svn commit: samba r14788 - in branches/SAMBA_3_0/source/rpc_server: .

[jra at samba.org]

Author: jra
Date: 2006-03-29 23:42:03 +0000 (Wed, 29 Mar 2006)
New Revision: 14788

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=14788

Log:
Fix coverity bug #276. null deref.
Jeremy.

Modified:
   branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c


Changeset:
Modified: branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c
===================================================================
--- branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c	2006-03-29 23:35:23 UTC (rev 14787)
+++ branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c	2006-03-29 23:42:03 UTC (rev 14788)
@@ -984,6 +984,10 @@
 		/* allocate the max entries possible */
 		
 		data = TALLOC_ARRAY( mem_ctx, SPOOL_NOTIFY_INFO_DATA, msg_group->num_msgs);
+		if (!data) {
+			return;
+		}
+
 		ZERO_STRUCTP(data);
 		
 		/* build the array of change notifications */
@@ -1400,6 +1404,9 @@
 	len = unistrlen(devmode->devicename.buffer);
 	if (len != -1) {
 		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
+		if (!d->devicename.buffer) {
+			return NULL;
+		}
 		if (unistrcpy(d->devicename.buffer, devmode->devicename.buffer) != len)
 			return NULL;
 	}
@@ -1408,12 +1415,17 @@
 	len = unistrlen(devmode->formname.buffer);
 	if (len != -1) {
 		d->devicename.buffer = TALLOC_ARRAY(ctx, uint16, len);
+		if (!d->devicename.buffer) {
+			return NULL;
+		}
 		if (unistrcpy(d->formname.buffer, devmode->formname.buffer) != len)
 			return NULL;
 	}
 
 	d->dev_private = TALLOC_MEMDUP(ctx, devmode->dev_private, devmode->driverextra);
-	
+	if (!d->dev_private) {
+		return NULL;
+	}	
 	return d;
 }
 
@@ -5894,6 +5906,10 @@
 	}
 
 	new_secdesc_ctr = sec_desc_merge(p->mem_ctx, secdesc_ctr, old_secdesc_ctr);
+	if (!new_secdesc_ctr) {
+		result = WERR_NOMEM;
+		goto done;
+	}
 
 	if (sec_desc_equal(new_secdesc_ctr->sec, old_secdesc_ctr->sec)) {
 		result = WERR_OK;