cli_signing_trans_stop(cli);
 			return False;
 		}
-		else
-			*data = tdata;
 	}
 
 	if (total_param!=0) {
-		tparam = SMB_REALLOC(*param,total_param);
-		if (!tparam) {
+		*param = SMB_REALLOC(*param,total_param);
+		if (!(*param)) {
 			DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 			cli_signing_trans_stop(cli);
 			return False;
 		}
-		else
-			*param = tparam;
 	}
 
 	for (;;)  {
@@ -476,8 +470,6 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 	unsigned int this_data,this_param;
 	uint8 eclass;
 	uint32 ecode;
-	char *tdata;
-	char *tparam;
 
 	*data_len = *param_len = 0;
 
@@ -526,24 +518,20 @@ BOOL cli_receive_nt_trans(struct cli_state *cli,
 
 	/* allocate it */
 	if (total_data) {
-		tdata = SMB_REALLOC(*data,total_data);
-		if (!tdata) {
+		*data = SMB_REALLOC(*data,total_data);
+		if (!(*data)) {
 			DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 			cli_signing_trans_stop(cli);
 			return False;
-		} else {
-			*data = tdata;
 		}
 	}
 
 	if (total_param) {
-		tparam = SMB_REALLOC(*param,total_param);
-		if (!tparam) {
+		*param = SMB_REALLOC(*param,total_param);
+		if (!(*param)) {
 			DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 			cli_signing_trans_stop(cli);
 			return False;
-		} else {
-			*param = tparam;
 		}
 	}
 
diff --git a/source/libsmb/namequery.c b/source/libsmb/namequery.c
index f78c368eb8c..c721a9deff6 100644
--- a/source/libsmb/namequery.c
+++ b/source/libsmb/namequery.c
@@ -501,7 +501,6 @@ struct in_addr *name_query(int fd,const char *name,int name_type,
 	
 	while (1) {
 		struct timeval tval2;
-		struct in_addr *tmp_ip_list;
 		
 		GetTimeOfDay(&tval2);
 		if (TvalDiff(&tval,&tval2) > retry_time) {
@@ -566,27 +565,22 @@ struct in_addr *name_query(int fd,const char *name,int name_type,
 				continue;
 			}
 			
-			tmp_ip_list = SMB_REALLOC_ARRAY( ip_list, struct in_addr,
+			ip_list = SMB_REALLOC_ARRAY( ip_list, struct in_addr,
 						(*count) + nmb2->answers->rdlength/6 );
 			
-			if (!tmp_ip_list) {
+			if (!ip_list) {
 				DEBUG(0,("name_query: Realloc failed.\n"));
-				SAFE_FREE(ip_list);
 				free_packet(p2);
 				return( NULL );
 			}
 			
-			ip_list = tmp_ip_list;
-			
-			if (ip_list) {
-				DEBUG(2,("Got a positive name query response from %s ( ", inet_ntoa(p2->ip)));
-				for (i=0;i<nmb2->answers->rdlength/6;i++) {
-					putip((char *)&ip_list[(*count)],&nmb2->answers->rdata[2+i*6]);
-					DEBUGADD(2,("%s ",inet_ntoa(ip_list[(*count)])));
-					(*count)++;
-				}
-				DEBUGADD(2,(")\n"));
+			DEBUG(2,("Got a positive name query response from %s ( ", inet_ntoa(p2->ip)));
+			for (i=0;i<nmb2->answers->rdlength/6;i++) {
+				putip((char *)&ip_list[(*count)],&nmb2->answers->rdata[2+i*6]);
+				DEBUGADD(2,("%s ",inet_ntoa(ip_list[(*count)])));
+				(*count)++;
 			}
+			DEBUGADD(2,(")\n"));
 			
 			found=True;
 			retries=0;
diff --git a/source/libsmb/spnego.c b/source/libsmb/spnego.c
index f6a66200bac..a2839578aef 100644
--- a/source/libsmb/spnego.c
+++ b/source/libsmb/spnego.c
@@ -48,6 +48,10 @@ static BOOL read_negTokenInit(ASN1_DATA *asn1, negTokenInit_t *token)
 				char *p_oid = NULL;
 				token->mechTypes = 
 					SMB_REALLOC_ARRAY(token->mechTypes, const char *, i + 2);
+				if (!token->mechTypes) {
+					asn1->has_error = True;
+					return False;
+				}
 				asn1_read_OID(asn1, &p_oid);
 				token->mechTypes[i] = p_oid;
 			}