[SCM] Samba Shared Repository - branch master updated

Gary Lockyer gary at samba.org
Fri Nov 23 00:24:02 UTC 2018


The branch, master has been updated
       via  6f48bc840c1 librpc:ndr: Fix undefined behavior in ndr.c
       via  aab5034a9dd lib:compression: Fix undefined behavior in lzxpress
       via  93ab0cef2a0 lib:util: Fix undefined behavior in bitmap.c
       via  470a9b891ac lib:util: Fix undefined behavior in idtree
       via  02913d08887 lib:util: Fix undefined behavior in asn1 parser
       via  502f56c1ce0 s3:lib: Fix undefined behavior in messages_dgm
       via  ee6497574a0 lib:crypto: Fix undefined behavior in md4
       via  1642dc2fd4c s3:lib: Do not redefine bool and use stdbool.h
       via  2a418f731b2 lib:util: Always include unistd.h for setgroups
       via  dbdd57e31c0 s3:tests: Initialize pointers with NULL in netdisplay test
       via  dbeb806d4a3 s4:torture: Initialize pointers in libnetapi user test
       via  3e58e83be5a s4:bind_dlz: Only copy the dn once
      from  64fbc4c1511 utils: Free host realm after processing

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 6f48bc840c11c0d4cfbd6b7eada15cc69218ca0f
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Nov 22 15:01:44 2018 +0100

    librpc:ndr: Fix undefined behavior in ndr.c
    
    librpc/ndr/ndr.c:1430 runtime error: left shift of 1 by 31 places cannot
    be represented in type 'int'
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>
    
    Autobuild-User(master): Gary Lockyer <gary at samba.org>
    Autobuild-Date(master): Fri Nov 23 01:23:09 CET 2018 on sn-devel-144

commit aab5034a9ddc57ee9ce14ce584e53bd9b96b7a58
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Nov 22 15:11:09 2018 +0100

    lib:compression: Fix undefined behavior in lzxpress
    
    lib/compression/lzxpress.c:228 runtime error: store to misaligned
    address 0x5631d53ca9fe for type 'uint32_t', which requires 4 byte
    alignment
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit 93ab0cef2a0f68788f77d8fce7e4f795e9921a9b
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Nov 22 15:06:42 2018 +0100

    lib:util: Fix undefined behavior in bitmap.c
    
    lib/util/bitmap.c:77: runtime error: left shift of 1 by 31 places cannot
    be represented in type 'int'
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit 470a9b891acfa4ec8426f703912652ee2e4b5d86
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Nov 22 14:53:21 2018 +0100

    lib:util: Fix undefined behavior in idtree
    
    lib/util/idtree.c:84 runtime error: left shift of 1 by 31 places cannot
    be represented in type 'int'
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit 02913d088879500a149ef733eb618561434a9f3a
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Nov 22 14:45:20 2018 +0100

    lib:util: Fix undefined behavior in asn1 parser
    
    lib/util/asn1.c:969 runtime error: left shift of negative value -1
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit 502f56c1ce0077cf31b64831ae787cf91ffc4ab1
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Nov 22 13:57:18 2018 +0100

    s3:lib: Fix undefined behavior in messages_dgm
    
    source3/lib/messages_dgm.c:1290:7: runtime error: variable length array
    bound evaluates to non-positive value 0
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit ee6497574a0b5a7fcaf8171fea50dd169f468158
Author: Andreas Schneider <asn at samba.org>
Date:   Thu Nov 22 09:22:38 2018 +0100

    lib:crypto: Fix undefined behavior in md4
    
    runtime error: left shift of 145 by 24 places cannot be represented in type 'int'
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit 1642dc2fd4c3e89bab127c5c1d0b675d1c5cb6f9
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Nov 20 10:39:28 2018 +0100

    s3:lib: Do not redefine bool and use stdbool.h
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit 2a418f731b220d75f27c9885c373d7a2c0b41b57
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Nov 20 10:37:01 2018 +0100

    lib:util: Always include unistd.h for setgroups
    
    This is needed to pass configure checks
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit dbdd57e31c09c71460eb2f7b0c646795682ebd88
Author: Andreas Schneider <asn at samba.org>
Date:   Fri Nov 16 20:02:26 2018 +0100

    s3:tests: Initialize pointers with NULL in netdisplay test
    
    Found by Undefined Sanitizer
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit dbeb806d4a3374076a9edf8c504e6e3f88fe9da7
Author: Andreas Schneider <asn at samba.org>
Date:   Fri Nov 16 18:25:58 2018 +0100

    s4:torture: Initialize pointers in libnetapi user test
    
    Found by Undefined Sanitizer.
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

commit 3e58e83be5a52b70d6cb409a87401b52ae365b01
Author: Andreas Schneider <asn at samba.org>
Date:   Fri Nov 16 16:07:42 2018 +0100

    s4:bind_dlz: Only copy the dn once
    
    ../source4/dns_server/dlz_bind9.c:1132:4: error: 'dn' may be used uninitialized in this function [-Werror=maybe-uninitialized]
        state->log(ISC_LOG_INFO, "failed to find dnsRecord for %s",
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            ldb_dn_get_linearized(dn));
            ~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Found by Undefined Sanitizer.
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>

-----------------------------------------------------------------------

Summary of changes:
 lib/compression/lzxpress.c                 |  2 +-
 lib/crypto/md4.c                           |  6 ++-
 lib/util/asn1.c                            | 11 +++--
 lib/util/bitmap.c                          |  6 +--
 lib/util/idtree.c                          |  6 +--
 lib/util/setid.c                           |  6 +--
 librpc/ndr/libndr.h                        | 66 +++++++++++++++---------------
 source3/lib/messages_dgm.c                 | 10 +++--
 source3/lib/netapi/tests/netdisplay.c      |  6 +--
 source3/lib/netapi/tests/netuser.c         |  4 +-
 source3/lib/util_sec.c                     |  2 +-
 source4/dns_server/dlz_bind9.c             |  7 ++--
 source4/torture/libnetapi/libnetapi_user.c |  4 +-
 13 files changed, 73 insertions(+), 63 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/compression/lzxpress.c b/lib/compression/lzxpress.c
index a4ded7e4555..024aba4c2ce 100644
--- a/lib/compression/lzxpress.c
+++ b/lib/compression/lzxpress.c
@@ -225,7 +225,7 @@ ssize_t lzxpress_compress(const uint8_t *uncompressed,
 		for (; (indic_bit % 32) != 0; indic_bit++)
 			indic |= 0 << (32 - ((indic_bit % 32) + 1));
 
-		*(uint32_t *)&compressed[compressed_pos] = 0;
+		SIVAL(compressed, compressed_pos, 0);
 		SIVAL(indic_pos, 0, indic);
 		compressed_pos += sizeof(uint32_t);
 	}
diff --git a/lib/crypto/md4.c b/lib/crypto/md4.c
index 7eb6070cd44..831fe32ecb8 100644
--- a/lib/crypto/md4.c
+++ b/lib/crypto/md4.c
@@ -112,8 +112,10 @@ static void copy64(uint32_t *M, const uint8_t *in)
 	int i;
 
 	for (i=0;i<16;i++)
-		M[i] = (in[i*4+3]<<24) | (in[i*4+2]<<16) |
-			(in[i*4+1]<<8) | (in[i*4+0]<<0);
+		M[i] = ((uint32_t)in[i*4+3] << 24) |
+			((uint32_t)in[i*4+2] << 16) |
+			((uint32_t)in[i*4+1] << 8) |
+			((uint32_t)in[i*4+0] << 0);
 }
 
 static void copy4(uint8_t *out, uint32_t x)
diff --git a/lib/util/asn1.c b/lib/util/asn1.c
index d3b46aac857..60ddfa09bcf 100644
--- a/lib/util/asn1.c
+++ b/lib/util/asn1.c
@@ -953,21 +953,24 @@ bool asn1_read_ContextSimple(struct asn1_data *data, TALLOC_CTX *mem_ctx, uint8_
 bool asn1_read_implicit_Integer(struct asn1_data *data, int *i)
 {
 	uint8_t b;
+	uint32_t x = 0;
 	bool first_byte = true;
+
 	*i = 0;
 
 	while (!data->has_error && asn1_tag_remaining(data)>0) {
 		if (!asn1_read_uint8(data, &b)) return false;
 		if (first_byte) {
 			if (b & 0x80) {
-				/* Number is negative.
-				   Set i to -1 for sign extend. */
-				*i = -1;
+				/* Number is negative. */
+				x = (uint32_t)-1;
 			}
 			first_byte = false;
 		}
-		*i = (*i << 8) + b;
+		x = (x << 8) + b;
 	}
+	*i = (int)x;
+
 	return !data->has_error;
 }
 
diff --git a/lib/util/bitmap.c b/lib/util/bitmap.c
index 63963356f98..12cdfe4d16a 100644
--- a/lib/util/bitmap.c
+++ b/lib/util/bitmap.c
@@ -74,7 +74,7 @@ bool bitmap_set(struct bitmap *bm, unsigned i)
 		      i, bm->n));
 		return false;
 	}
-	bm->b[i/32] |= (1<<(i%32));
+	bm->b[i/32] |= (1U<<(i%32));
 	return true;
 }
 
@@ -88,7 +88,7 @@ bool bitmap_clear(struct bitmap *bm, unsigned i)
 		      i, bm->n));
 		return false;
 	}
-	bm->b[i/32] &= ~(1<<(i%32));
+	bm->b[i/32] &= ~(1U<<(i%32));
 	return true;
 }
 
@@ -98,7 +98,7 @@ query a bit in a bitmap
 bool bitmap_query(struct bitmap *bm, unsigned i)
 {
 	if (i >= bm->n) return false;
-	if (bm->b[i/32] & (1<<(i%32))) {
+	if (bm->b[i/32] & (1U<<(i%32))) {
 		return true;
 	}
 	return false;
diff --git a/lib/util/idtree.c b/lib/util/idtree.c
index 72266a6a62c..d72ddfbc538 100644
--- a/lib/util/idtree.c
+++ b/lib/util/idtree.c
@@ -50,9 +50,9 @@
 #define MAX_LEVEL (MAX_ID_SHIFT + IDR_BITS - 1) / IDR_BITS
 #define IDR_FREE_MAX MAX_LEVEL + MAX_LEVEL
 
-#define set_bit(bit, v) (v) |= (1<<(bit))
-#define clear_bit(bit, v) (v) &= ~(1<<(bit))
-#define test_bit(bit, v) ((v) & (1<<(bit)))
+#define set_bit(bit, v) (v) |= (1U<<(bit))
+#define clear_bit(bit, v) (v) &= ~(1U<<(bit))
+#define test_bit(bit, v) ((v) & (1U<<(bit)))
 
 struct idr_layer {
 	uint32_t		 bitmap;
diff --git a/lib/util/setid.c b/lib/util/setid.c
index eb7511083f0..10014618def 100644
--- a/lib/util/setid.c
+++ b/lib/util/setid.c
@@ -34,6 +34,9 @@
 #include <sys/types.h>
 #include <errno.h>
 
+#if defined(HAVE_UNISTD_H)
+#include <unistd.h>
+#endif
 #ifdef HAVE_SYS_PRIV_H
 #include <sys/priv.h>
 #endif
@@ -57,9 +60,6 @@ int samba_setgroups(size_t setlen, const gid_t *gidset);
 #endif
 
 #if defined(HAVE_LINUX_THREAD_CREDENTIALS)
-#if defined(HAVE_UNISTD_H)
-#include <unistd.h>
-#endif
 #if defined(HAVE_SYSCALL_H)
 #include <syscall.h>
 #endif
diff --git a/librpc/ndr/libndr.h b/librpc/ndr/libndr.h
index de93893be19..c31496fe1dc 100644
--- a/librpc/ndr/libndr.h
+++ b/librpc/ndr/libndr.h
@@ -118,21 +118,21 @@ struct ndr_print {
 	bool print_secrets;
 };
 
-#define LIBNDR_FLAG_BIGENDIAN  (1<<0)
-#define LIBNDR_FLAG_NOALIGN    (1<<1)
-
-#define LIBNDR_FLAG_STR_ASCII		(1<<2)
-#define LIBNDR_FLAG_STR_LEN4		(1<<3)
-#define LIBNDR_FLAG_STR_SIZE4		(1<<4)
-#define LIBNDR_FLAG_STR_NOTERM		(1<<5)
-#define LIBNDR_FLAG_STR_NULLTERM	(1<<6)
-#define LIBNDR_FLAG_STR_SIZE2		(1<<7)
-#define LIBNDR_FLAG_STR_BYTESIZE	(1<<8)
-#define LIBNDR_FLAG_STR_CONFORMANT	(1<<10)
-#define LIBNDR_FLAG_STR_CHARLEN		(1<<11)
-#define LIBNDR_FLAG_STR_UTF8		(1<<12)
-#define LIBNDR_FLAG_STR_RAW8		(1<<13)
-#define LIBNDR_STRING_FLAGS		(0 | \
+#define LIBNDR_FLAG_BIGENDIAN  (1U<<0)
+#define LIBNDR_FLAG_NOALIGN    (1U<<1)
+
+#define LIBNDR_FLAG_STR_ASCII		(1U<<2)
+#define LIBNDR_FLAG_STR_LEN4		(1U<<3)
+#define LIBNDR_FLAG_STR_SIZE4		(1U<<4)
+#define LIBNDR_FLAG_STR_NOTERM		(1U<<5)
+#define LIBNDR_FLAG_STR_NULLTERM	(1U<<6)
+#define LIBNDR_FLAG_STR_SIZE2		(1U<<7)
+#define LIBNDR_FLAG_STR_BYTESIZE	(1U<<8)
+#define LIBNDR_FLAG_STR_CONFORMANT	(1U<<10)
+#define LIBNDR_FLAG_STR_CHARLEN		(1U<<11)
+#define LIBNDR_FLAG_STR_UTF8		(1U<<12)
+#define LIBNDR_FLAG_STR_RAW8		(1U<<13)
+#define LIBNDR_STRING_FLAGS		(0U | \
 		LIBNDR_FLAG_STR_ASCII | \
 		LIBNDR_FLAG_STR_LEN4 | \
 		LIBNDR_FLAG_STR_SIZE4 | \
@@ -150,10 +150,10 @@ struct ndr_print {
  * Mark an element as SECRET, it won't be printed by
  * via ndr_print* unless NDR_PRINT_SECRETS is specified.
  */
-#define LIBNDR_FLAG_IS_SECRET		(1<<14)
+#define LIBNDR_FLAG_IS_SECRET		(1U<<14)
 
 /* Disable string token compression  */
-#define LIBNDR_FLAG_NO_COMPRESSION	(1<<15)
+#define LIBNDR_FLAG_NO_COMPRESSION	(1U<<15)
 
 /*
  * don't debug NDR_ERR_BUFSIZE failures,
@@ -161,25 +161,25 @@ struct ndr_print {
  *
  * return NDR_ERR_INCOMPLETE_BUFFER instead.
  */
-#define LIBNDR_FLAG_INCOMPLETE_BUFFER (1<<16)
+#define LIBNDR_FLAG_INCOMPLETE_BUFFER (1U<<16)
 
 /*
  * This lets ndr_pull_subcontext_end() return
  * NDR_ERR_UNREAD_BYTES.
  */
-#define LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES (1<<17)
+#define LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES (1U<<17)
 
 /* set if relative pointers should *not* be marshalled in reverse order */
-#define LIBNDR_FLAG_NO_RELATIVE_REVERSE	(1<<18)
+#define LIBNDR_FLAG_NO_RELATIVE_REVERSE	(1U<<18)
 
 /* set if relative pointers are marshalled in reverse order */
-#define LIBNDR_FLAG_RELATIVE_REVERSE	(1<<19)
+#define LIBNDR_FLAG_RELATIVE_REVERSE	(1U<<19)
 
-#define LIBNDR_FLAG_REF_ALLOC    (1<<20)
-#define LIBNDR_FLAG_REMAINING    (1<<21)
-#define LIBNDR_FLAG_ALIGN2       (1<<22)
-#define LIBNDR_FLAG_ALIGN4       (1<<23)
-#define LIBNDR_FLAG_ALIGN8       (1<<24)
+#define LIBNDR_FLAG_REF_ALLOC    (1U<<20)
+#define LIBNDR_FLAG_REMAINING    (1U<<21)
+#define LIBNDR_FLAG_ALIGN2       (1U<<22)
+#define LIBNDR_FLAG_ALIGN4       (1U<<23)
+#define LIBNDR_FLAG_ALIGN8       (1U<<24)
 
 #define LIBNDR_ALIGN_FLAGS ( 0        | \
 		LIBNDR_FLAG_NOALIGN   | \
@@ -189,22 +189,22 @@ struct ndr_print {
 		LIBNDR_FLAG_ALIGN8    | \
 		0)
 
-#define LIBNDR_PRINT_ARRAY_HEX   (1<<25)
-#define LIBNDR_PRINT_SET_VALUES  (1<<26)
+#define LIBNDR_PRINT_ARRAY_HEX   (1U<<25)
+#define LIBNDR_PRINT_SET_VALUES  (1U<<26)
 
 /* used to force a section of IDL to be little-endian */
-#define LIBNDR_FLAG_LITTLE_ENDIAN (1<<27)
+#define LIBNDR_FLAG_LITTLE_ENDIAN (1U<<27)
 
 /* used to check if alignment padding is zero */
-#define LIBNDR_FLAG_PAD_CHECK     (1<<28)
+#define LIBNDR_FLAG_PAD_CHECK     (1U<<28)
 
-#define LIBNDR_FLAG_NDR64         (1<<29)
+#define LIBNDR_FLAG_NDR64         (1U<<29)
 
 /* set if an object uuid will be present */
-#define LIBNDR_FLAG_OBJECT_PRESENT    (1<<30)
+#define LIBNDR_FLAG_OBJECT_PRESENT    (1U<<30)
 
 /* set to avoid recursion in ndr_size_*() calculation */
-#define LIBNDR_FLAG_NO_NDR_SIZE		(1<<31)
+#define LIBNDR_FLAG_NO_NDR_SIZE		(1U<<31)
 
 /* useful macro for debugging */
 #define NDR_PRINT_DEBUG(type, p) ndr_print_debug((ndr_print_fn_t)ndr_print_ ##type, #p, p)
diff --git a/source3/lib/messages_dgm.c b/source3/lib/messages_dgm.c
index daaad9619e0..af12be8d82e 100644
--- a/source3/lib/messages_dgm.c
+++ b/source3/lib/messages_dgm.c
@@ -1249,6 +1249,7 @@ static void messaging_dgm_read_handler(struct tevent_context *ev,
 	size_t msgbufsize = msghdr_prep_recv_fds(NULL, NULL, 0, INT8_MAX);
 	uint8_t msgbuf[msgbufsize];
 	uint8_t buf[MESSAGING_DGM_FRAGMENT_LENGTH];
+	size_t num_fds;
 
 	messaging_dgm_validate(ctx);
 
@@ -1284,8 +1285,12 @@ static void messaging_dgm_read_handler(struct tevent_context *ev,
 		return;
 	}
 
-	{
-		size_t num_fds = msghdr_extract_fds(&msg, NULL, 0);
+	num_fds = msghdr_extract_fds(&msg, NULL, 0);
+	if (num_fds == 0) {
+		int fds[1];
+
+		messaging_dgm_recv(ctx, ev, buf, received, fds, 0);
+	} else {
 		size_t i;
 		int fds[num_fds];
 
@@ -1303,7 +1308,6 @@ static void messaging_dgm_read_handler(struct tevent_context *ev,
 
 		messaging_dgm_recv(ctx, ev, buf, received, fds, num_fds);
 	}
-
 }
 
 static int messaging_dgm_in_msg_destructor(struct messaging_dgm_in_msg *m)
diff --git a/source3/lib/netapi/tests/netdisplay.c b/source3/lib/netapi/tests/netdisplay.c
index 090792cec2f..d7967fa4150 100644
--- a/source3/lib/netapi/tests/netdisplay.c
+++ b/source3/lib/netapi/tests/netdisplay.c
@@ -39,9 +39,9 @@ static NET_API_STATUS test_netquerydisplayinformation(const char *hostname,
 	uint32_t idx = 0;
 	int i;
 
-	struct NET_DISPLAY_USER *user;
-	struct NET_DISPLAY_GROUP *group;
-	struct NET_DISPLAY_MACHINE *machine;
+	struct NET_DISPLAY_USER *user = NULL;
+	struct NET_DISPLAY_GROUP *group = NULL;
+	struct NET_DISPLAY_MACHINE *machine = NULL;
 
 	printf("testing NetQueryDisplayInformation level %d\n", level);
 
diff --git a/source3/lib/netapi/tests/netuser.c b/source3/lib/netapi/tests/netuser.c
index de5f0a102d9..ad2bb53f18c 100644
--- a/source3/lib/netapi/tests/netuser.c
+++ b/source3/lib/netapi/tests/netuser.c
@@ -265,8 +265,8 @@ static NET_API_STATUS test_netusergetgroups(const char *hostname,
 	uint8_t *buffer = NULL;
 	int i;
 
-	struct GROUP_USERS_INFO_0 *i0;
-	struct GROUP_USERS_INFO_1 *i1;
+	struct GROUP_USERS_INFO_0 *i0 = NULL;
+	struct GROUP_USERS_INFO_1 *i1 = NULL;
 
 	printf("testing NetUserGetGroups level %d\n", level);
 
diff --git a/source3/lib/util_sec.c b/source3/lib/util_sec.c
index 703c522d77b..94082697def 100644
--- a/source3/lib/util_sec.c
+++ b/source3/lib/util_sec.c
@@ -28,6 +28,7 @@
 #if defined(HAVE_UNISTD_H)
 #include <unistd.h>
 #endif
+#include <stdbool.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <sys/types.h>
@@ -42,7 +43,6 @@
 
 #define DEBUG(x, y) printf y
 #define smb_panic(x) exit(1)
-#define bool int
 #endif
 
 /* are we running as non-root? This is used by the regresison test code,
diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c
index 43f3e57c789..82c72111a00 100644
--- a/source4/dns_server/dlz_bind9.c
+++ b/source4/dns_server/dlz_bind9.c
@@ -1059,8 +1059,9 @@ _PUBLIC_ isc_result_t dlz_allnodes(const char *zone, void *dbdata,
 {
 	struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
 	const char *attrs[] = { "dnsRecord", NULL };
-	int ret = LDB_SUCCESS, i, j;
-	struct ldb_dn *dn;
+	int ret = LDB_ERR_NO_SUCH_OBJECT;
+	size_t i, j;
+	struct ldb_dn *dn = NULL;
 	struct ldb_result *res;
 	TALLOC_CTX *tmp_ctx = talloc_new(state);
 	struct ldb_val zone_name_val = data_blob_string_const(zone);
@@ -1113,7 +1114,7 @@ _PUBLIC_ isc_result_t dlz_allnodes(const char *zone, void *dbdata,
 			break;
 		}
 	}
-	if (ret != LDB_SUCCESS) {
+	if (ret != LDB_SUCCESS || dn == NULL) {
 		talloc_free(tmp_ctx);
 		return ISC_R_NOTFOUND;
 	}
diff --git a/source4/torture/libnetapi/libnetapi_user.c b/source4/torture/libnetapi/libnetapi_user.c
index e925725e5f0..134b4e8b9c0 100644
--- a/source4/torture/libnetapi/libnetapi_user.c
+++ b/source4/torture/libnetapi/libnetapi_user.c
@@ -271,8 +271,8 @@ static NET_API_STATUS test_netusergetgroups(struct torture_context *tctx,
 	uint8_t *buffer = NULL;
 	int i;
 
-	struct GROUP_USERS_INFO_0 *i0;
-	struct GROUP_USERS_INFO_1 *i1;
+	struct GROUP_USERS_INFO_0 *i0 = NULL;
+	struct GROUP_USERS_INFO_1 *i1 = NULL;
 
 	torture_comment(tctx, "Testing NetUserGetGroups level %d\n", level);
 


-- 
Samba Shared Repository



More information about the samba-cvs mailing list