svn commit: samba r20090 - in branches: SAMBA_3_0/source/auth SAMBA_3_0/source/groupdb SAMBA_3_0/source/lib SAMBA_3_0/source/nsswitch SAMBA_3_0/source/passdb SAMBA_3_0/source/rpcclient SAMBA_3_0/source/smbd SAMBA_3_0_24/source/auth SAMBA_3_0_24/source/groupdb SAMBA_3_0_24/source/lib SAMBA_3_0_24/source/nsswitch SAMBA_3_0_24/source/passdb SAMBA_3_0_24/source/rpcclient SAMBA_3_0_24/source/smbd

[James Peach]

On 08/12/2006, at 6:58 PM, jra at samba.org wrote:

> Author: jra
> Date: 2006-12-09 02:58:18 +0000 (Sat, 09 Dec 2006)
> New Revision: 20090
>
> WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi? 
> view=rev&root=samba&rev=20090
>
> Log:
> Fix a class of bugs found by James Peach. Ensure
> we never mix malloc and talloc'ed contexts in the
> add_XX_to_array() and add_XX_to_array_unique()
> calls. Ensure that these calls always return
> False on out of memory, True otherwise and always
> check them. Ensure that the relevent parts of
> the conn struct and the nt_user_tokens are
> TALLOC_DESTROYED not SAFE_FREE'd.
> James - this should fix your crash bug in both
> branches.

Thanks Jeremy. One thing - in create_token_from_username, the gids  
array can be allocated on either tmp_ctx or mem_ctx. tmp_ctx is  
destroyed on exit, but mem_ctx is not, and can be the null context.  
Do you need to explicity free gids?

--
James Peach | jpeach at samba.org