[SCM] Samba Shared Repository - branch v3-6-test updated

[Jeremy Allison]

The branch, v3-6-test has been updated
       via  9734bba s3-spoolss: fix typo in debug message.
       via  0bf8ece talloc: added TALLOC_FREE_FILL environment variable
      from  1002f68 s3/vfs_tsmsm: remove unneeded cast to off_t

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-6-test


- Log -----------------------------------------------------------------
commit 9734bba5802c837772274b866a7c445a48dbb56f
Author: Günther Deschner <gd at samba.org>
Date:   Thu Nov 18 15:25:13 2010 +0100

    s3-spoolss: fix typo in debug message.
    
    Guenther
    
    Autobuild-User: Günther Deschner <gd at samba.org>
    Autobuild-Date: Fri Nov 19 12:05:10 CET 2010 on sn-devel-104
    (cherry picked from commit 5855194894535c57797a0475640e50c07ed92643)

commit 0bf8ece121399100d94b0310b7c6f6d0f97700f4
Author: Andrew Tridgell <tridge at samba.org>
Date:   Fri Nov 19 11:04:33 2010 +1100

    talloc: added TALLOC_FREE_FILL environment variable
    
    when this environment variable is set, talloc will fill freed memory
    with the value from that environment variable. This can be used to
    help find use after free bugs when valgrind is too slow to be used
    (cherry picked from commit 999f3ed2ce656ecf97b95afa85823115939f9360)

-----------------------------------------------------------------------

Summary of changes:
 lib/talloc/talloc.c                 |   30 ++++++++++++++++++++++++++++++
 source3/rpc_server/srv_spoolss_nt.c |    2 +-
 2 files changed, 31 insertions(+), 1 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c
index bd364ed..729e248 100644
--- a/lib/talloc/talloc.c
+++ b/lib/talloc/talloc.c
@@ -104,6 +104,17 @@
 static void *null_context;
 static void *autofree_context;
 
+/* used to enable fill of memory on free, which can be useful for
+ * catching use after free errors when valgrind is too slow
+ */
+static struct {
+	bool initialised;
+	bool enabled;
+	uint8_t fill_value;
+} talloc_fill;
+
+#define TALLOC_FILL_ENV "TALLOC_FREE_FILL"
+
 struct talloc_reference_handle {
 	struct talloc_reference_handle *next, *prev;
 	void *ptr;
@@ -567,6 +578,16 @@ static inline int _talloc_free_internal(void *ptr, const char *location)
 		return -1;
 	}
 
+	/* possibly initialised the talloc fill value */
+	if (!talloc_fill.initialised) {
+		const char *fill = getenv(TALLOC_FILL_ENV);
+		if (fill != NULL) {
+			talloc_fill.enabled = true;
+			talloc_fill.fill_value = strtoul(fill, NULL, 0);
+		}
+		talloc_fill.initialised = true;
+	}
+
 	tc = talloc_chunk_from_ptr(ptr);
 
 	if (unlikely(tc->refs)) {
@@ -662,10 +683,19 @@ static inline int _talloc_free_internal(void *ptr, const char *location)
 		*pool_object_count -= 1;
 
 		if (*pool_object_count == 0) {
+			if (talloc_fill.enabled) {
+				memset(TC_PTR_FROM_CHUNK(pool), talloc_fill.fill_value, pool->size);
+			}
 			free(pool);
 		}
 	}
 	else {
+		if (talloc_fill.enabled) {
+			/* don't wipe the header, to allow the
+			   double-free logic to still work
+			*/
+			memset(TC_PTR_FROM_CHUNK(tc), talloc_fill.fill_value, tc->size);
+		}
 		free(tc);
 	}
 	return 0;
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index c1f72db..090181d 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -1629,7 +1629,7 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p,
 				ZERO_STRUCTP(r->out.handle);
 				DEBUG(3,("access DENIED as user is not root, "
 					"has no printoperator privilege, "
-					"not a member of the printoperater builtin group and "
+					"not a member of the printoperator builtin group and "
 					"is not in printer admin list"));
 				return WERR_ACCESS_DENIED;
 			}


-- 
Samba Shared Repository