svn commit: samba r13980 - branches/SAMBA_3_0/source/smbd trunk/source/smbd

[vlendec at samba.org]

Author: vlendec
Date: 2006-03-07 19:52:26 +0000 (Tue, 07 Mar 2006)
New Revision: 13980

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=13980

Log:
Fix Coverity bug # 63. Jeremy, could you take a look at this?

Thanks,

Volker


Modified:
   branches/SAMBA_3_0/source/smbd/ipc.c
   trunk/source/smbd/ipc.c


Changeset:
Modified: branches/SAMBA_3_0/source/smbd/ipc.c
===================================================================
--- branches/SAMBA_3_0/source/smbd/ipc.c	2006-03-07 19:24:28 UTC (rev 13979)
+++ branches/SAMBA_3_0/source/smbd/ipc.c	2006-03-07 19:52:26 UTC (rev 13980)
@@ -380,7 +380,7 @@
 	unsigned int dscnt = SVAL(inbuf,smb_vwv11);
 	unsigned int dsoff = SVAL(inbuf,smb_vwv12);
 	unsigned int suwcnt = CVAL(inbuf,smb_vwv13);
-	fstring local_machine_name;
+	char *local_machine_name;
 	START_PROFILE(SMBtrans);
 
 	memset(name, '\0',sizeof(name));
@@ -542,12 +542,23 @@
 	 * WinCE wierdness....
 	 */
 
-	fstrcpy( local_machine_name, get_local_machine_name() );
+	asprintf(&local_machine_name, "\\%s\\", get_local_machine_name());
 
-	if (name[0] == '\\' && (StrnCaseCmp(&name[1],local_machine_name, strlen(local_machine_name)) == 0) &&
-			(name[strlen(local_machine_name)+1] == '\\'))
-		name_offset = strlen(local_machine_name)+1;
+	if (local_machine_name == NULL) {
+		srv_signing_trans_stop();
+		SAFE_FREE(data);
+		SAFE_FREE(params);
+		SAFE_FREE(setup);
+		END_PROFILE(SMBtrans);
+		return ERROR_NT(NT_STATUS_NO_MEMORY);
+	}
 
+	if (strnequal(name, local_machine_name,	strlen(local_machine_name))) {
+		name_offset = strlen(local_machine_name)-1;
+	}
+
+	SAFE_FREE(local_machine_name);
+
 	if (strnequal(&name[name_offset], "\\PIPE", strlen("\\PIPE"))) {
 		name_offset += strlen("\\PIPE");
 

Modified: trunk/source/smbd/ipc.c
===================================================================
--- trunk/source/smbd/ipc.c	2006-03-07 19:24:28 UTC (rev 13979)
+++ trunk/source/smbd/ipc.c	2006-03-07 19:52:26 UTC (rev 13980)
@@ -380,7 +380,7 @@
 	unsigned int dscnt = SVAL(inbuf,smb_vwv11);
 	unsigned int dsoff = SVAL(inbuf,smb_vwv12);
 	unsigned int suwcnt = CVAL(inbuf,smb_vwv13);
-	fstring local_machine_name;
+	char *local_machine_name;
 	START_PROFILE(SMBtrans);
 
 	memset(name, '\0',sizeof(name));
@@ -542,12 +542,23 @@
 	 * WinCE wierdness....
 	 */
 
-	fstrcpy( local_machine_name, get_local_machine_name() );
+	asprintf(&local_machine_name, "\\%s\\", get_local_machine_name());
 
-	if (name[0] == '\\' && (StrnCaseCmp(&name[1],local_machine_name, strlen(local_machine_name)) == 0) &&
-			(name[strlen(local_machine_name)+1] == '\\'))
-		name_offset = strlen(local_machine_name)+1;
+	if (local_machine_name == NULL) {
+		srv_signing_trans_stop();
+		SAFE_FREE(data);
+		SAFE_FREE(params);
+		SAFE_FREE(setup);
+		END_PROFILE(SMBtrans);
+		return ERROR_NT(NT_STATUS_NO_MEMORY);
+	}
 
+	if (strnequal(name, local_machine_name,	strlen(local_machine_name))) {
+		name_offset = strlen(local_machine_name)-1;
+	}
+
+	SAFE_FREE(local_machine_name);
+
 	if (strnequal(&name[name_offset], "\\PIPE", strlen("\\PIPE"))) {
 		name_offset += strlen("\\PIPE");