r4231: commiting changes to 3.0.10samba-3.0.10

1 files changed, 64 insertions, 65 deletions

diff --git a/source/smbd/lanman.c b/source/smbd/lanman.c
index e7aa05b54a6..f4dad2ddb9c 100644
--- a/source/smbd/lanman.c
+++ b/source/smbd/lanman.c
@@ -753,7 +753,7 @@ static BOOL api_DosPrintQGetInfo(connection_struct *conn,
 		 */
 		*rdata_len = 0;
 		*rparam_len = 6;
-		*rparam = REALLOC(*rparam,*rparam_len);
+		*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 		SSVALS(*rparam,0,ERRunknownlevel);
 		SSVAL(*rparam,2,0);
 		SSVAL(*rparam,4,0);
@@ -780,7 +780,7 @@ static BOOL api_DosPrintQGetInfo(connection_struct *conn,
 	}
 
 	if (mdrcnt > 0) {
-		*rdata = REALLOC(*rdata,mdrcnt);
+		*rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
 		desc.base = *rdata;
 		desc.buflen = mdrcnt;
 	} else {
@@ -789,7 +789,7 @@ static BOOL api_DosPrintQGetInfo(connection_struct *conn,
 		 * init_package will return wrong size if buflen=0
 		 */
 		desc.buflen = getlen(desc.format);
-		desc.base = tmpdata = (char *) malloc (desc.buflen);
+		desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 	}
 
 	if (init_package(&desc,1,count)) {
@@ -809,7 +809,7 @@ static BOOL api_DosPrintQGetInfo(connection_struct *conn,
  
 	*rdata_len = desc.usedlen;
 	*rparam_len = 6;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 	SSVALS(*rparam,0,desc.errcode);
 	SSVAL(*rparam,2,0);
 	SSVAL(*rparam,4,desc.neededlen);
@@ -857,7 +857,7 @@ static BOOL api_DosPrintQEnum(connection_struct *conn, uint16 vuid, char* param,
      */
     *rdata_len = 0;
     *rparam_len = 6;
-    *rparam = REALLOC(*rparam,*rparam_len);
+    *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
     SSVALS(*rparam,0,ERRunknownlevel);
     SSVAL(*rparam,2,0);
     SSVAL(*rparam,4,0);
@@ -869,17 +869,17 @@ static BOOL api_DosPrintQEnum(connection_struct *conn, uint16 vuid, char* param,
     if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i))
       queuecnt++;
   if (uLevel > 0) {
-    if((queue = (print_queue_struct**)malloc(queuecnt*sizeof(print_queue_struct*))) == NULL) {
+    if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
       return False;
     }
     memset(queue,0,queuecnt*sizeof(print_queue_struct*));
-    if((status = (print_status_struct*)malloc(queuecnt*sizeof(print_status_struct))) == NULL) {
+    if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
       return False;
     }
     memset(status,0,queuecnt*sizeof(print_status_struct));
-    if((subcntarr = (int*)malloc(queuecnt*sizeof(int))) == NULL) {
+    if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
       DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
       return False;
     }
@@ -892,7 +892,7 @@ static BOOL api_DosPrintQEnum(connection_struct *conn, uint16 vuid, char* param,
  	n++;
       }
   }
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   desc.base = *rdata;
   desc.buflen = mdrcnt;
 
@@ -911,7 +911,7 @@ static BOOL api_DosPrintQEnum(connection_struct *conn, uint16 vuid, char* param,
  
   *rdata_len = desc.usedlen;
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,succnt);
@@ -995,8 +995,7 @@ static int get_server_info(uint32 servertype,
       struct srv_info_struct *ts;
       
       alloced += 10;
-      ts = (struct srv_info_struct *)
-	Realloc(*servers,sizeof(**servers)*alloced);
+      ts = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
       if (!ts) {
       	DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
 	return(0);
@@ -1242,7 +1241,7 @@ static BOOL api_RNetServerEnum(connection_struct *conn, uint16 vuid, char *param
   }
 
   *rdata_len = fixed_len + string_len;
-  *rdata = REALLOC(*rdata,*rdata_len);
+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
   memset(*rdata,'\0',*rdata_len);
   
   p2 = (*rdata) + fixed_len;	/* auxilliary data (strings) will go here */
@@ -1266,7 +1265,7 @@ static BOOL api_RNetServerEnum(connection_struct *conn, uint16 vuid, char *param
   }
   
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,counted);
@@ -1303,7 +1302,7 @@ static BOOL api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid, char *pa
   *rdata_len = 0;
   
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
   SSVAL(*rparam,0,0x08AC); /* informational warning message */
   SSVAL(*rparam,2,0);
@@ -1449,13 +1448,13 @@ static BOOL api_RNetShareGetInfo(connection_struct *conn,uint16 vuid, char *para
   if (!prefix_ok(str1,"zWrLh")) return False;
   if (!check_share_info(uLevel,str2)) return False;
  
-  *rdata = REALLOC(*rdata,mdrcnt);
+  *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   p = *rdata;
   *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
   if (*rdata_len < 0) return False;
  
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVAL(*rparam,0,NERR_Success);
   SSVAL(*rparam,2,0);		/* converter word */
   SSVAL(*rparam,4,*rdata_len);
@@ -1520,7 +1519,7 @@ static BOOL api_RNetShareEnum( connection_struct *conn,
     }
   }
   *rdata_len = fixed_len + string_len;
-  *rdata = REALLOC(*rdata,*rdata_len);
+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
   memset(*rdata,0,*rdata_len);
   
   p2 = (*rdata) + fixed_len;	/* auxiliary data (strings) will go here */
@@ -1541,7 +1540,7 @@ static BOOL api_RNetShareEnum( connection_struct *conn,
     }
   
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,counted);
@@ -1627,7 +1626,7 @@ static BOOL api_RNetShareAdd(connection_struct *conn,uint16 vuid, char *param,ch
   } else return False;
 
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVAL(*rparam,0,NERR_Success);
   SSVAL(*rparam,2,0);		/* converter word */
   SSVAL(*rparam,4,*rdata_len);
@@ -1637,7 +1636,7 @@ static BOOL api_RNetShareAdd(connection_struct *conn,uint16 vuid, char *param,ch
 
  error_exit:
   *rparam_len = 4;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   *rdata_len = 0;
   SSVAL(*rparam,0,res);
   SSVAL(*rparam,2,0);
@@ -1692,7 +1691,7 @@ static BOOL api_RNetGroupEnum(connection_struct *conn,uint16 vuid, char *param,c
 	DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: %d\n", resume_context, cli_buf_size));
 
 	*rdata_len = cli_buf_size;
-	*rdata = REALLOC(*rdata,*rdata_len);
+	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
 
 	p = *rdata;
 
@@ -1714,7 +1713,7 @@ static BOOL api_RNetGroupEnum(connection_struct *conn,uint16 vuid, char *param,c
 	*rdata_len = PTR_DIFF(p,*rdata);
 
 	*rparam_len = 8;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
   	SSVAL(*rparam, 0, errflags);
   	SSVAL(*rparam, 2, 0);		/* converter word */
@@ -1750,7 +1749,7 @@ static BOOL api_NetUserGetGroups(connection_struct *conn,uint16 vuid, char *para
 	DOM_SID sid, dom_sid;
 
 	*rparam_len = 8;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   
 	/* check it's a supported varient */
 	
@@ -1769,7 +1768,7 @@ static BOOL api_NetUserGetGroups(connection_struct *conn,uint16 vuid, char *para
 		return False;
 
 	*rdata_len = mdrcnt + 1024;
-	*rdata = REALLOC(*rdata,*rdata_len);
+	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
 
 	SSVAL(*rparam,0,NERR_Success);
 	SSVAL(*rparam,2,0);		/* converter word */
@@ -1864,14 +1863,14 @@ static BOOL api_RNetUserEnum(connection_struct *conn,uint16 vuid, char *param,ch
 	DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n", resume_context, cli_buf_size));
 
 	*rparam_len = 8;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
 	/* check it's a supported varient */
 	if (strcmp("B21",str2) != 0)
 		return False;
 
 	*rdata_len = cli_buf_size;
-	*rdata = REALLOC(*rdata,*rdata_len);
+	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
 
 	p = *rdata;
 
@@ -1934,10 +1933,10 @@ static BOOL api_NetRemoteTOD(connection_struct *conn,uint16 vuid, char *param,ch
 {
   char *p;
   *rparam_len = 4;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
   *rdata_len = 21;
-  *rdata = REALLOC(*rdata,*rdata_len);
+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
 
   SSVAL(*rparam,0,NERR_Success);
   SSVAL(*rparam,2,0);		/* converter word */
@@ -1996,7 +1995,7 @@ static BOOL api_SetUserPassword(connection_struct *conn,uint16 vuid, char *param
 	memcpy(pass2,p+16,16);
 
 	*rparam_len = 4;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
 	*rdata_len = 0;
 
@@ -2068,7 +2067,7 @@ static BOOL api_SamOEMChangePassword(connection_struct *conn,uint16 vuid, char *
 	fstring user;
 	char *p = param + 2;
 	*rparam_len = 2;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
 	*rdata_len = 0;
 
@@ -2135,7 +2134,7 @@ static BOOL api_RDosPrintJobDel(connection_struct *conn,uint16 vuid, char *param
 		return(False);
 
 	*rparam_len = 4;
-	*rparam = REALLOC(*rparam,*rparam_len);	
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);	
 	*rdata_len = 0;
 
 	if (!print_job_exists(sharename, jobid)) {
@@ -2192,7 +2191,7 @@ static BOOL api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid, char *param
 		return(False);
 
 	*rparam_len = 4;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 	*rdata_len = 0;
 
 	snum = print_queue_snum(QueueName);
@@ -2266,7 +2265,7 @@ static BOOL api_PrintJobInfo(connection_struct *conn,uint16 vuid,char *param,cha
 	if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
 		return False;
 	*rparam_len = 4;
-	*rparam = REALLOC(*rparam,*rparam_len);
+	*rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
 	if ( (snum = lp_servicenumber(sharename)) == -1 ) {
 		DEBUG(0,("api_PrintJobInfo: unable to get service number from sharename [%s]\n",
@@ -2367,7 +2366,7 @@ static BOOL api_RNetServerGetInfo(connection_struct *conn,uint16 vuid, char *par
   }
 
   *rdata_len = mdrcnt;
-  *rdata = REALLOC(*rdata,*rdata_len);
+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
 
   p = *rdata;
   p2 = p + struct_len;
@@ -2416,7 +2415,7 @@ static BOOL api_RNetServerGetInfo(connection_struct *conn,uint16 vuid, char *par
   *rdata_len = PTR_DIFF(p2,*rdata);
 
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVAL(*rparam,0,NERR_Success);
   SSVAL(*rparam,2,0);		/* converter word */
   SSVAL(*rparam,4,*rdata_len);
@@ -2443,14 +2442,14 @@ static BOOL api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid, char *param
   DEBUG(4,("NetWkstaGetInfo level %d\n",level));
 
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
   /* check it's a supported varient */
   if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz")))
     return(False);
 
   *rdata_len = mdrcnt + 1024;
-  *rdata = REALLOC(*rdata,*rdata_len);
+  *rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
 
   SSVAL(*rparam,0,NERR_Success);
   SSVAL(*rparam,2,0);		/* converter word */
@@ -2689,7 +2688,7 @@ static BOOL api_RNetUserGetInfo(connection_struct *conn,uint16 vuid, char *param
 	       vuser->user.unix_name));
 
     *rparam_len = 6;
-    *rparam = REALLOC(*rparam,*rparam_len);
+    *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
     DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
   
@@ -2708,7 +2707,7 @@ static BOOL api_RNetUserGetInfo(connection_struct *conn,uint16 vuid, char *param
 	if (strcmp(level_string,str2) != 0) return False;
 
 	*rdata_len = mdrcnt + 1024;
-	*rdata = REALLOC(*rdata,*rdata_len);
+	*rdata = SMB_REALLOC_LIMIT(*rdata,*rdata_len);
 
 	SSVAL(*rparam,0,NERR_Success);
 	SSVAL(*rparam,2,0);		/* converter word */
@@ -2855,7 +2854,7 @@ static BOOL api_WWkstaUserLogon(connection_struct *conn,uint16 vuid, char *param
   /* check it's a supported varient */
   if (strcmp(str1,"OOWb54WrLh") != 0) return False;
   if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) return False;
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   desc.base = *rdata;
   desc.buflen = mdrcnt;
   desc.subformat = NULL;
@@ -2894,7 +2893,7 @@ static BOOL api_WWkstaUserLogon(connection_struct *conn,uint16 vuid, char *param
 
   *rdata_len = desc.usedlen;
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,desc.neededlen);
@@ -2924,7 +2923,7 @@ static BOOL api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid, char *p
   if (strcmp(str2,"") != 0) return False;
 
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,0);		/* errorcode */
   SSVAL(*rparam,2,0);		/* converter word */
   SSVAL(*rparam,4,0x7f);	/* permission flags */
@@ -2976,7 +2975,7 @@ static BOOL api_WPrintJobGetInfo(connection_struct *conn,uint16 vuid, char *para
   }
 
   if (mdrcnt > 0) {
-    *rdata = REALLOC(*rdata,mdrcnt);
+    *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
     desc.base = *rdata;
     desc.buflen = mdrcnt;
   } else {
@@ -2985,7 +2984,7 @@ static BOOL api_WPrintJobGetInfo(connection_struct *conn,uint16 vuid, char *para
      *  init_package will return wrong size if buflen=0
      */
     desc.buflen = getlen(desc.format);
-    desc.base = tmpdata = (char *)malloc ( desc.buflen );
+    desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
   }
 
   if (init_package(&desc,1,0)) {
@@ -3000,7 +2999,7 @@ static BOOL api_WPrintJobGetInfo(connection_struct *conn,uint16 vuid, char *para
   }
 
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,desc.neededlen);
@@ -3054,7 +3053,7 @@ static BOOL api_WPrintJobEnumerate(connection_struct *conn,uint16 vuid, char *pa
   if (snum < 0 || !VALID_SNUM(snum)) return(False);
 
   count = print_queue_status(snum,&queue,&status);
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   desc.base = *rdata;
   desc.buflen = mdrcnt;
 
@@ -3069,7 +3068,7 @@ static BOOL api_WPrintJobEnumerate(connection_struct *conn,uint16 vuid, char *pa
   *rdata_len = desc.usedlen;
 
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,succnt);
@@ -3170,7 +3169,7 @@ static BOOL api_WPrintDestGetInfo(connection_struct *conn,uint16 vuid, char *par
   }
   else {
     if (mdrcnt > 0) {
-      *rdata = REALLOC(*rdata,mdrcnt);
+      *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
       desc.base = *rdata;
       desc.buflen = mdrcnt;
     } else {
@@ -3179,7 +3178,7 @@ static BOOL api_WPrintDestGetInfo(connection_struct *conn,uint16 vuid, char *par
        *  init_package will return wrong size if buflen=0
        */
       desc.buflen = getlen(desc.format);
-      desc.base = tmpdata = (char *)malloc ( desc.buflen );
+      desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
     }
     if (init_package(&desc,1,0)) {
       fill_printdest_info(conn,snum,uLevel,&desc);
@@ -3188,7 +3187,7 @@ static BOOL api_WPrintDestGetInfo(connection_struct *conn,uint16 vuid, char *par
   }
 
   *rparam_len = 6;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,desc.neededlen);
@@ -3227,7 +3226,7 @@ static BOOL api_WPrintDestEnum(connection_struct *conn,uint16 vuid, char *param,
     if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i))
       queuecnt++;
 
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   desc.base = *rdata;
   desc.buflen = mdrcnt;
   if (init_package(&desc,queuecnt,0)) {    
@@ -3245,7 +3244,7 @@ static BOOL api_WPrintDestEnum(connection_struct *conn,uint16 vuid, char *param,
   *rdata_len = desc.usedlen;
 
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,succnt);
@@ -3277,7 +3276,7 @@ static BOOL api_WPrintDriverEnum(connection_struct *conn,uint16 vuid, char *para
   if (strcmp(str1,"WrLeh") != 0) return False;
   if (uLevel != 0 || strcmp(str2,"B41") != 0) return False;
 
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   desc.base = *rdata;
   desc.buflen = mdrcnt;
   if (init_package(&desc,1,0)) {
@@ -3289,7 +3288,7 @@ static BOOL api_WPrintDriverEnum(connection_struct *conn,uint16 vuid, char *para
   *rdata_len = desc.usedlen;
 
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,succnt);
@@ -3321,7 +3320,7 @@ static BOOL api_WPrintQProcEnum(connection_struct *conn,uint16 vuid, char *param
   if (strcmp(str1,"WrLeh") != 0) return False;
   if (uLevel != 0 || strcmp(str2,"B13") != 0) return False;
 
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   desc.base = *rdata;
   desc.buflen = mdrcnt;
   desc.format = str2;
@@ -3334,7 +3333,7 @@ static BOOL api_WPrintQProcEnum(connection_struct *conn,uint16 vuid, char *param
   *rdata_len = desc.usedlen;
 
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,succnt);
@@ -3366,7 +3365,7 @@ static BOOL api_WPrintPortEnum(connection_struct *conn,uint16 vuid, char *param,
   if (strcmp(str1,"WrLeh") != 0) return False;
   if (uLevel != 0 || strcmp(str2,"B9") != 0) return False;
 
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   memset((char *)&desc,'\0',sizeof(desc));
   desc.base = *rdata;
   desc.buflen = mdrcnt;
@@ -3380,7 +3379,7 @@ static BOOL api_WPrintPortEnum(connection_struct *conn,uint16 vuid, char *param,
   *rdata_len = desc.usedlen;
 
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0);
   SSVAL(*rparam,4,succnt);
@@ -3422,7 +3421,7 @@ static BOOL api_RNetSessionEnum(connection_struct *conn,uint16 vuid, char *param
 
   num_sessions = list_sessions(&session_list);
 
-  if (mdrcnt > 0) *rdata = REALLOC(*rdata,mdrcnt);
+  if (mdrcnt > 0) *rdata = SMB_REALLOC_LIMIT(*rdata,mdrcnt);
   memset((char *)&desc,'\0',sizeof(desc));
   desc.base = *rdata;
   desc.buflen = mdrcnt;
@@ -3446,7 +3445,7 @@ static BOOL api_RNetSessionEnum(connection_struct *conn,uint16 vuid, char *param
   *rdata_len = desc.usedlen;
 
   *rparam_len = 8;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
   SSVALS(*rparam,0,desc.errcode);
   SSVAL(*rparam,2,0); /* converter */
   SSVAL(*rparam,4,num_sessions); /* count */
@@ -3466,7 +3465,7 @@ static BOOL api_TooSmall(connection_struct *conn,uint16 vuid, char *param,char *
 			 int *rdata_len,int *rparam_len)
 {
   *rparam_len = MIN(*rparam_len,mprcnt);
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
   *rdata_len = 0;
 
@@ -3488,7 +3487,7 @@ static BOOL api_Unsupported(connection_struct *conn,uint16 vuid, char *param,cha
 			    int *rdata_len,int *rparam_len)
 {
   *rparam_len = 4;
-  *rparam = REALLOC(*rparam,*rparam_len);
+  *rparam = SMB_REALLOC_LIMIT(*rparam,*rparam_len);
 
   *rdata_len = 0;
 
@@ -3595,11 +3594,11 @@ int api_reply(connection_struct *conn,uint16 vuid,char *outbuf,char *data,char *
 		  return ERROR_NT(NT_STATUS_ACCESS_DENIED);
   }
 
-  rdata = (char *)malloc(1024);
+  rdata = (char *)SMB_MALLOC(1024);
   if (rdata)
     memset(rdata,'\0',1024);
 
-  rparam = (char *)malloc(1024);
+  rparam = (char *)SMB_MALLOC(1024);
   if (rparam)
     memset(rparam,'\0',1024);