[SCM] Samba Shared Repository - branch master updated

Andreas Schneider asn at samba.org
Mon Jun 24 07:15:01 UTC 2024


The branch, master has been updated
       via  cfb81b0c313 packaging: Add missing quotes in smbprint
       via  b57bddacd76 s3:registry: Add missing return value checks
       via  8c4f807350d s3:registry: Avoid possible double frees
       via  10b95ff4368 s3:registry: Remove trailing spaces in reg_perfcount.c
       via  3cb4073cd0e s4:dsdb: Avoid possible underflows with new_len
       via  44db391ae1c s4:dsdb: Remove trailing spaces in schema_query.c
       via  94c06dd1890 s4:torture: Initialize struct wrepl_wins_name
       via  5d568f6e613 s4:torture: Remove trailing spaces in winsreplication.c
       via  067a30c5273 s3:utils: Fix get_window_height() return value
       via  a0b6d18a254 s3:rpc_server: Make sure struct security_ace is initialized
       via  c709cb8a17c s3:lib: Make sure struct security_ace is fully initialized
       via  d6a7a97bc23 s3:lib: Remove trailing spaces in sharesec.c
       via  36fb8a3d654 nsswitch:krb5_plugin: Avoid a possible double free
      from  5b40cdf6e88 auth/credentials: don't ignore "client use kerberos" and --use-kerberos for machine accounts

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit cfb81b0c3138d6cb89cd88ce494c60acd7c2cc7f
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:50:26 2024 +0200

    packaging: Add missing quotes in smbprint
    
    Found by Covscan.
    
    "Error: SHELLCHECK_WARNING (CWE-569):
    /usr/bin/smbprint:49:21: warning[SC1083]: This } is literal. Check expression (missing ;/\n?) or quote it.
       47|   #   Concat this with /.config to get the config file.
       48|   #
       49|-> eval acct_file=\${$#}
       50|   spool_dir=$(dirname $acct_file)
       51|   config_file=$spool_dir/.config"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
    
    Autobuild-User(master): Andreas Schneider <asn at cryptomilk.org>
    Autobuild-Date(master): Mon Jun 24 07:14:54 UTC 2024 on atb-devel-224

commit b57bddacd765c48f3f427095ba4a474dbaf51c23
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:47:41 2024 +0200

    s3:registry: Add missing return value checks
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 8c4f807350d6815582019bb0c52358e7db43ea24
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:46:15 2024 +0200

    s3:registry: Avoid possible double frees
    
    Found by Covscan.
    
    "Error: USE_AFTER_FREE (CWE-416):
    samba-4.20.0rc2/source3/registry/reg_perfcount.c:309: freed_arg: ""_reg_perfcount_multi_sz_from_tdb"" frees ""*retbuf"".
    samba-4.20.0rc2/source3/registry/reg_perfcount.c:313: double_free: Calling ""_reg_perfcount_multi_sz_from_tdb"" frees pointer ""*retbuf"" which has already been freed.
      311|   	for(i = 1; i <= base_index; i++)
      312|   	{
      313|-> 		buffer_size = _reg_perfcount_multi_sz_from_tdb(names, i*2, retbuf, buffer_size);
      314|   	}
      315|   	tdb_close(names);"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 10b95ff436866e484755fc2c5189263394029a29
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:45:01 2024 +0200

    s3:registry: Remove trailing spaces in reg_perfcount.c
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 3cb4073cd0e24c8082d71d569a67a344af0f8cba
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:33:00 2024 +0200

    s4:dsdb: Avoid possible underflows with new_len
    
    Found by Covscan.
    
    "Error: INTEGER_OVERFLOW (CWE-190):
    samba-4.20.0rc2/source4/dsdb/schema/schema_query.c:403: tainted_data_argument: The check ""i < new_len"" contains the tainted expression ""i"" which causes ""new_len"" to be considered tainted.
    samba-4.20.0rc2/source4/dsdb/schema/schema_query.c:407: overflow: The expression ""new_len - i"" is deemed underflowed because at least one of its arguments has underflowed.
    samba-4.20.0rc2/source4/dsdb/schema/schema_query.c:407: overflow: The expression ""(new_len - i) * 8UL"" is deemed underflowed because at least one of its arguments has underflowed.
    samba-4.20.0rc2/source4/dsdb/schema/schema_query.c:407: overflow_sink: ""(new_len - i) * 8UL"", which might have underflowed, is passed to ""memmove(val1, val2, (new_len - i) * 8UL)"". [Note: The source code implementation of the function has been overridden by a builtin model.]
      405|   			const char **val2 = &attr_list[i];
      406|   			if (ldb_attr_cmp(*val1, *val2) == 0) {
      407|-> 				memmove(val1, val2, (new_len - i) * sizeof( *attr_list));
      408|   				attr_list[new_len-1] = NULL;
      409|   				new_len--;"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 44db391ae1cb52b13769d4a0dc27dec90618c7ce
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:26:12 2024 +0200

    s4:dsdb: Remove trailing spaces in schema_query.c
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 94c06dd189094ddf8aa0c152fcfc95c69c5dff81
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:21:12 2024 +0200

    s4:torture: Initialize struct wrepl_wins_name
    
    Found by Covscan.
    
    "Error: UNINIT (CWE-457):
    samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:5040: var_decl: Declaring variable ""wins_name_"" without initializer.
    samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:5041: assign: Assigning: ""wins_name"" = ""&wins_name_"", which points to uninitialized data.
    samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:6680: uninit_use_in_call: Using uninitialized value ""*wins_name"". Field ""wins_name->is_group"" is uninitialized when calling ""test_wrepl_update_one"".
     6678|   			wins_name->unknown	= ""255.255.255.255"";
     6679|
     6680|-> 			ret &= test_wrepl_update_one(tctx, ctx, &ctx->b, wins_name);
     6681|   			ret &= test_wrepl_is_applied(tctx, ctx, &ctx->b, wins_name, true);
     6682|   		} else {"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 5d568f6e613cae228f34c27f971a6bc7e91bd04a
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:20:37 2024 +0200

    s4:torture: Remove trailing spaces in winsreplication.c
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 067a30c5273e866e743815b08bf205e7e48b44c4
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Jun 19 11:17:22 2024 +0200

    s3:utils: Fix get_window_height() return value
    
    Found by Covscan.
    
    "Error: INTEGER_OVERFLOW (CWE-190):
    samba-4.20.0rc2/source3/utils/regedit_list.c:522: tainted_data_return: Called function ""get_window_height(list)"", and a possible return value may be less than zero.
    samba-4.20.0rc2/source3/utils/regedit_list.c:522: cast_underflow: An assign of a possibly negative number to an unsigned type, which might trigger an underflow.
    samba-4.20.0rc2/source3/utils/regedit_list.c:526: overflow: The expression ""list->cursor_row -= page"" is deemed underflowed because at least one of its arguments has underflowed.
    samba-4.20.0rc2/source3/utils/regedit_list.c:529: overflow_sink: ""list->cursor_row"", which might have underflowed, is passed to ""data_get_row_n(list, list->cursor_row)"".
      527|   			list->start_row -= page;
      528|   		}
      529|-> 		tmp = data_get_row_n(list, list->cursor_row);
      530|   		break;
      531|   	case ML_CURSOR_PGDN:"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit a0b6d18a254b77a6d236390a2b21beb61ec4ba5b
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Jun 18 15:57:45 2024 +0200

    s3:rpc_server: Make sure struct security_ace is initialized
    
    Found by Covscan.
    
    "Error: UNINIT (CWE-457):
    samba-4.20.0rc2/source3/rpc_server/samr/srv_samr_nt.c:235: var_decl: Declaring variable ""ace"" without initializer.
    samba-4.20.0rc2/source3/rpc_server/samr/srv_samr_nt.c:269: uninit_use_in_call: Using uninitialized value ""*ace"". Field ""ace->object"" is uninitialized when calling ""make_sec_acl"".
      267|   	/* create the security descriptor */
      268|
      269|-> 	if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
      270|   		return NT_STATUS_NO_MEMORY;
      271|"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit c709cb8a17cb1d441c598b9e894f55a3f16bd6df
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Jun 18 15:48:38 2024 +0200

    s3:lib: Make sure struct security_ace is fully initialized
    
    Found by Covscan.
    
    "Error: UNINIT (CWE-457):
    samba-4.20.0rc2/source3/lib/sharesec.c:275: var_decl: Declaring variable ""ace"" without initializer.
    samba-4.20.0rc2/source3/lib/sharesec.c:285: uninit_use_in_call: Using uninitialized value ""ace"". Field ""ace.object"" is uninitialized when calling ""make_sec_acl"".
      283|   	init_sec_ace(&ace, &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, sa, 0);
      284|
      285|-> 	if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 1, &ace)) != NULL) {
      286|   		psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
      287|   				    SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit d6a7a97bc23642d269306eaf20afec11958adfd2
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Jun 18 15:48:17 2024 +0200

    s3:lib: Remove trailing spaces in sharesec.c
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

commit 36fb8a3d654a4bc75abe86376de970ebc83552c6
Author: Andreas Schneider <asn at samba.org>
Date:   Tue Jun 18 15:45:53 2024 +0200

    nsswitch:krb5_plugin: Avoid a possible double free
    
    Found by Covscan.
    
    "Error: USE_AFTER_FREE (CWE-416):
    samba-4.20.0rc2/nsswitch/krb5_plugin/winbind_krb5_localauth.c:122: freed_arg: ""wbcFreeMemory"" frees ""pwd"".
    samba-4.20.0rc2/nsswitch/krb5_plugin/winbind_krb5_localauth.c:144: pass_freed_arg: Passing freed pointer ""pwd"" as an argument to ""wbcFreeMemory"".
      142|   		break;
      143|   	}
      144|-> 	wbcFreeMemory(pwd);
      145|   	if (code != 0) {
      146|   		goto out;"
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Signed-off-by: Martin Schwenke <mschwenke at ddn.com>

-----------------------------------------------------------------------

Summary of changes:
 nsswitch/krb5_plugin/winbind_krb5_localauth.c |   1 +
 packaging/printing/smbprint                   |   2 +-
 source3/lib/sharesec.c                        |  12 +-
 source3/registry/reg_perfcount.c              |  40 ++-
 source3/rpc_server/samr/srv_samr_nt.c         |   2 +-
 source3/utils/regedit_list.c                  |  14 +-
 source4/dsdb/schema/schema_query.c            |  74 ++---
 source4/torture/nbt/winsreplication.c         | 388 +++++++++++++-------------
 8 files changed, 277 insertions(+), 256 deletions(-)


Changeset truncated at 500 lines:

diff --git a/nsswitch/krb5_plugin/winbind_krb5_localauth.c b/nsswitch/krb5_plugin/winbind_krb5_localauth.c
index 751dfd1674b..f610b0cdf8c 100644
--- a/nsswitch/krb5_plugin/winbind_krb5_localauth.c
+++ b/nsswitch/krb5_plugin/winbind_krb5_localauth.c
@@ -120,6 +120,7 @@ static krb5_error_code winbind_userok(krb5_context context,
 		break;
 	}
 	wbcFreeMemory(pwd);
+	pwd = NULL;
 	if (code != 0) {
 		goto out;
 	}
diff --git a/packaging/printing/smbprint b/packaging/printing/smbprint
index a21385aa25c..5439207c041 100644
--- a/packaging/printing/smbprint
+++ b/packaging/printing/smbprint
@@ -46,7 +46,7 @@
 #   Extract the directory name from the file name.
 #   Concat this with /.config to get the config file.
 #
-eval acct_file=\${$#}
+eval acct_file="\${$#}"
 spool_dir=$(dirname $acct_file)
 config_file=$spool_dir/.config
 
diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c
index fbb2d4795fa..da1d5e89e54 100644
--- a/source3/lib/sharesec.c
+++ b/source3/lib/sharesec.c
@@ -1,18 +1,18 @@
-/* 
+/*
  *  Unix SMB/Netbios implementation.
  *  SEC_DESC handling functions
  *  Copyright (C) Jeremy R. Allison            1995-2003.
- *  
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
- *  
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *  
+ *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
@@ -272,7 +272,9 @@ static struct security_descriptor *get_share_security_default(TALLOC_CTX *ctx,
 							uint32_t def_access)
 {
 	uint32_t sa;
-	struct security_ace ace;
+	struct security_ace ace = {
+		.size = 0,
+	};
 	struct security_acl *psa = NULL;
 	struct security_descriptor *psd = NULL;
 	uint32_t spec_access = def_access;
diff --git a/source3/registry/reg_perfcount.c b/source3/registry/reg_perfcount.c
index 131cc57d958..7be0a1b0147 100644
--- a/source3/registry/reg_perfcount.c
+++ b/source3/registry/reg_perfcount.c
@@ -1,20 +1,20 @@
-/* 
+/*
  *  Unix SMB/CIFS implementation.
  *  Virtual Windows Registry Layer
  *
  *  Copyright (C) Marcin Krzysztof Porwit    2005,
  *  Copyright (C) Gerald (Jerry) Carter      2005.
- *  
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
- *  
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *  
+ *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
@@ -173,12 +173,15 @@ static uint32_t _reg_perfcount_multi_sz_from_tdb(TDB_CONTEXT *tdb,
 	DATA_BLOB name_index, name;
 	bool ok;
 
+	/* Set to NULL, to avoid possible double frees on error. */
+	*retbuf = NULL;
+
 	snprintf(temp, sizeof(temp), "%d", keyval);
 	kbuf = string_tdb_data(temp);
 	dbuf = tdb_fetch(tdb, kbuf);
 	if(dbuf.dptr == NULL)
 	{
-		/* If a key isn't there, just bypass it -- this really shouldn't 
+		/* If a key isn't there, just bypass it -- this really shouldn't
 		   happen unless someone's mucking around with the tdb */
 		DEBUG(3, ("_reg_perfcount_multi_sz_from_tdb: failed to find key [%s] in [%s].\n",
 			  temp, tdb_name(tdb)));
@@ -259,6 +262,9 @@ uint32_t reg_perfcount_get_counter_help(uint32_t base_index, char **retbuf)
 	for(i = 1; i <= base_index; i++)
 	{
 		buffer_size = _reg_perfcount_multi_sz_from_tdb(names, (i*2)+1, retbuf, buffer_size);
+		if (buffer_size == 0) {
+			return buffer_size;
+		}
 	}
 	tdb_close(names);
 
@@ -307,10 +313,16 @@ uint32_t reg_perfcount_get_counter_names(uint32_t base_index, char **retbuf)
 	TALLOC_FREE(fname);
 
 	buffer_size = _reg_perfcount_multi_sz_from_tdb(names, 1, retbuf, buffer_size);
+	if (buffer_size == 0) {
+		return buffer_size;
+	}
 
 	for(i = 1; i <= base_index; i++)
 	{
 		buffer_size = _reg_perfcount_multi_sz_from_tdb(names, i*2, retbuf, buffer_size);
+		if (buffer_size == 0) {
+			return buffer_size;
+		}
 	}
 	tdb_close(names);
 
@@ -341,7 +353,7 @@ static void _reg_perfcount_make_key(TDB_DATA *key,
 	memset(buf, 0, buflen);
 	if(key_part2 != NULL)
 		snprintf(buf, buflen,"%d%s", key_part1, key_part2);
-	else 
+	else
 		snprintf(buf, buflen, "%d", key_part1);
 
 	*key = string_tdb_data(buf);
@@ -602,7 +614,7 @@ static bool _reg_perfcount_get_counter_info(struct PERF_DATA_BLOCK *block,
 		return False;
 	if(dbuf[0] != 0 || dbuf[1] != 0)
 	{
-		memcpy((void *)(obj->counter_data.data + 
+		memcpy((void *)(obj->counter_data.data +
 				(obj->counter_data.ByteLength - (sizeof(uint32_t) + dsize))),
 		       (const void *)dbuf, dsize);
 	}
@@ -860,7 +872,7 @@ static int _reg_perfcount_assemble_global(struct PERF_DATA_BLOCK *block,
 		}
 		else
 			DEBUG(3, ("NULL relationship for counter [%d] using key [%s].\n", j, keybuf));
-	}	
+	}
 	return retval;
 }
 
@@ -1054,8 +1066,8 @@ static uint32_t _reg_perfcount_perf_data_block_fixup(struct PERF_DATA_BLOCK *blo
 				counter = &(object[obj].counters[object[obj].NumCounters - 1]);
 				counter_data->ByteLength = counter->CounterOffset + counter->CounterSize + sizeof(counter_data->ByteLength);
 				temp = talloc_realloc(mem_ctx,
-							    temp, 
-							    char, 
+							    temp,
+							    char,
 							    counter_data->ByteLength- sizeof(counter_data->ByteLength));
 				if (temp == NULL) {
 					return 0;
@@ -1233,8 +1245,8 @@ static bool _reg_perfcount_marshall_perf_data_block(prs_struct *ps, struct PERF_
 	if(!prs_uint32("SystemNameOffset", ps, depth, &block.SystemNameOffset))
 		return False;
 	/* hack to make sure we're 64-bit aligned at the end of this whole mess */
-	if(!prs_uint8s(False, "SystemName", ps, depth, block.data, 
-		       block.HeaderLength - block.SystemNameOffset)) 
+	if(!prs_uint8s(False, "SystemName", ps, depth, block.data,
+		       block.HeaderLength - block.SystemNameOffset))
 		return False;
 
 	return True;
@@ -1287,7 +1299,7 @@ static bool _reg_perfcount_marshall_perf_counters(prs_struct *ps,
 /*********************************************************************
 *********************************************************************/
 
-static bool _reg_perfcount_marshall_perf_counter_data(prs_struct *ps, 
+static bool _reg_perfcount_marshall_perf_counter_data(prs_struct *ps,
 						      struct PERF_COUNTER_BLOCK counter_data,
 						      int depth)
 {
@@ -1460,4 +1472,4 @@ WERROR reg_perfcount_get_hkpd(prs_struct *ps, uint32_t max_buf_size, uint32_t *o
 
 		return WERR_INSUFFICIENT_BUFFER;
 	}
-}    
+}
diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
index d26a8d5a440..e0d0875bd5d 100644
--- a/source3/rpc_server/samr/srv_samr_nt.c
+++ b/source3/rpc_server/samr/srv_samr_nt.c
@@ -232,7 +232,7 @@ static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, struct security_descriptor
 				     struct dom_sid *sid, uint32_t sid_access )
 {
 	struct dom_sid domadmin_sid;
-	struct security_ace ace[5];		/* at most 5 entries */
+	struct security_ace ace[5] = {0};		/* at most 5 entries */
 	size_t i = 0;
 
 	struct security_acl *psa = NULL;
diff --git a/source3/utils/regedit_list.c b/source3/utils/regedit_list.c
index b5405f286da..83eac2ad11f 100644
--- a/source3/utils/regedit_list.c
+++ b/source3/utils/regedit_list.c
@@ -20,6 +20,9 @@
 #include "regedit_list.h"
 #include "regedit.h"
 
+#define CLAMP(x, low, high) \
+	(((x) > (high)) ? (high) : (((x) < (low)) ? (low) : (x)))
+
 struct multilist {
 	WINDOW *window;
 	WINDOW *pad;
@@ -405,21 +408,22 @@ WERROR multilist_set_data(struct multilist *list, const void *data)
 	return WERR_OK;
 }
 
-static int get_window_height(struct multilist *list)
+static unsigned get_window_height(struct multilist *list)
 {
-	int height;
+	unsigned height;
 
 	height = list->window_height;
-	if (list->cb->get_column_header) {
+	if (height > 0 && list->cb->get_column_header) {
 		height--;
 	}
 
-	return height;
+	/* Clamp to some sensible values */
+	return CLAMP(height, 1, 16384);
 }
 
 static void fix_start_row(struct multilist *list)
 {
-	int height;
+	unsigned height;
 
 	/* adjust start_row so that the cursor appears on the screen */
 
diff --git a/source4/dsdb/schema/schema_query.c b/source4/dsdb/schema/schema_query.c
index 736027975ea..aa906d03d4b 100644
--- a/source4/dsdb/schema/schema_query.c
+++ b/source4/dsdb/schema/schema_query.c
@@ -1,7 +1,7 @@
-/* 
+/*
    Unix SMB/CIFS Implementation.
    DSDB schema header
-   
+
    Copyright (C) Stefan Metzmacher <metze at samba.org> 2006-2007
    Copyright (C) Andrew Bartlett <abartlet at samba.org> 2006-2008
 
@@ -9,15 +9,15 @@
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-   
+
 */
 
 #include "includes.h"
@@ -30,12 +30,12 @@
 #undef strcasecmp
 #undef strncasecmp
 
-static const char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx, 
-						      const struct dsdb_schema *schema, 
+static const char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx,
+						      const struct dsdb_schema *schema,
 						      const char **class_list,
 						      enum dsdb_attr_list_query query);
 
-static int uint32_cmp(uint32_t c1, uint32_t c2) 
+static int uint32_cmp(uint32_t c1, uint32_t c2)
 {
 	if (c1 == c2) return 0;
 	return c1 > c2 ? 1 : -1;
@@ -213,7 +213,7 @@ const char *dsdb_lDAPDisplayName_by_id(const struct dsdb_schema *schema,
 	return NULL;
 }
 
-/** 
+/**
     Return a list of linked attributes, in lDAPDisplayName format.
 
     This may be used to determine if a modification would require
@@ -227,7 +227,7 @@ WERROR dsdb_linked_attribute_lDAPDisplayName_list(const struct dsdb_schema *sche
 	unsigned int i = 0;
 	for (cur = schema->attributes; cur; cur = cur->next) {
 		if (cur->linkID == 0) continue;
-		
+
 		attr_list = talloc_realloc(mem_ctx, attr_list, const char *, i+2);
 		if (!attr_list) {
 			return WERR_NOT_ENOUGH_MEMORY;
@@ -242,8 +242,8 @@ WERROR dsdb_linked_attribute_lDAPDisplayName_list(const struct dsdb_schema *sche
 	return WERR_OK;
 }
 
-const char **merge_attr_list(TALLOC_CTX *mem_ctx, 
-		       const char **attrs, const char * const*new_attrs) 
+const char **merge_attr_list(TALLOC_CTX *mem_ctx,
+		       const char **attrs, const char * const*new_attrs)
 {
 	const char **ret_attrs;
 	unsigned int i;
@@ -280,28 +280,28 @@ const char **dsdb_attribute_list(TALLOC_CTX *mem_ctx, const struct dsdb_class *s
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->mayContain);
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->systemMayContain);
 		break;
-		
+
 	case DSDB_SCHEMA_ALL_MUST:
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->mustContain);
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->systemMustContain);
 		break;
-		
+
 	case DSDB_SCHEMA_SYS_MAY:
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->systemMayContain);
 		break;
-		
+
 	case DSDB_SCHEMA_SYS_MUST:
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->systemMustContain);
 		break;
-		
+
 	case DSDB_SCHEMA_MAY:
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->mayContain);
 		break;
-		
+
 	case DSDB_SCHEMA_MUST:
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->mustContain);
 		break;
-		
+
 	case DSDB_SCHEMA_ALL:
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->mayContain);
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass->systemMayContain);
@@ -313,9 +313,9 @@ const char **dsdb_attribute_list(TALLOC_CTX *mem_ctx, const struct dsdb_class *s
 }
 
 static const char **attribute_list_from_class(TALLOC_CTX *mem_ctx,
-					      const struct dsdb_schema *schema, 
+					      const struct dsdb_schema *schema,
 					      const struct dsdb_class *sclass,
-					      enum dsdb_attr_list_query query) 
+					      enum dsdb_attr_list_query query)
 {
 	const char **this_class_list;
 	const char **system_recursive_list;
@@ -323,15 +323,15 @@ static const char **attribute_list_from_class(TALLOC_CTX *mem_ctx,
 	const char **attr_list;
 
 	this_class_list = dsdb_attribute_list(mem_ctx, sclass, query);
-	
-	recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema, 
+
+	recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema,
 							   sclass->systemAuxiliaryClass,
 							   query);
-	
-	system_recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema, 
+
+	system_recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema,
 								  sclass->auxiliaryClass,
 								  query);
-	
+
 	attr_list = this_class_list;
 	attr_list = merge_attr_list(mem_ctx, attr_list, recursive_list);
 	attr_list = merge_attr_list(mem_ctx, attr_list, system_recursive_list);
@@ -342,8 +342,8 @@ static const char **attribute_list_from_class(TALLOC_CTX *mem_ctx,
 
    Via attribute_list_from_class() this calls itself when recursing on auxiliary classes
  */
-static const char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx, 
-						      const struct dsdb_schema *schema, 
+static const char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx,
+						      const struct dsdb_schema *schema,
 						      const char **class_list,
 						      enum dsdb_attr_list_query query)
 {
@@ -366,11 +366,11 @@ static const char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx,
    Using the ldb_message_element ensures we do length-limited
    comparisons, rather than casting the possibly-unterminated string
 
-   Via attribute_list_from_class() this calls 
+   Via attribute_list_from_class() this calls
    dsdb_full_attribute_list_internal() when recursing on auxiliary classes
  */
-static const char **dsdb_full_attribute_list_internal_el(TALLOC_CTX *mem_ctx, 
-							 const struct dsdb_schema *schema, 
+static const char **dsdb_full_attribute_list_internal_el(TALLOC_CTX *mem_ctx,
+							 const struct dsdb_schema *schema,
 							 const struct ldb_message_element *el,
 							 enum dsdb_attr_list_query query)
 {
@@ -382,7 +382,7 @@ static const char **dsdb_full_attribute_list_internal_el(TALLOC_CTX *mem_ctx,
 			= attribute_list_from_class(mem_ctx, schema,
 						    dsdb_class_by_lDAPDisplayName_ldb_val(schema, &el->values[i]),
 						    query);
-		
+
 		attr_list = merge_attr_list(mem_ctx, attr_list, sclass_list);
 	}
 	return attr_list;
@@ -394,19 +394,19 @@ static int qsort_string(const char **s1, const char **s2)
 }
 
 /* Helper function to remove duplicates from the attribute list to be returned */
-static const char **dedup_attr_list(const char **attr_list) 
+static const char **dedup_attr_list(const char **attr_list)
 {
 	size_t new_len = str_list_length(attr_list);
 	/* Remove duplicates */
 	if (new_len > 1) {
 		size_t i;
 		TYPESAFE_QSORT(attr_list, new_len, qsort_string);
-		
-		for (i=1; i < new_len; i++) {
+
+		for (i=1; new_len > 0 && i < new_len; i++) {
 			const char **val1 = &attr_list[i-1];
 			const char **val2 = &attr_list[i];
 			if (ldb_attr_cmp(*val1, *val2) == 0) {
-				memmove(val1, val2, (new_len - i) * sizeof( *attr_list)); 
+				memmove(val1, val2, (new_len - i) * sizeof( *attr_list));
 				attr_list[new_len-1] = NULL;
 				new_len--;
 				i--;
@@ -423,8 +423,8 @@ static const char **dedup_attr_list(const char **attr_list)
 
    The result contains only unique values
  */
-const char **dsdb_full_attribute_list(TALLOC_CTX *mem_ctx, 
-				      const struct dsdb_schema *schema, 
+const char **dsdb_full_attribute_list(TALLOC_CTX *mem_ctx,
+				      const struct dsdb_schema *schema,
 				      const struct ldb_message_element *class_list,
 				      enum dsdb_attr_list_query query)
 {
diff --git a/source4/torture/nbt/winsreplication.c b/source4/torture/nbt/winsreplication.c
index e1c9a4dea11..90004cabe63 100644
--- a/source4/torture/nbt/winsreplication.c
+++ b/source4/torture/nbt/winsreplication.c
@@ -1,21 +1,21 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
    WINS replication testing
 
    Copyright (C) Andrew Tridgell	2005
    Copyright (C) Stefan Metzmacher	2005
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.


-- 
Samba Shared Repository



More information about the samba-cvs mailing list