r22770: sync with SAMBA_3_0_25 as of svn r22765

11 files changed, 82 insertions, 52 deletions

diff --git a/source/configure.in b/source/configure.in
index bb54635135f..fd728289d7b 100644
--- a/source/configure.in
+++ b/source/configure.in
@@ -5764,10 +5764,6 @@ AC_SUBST(WINBIND_NSS_EXTRA_OBJS)
 AC_SUBST(WINBIND_NSS_EXTRA_LIBS)
 AC_SUBST(NSSSONAMEVERSIONSUFFIX)
 
-if test $BLDSHARED = true -a x"$HAVE_WINBIND" = x"yes"; then
-	NSS_MODULES="${WINBIND_NSS} ${WINBIND_WINS_NSS}"
-fi
-
 AC_SUBST(SMB_KRB5_LOCATOR)
 
 # Check the setting of --with-winbind
@@ -5802,6 +5798,10 @@ if test x"$HAVE_WINBIND" = x"no"; then
 	WINBIND_WINS_NSS=""
 fi
 
+if test $BLDSHARED = true -a x"$HAVE_WINBIND" = x"yes"; then
+	NSS_MODULES="${WINBIND_NSS} ${WINBIND_WINS_NSS}"
+fi
+
 if test x"$HAVE_WINBIND" = x"yes"; then
         AC_MSG_RESULT(yes)
 	AC_DEFINE(WITH_WINBIND,1,[Whether to build winbind])
diff --git a/source/lib/charcnv.c b/source/lib/charcnv.c
index 3d02988a979..8d5fbc8118d 100644
--- a/source/lib/charcnv.c
+++ b/source/lib/charcnv.c
@@ -972,13 +972,18 @@ size_t pull_ascii(char *dest, const void *src, size_t dest_len, size_t src_len,
 
 	ret = convert_string(CH_DOS, CH_UNIX, src, src_len, dest, dest_len, True);
 	if (ret == (size_t)-1) {
+		ret = 0;
 		dest_len = 0;
 	}
 
-	if (dest_len)
-		dest[MIN(ret, dest_len-1)] = 0;
-	else 
+	if (dest_len && ret) {
+		/* Did we already process the terminating zero ? */
+		if (dest[MIN(ret-1, dest_len-1)] != 0) {
+			dest[MIN(ret, dest_len-1)] = 0;
+		}
+	} else  {
 		dest[0] = 0;
+	}
 
 	return src_len;
 }
@@ -1219,10 +1224,14 @@ size_t pull_ucs2(const void *base_ptr, char *dest, const void *src, size_t dest_
 	if (src_len == (size_t)-1)
 		src_len = ret*2;
 		
-	if (dest_len)
-		dest[MIN(ret, dest_len-1)] = 0;
-	else 
+	if (dest_len && ret) {
+		/* Did we already process the terminating zero ? */
+		if (dest[MIN(ret-1, dest_len-1)] != 0) {
+			dest[MIN(ret, dest_len-1)] = 0;
+		}
+	} else {
 		dest[0] = 0;
+	}
 
 	return src_len;
 }
diff --git a/source/modules/vfs_afsacl.c b/source/modules/vfs_afsacl.c
index a82e6b350b2..47e8ec5aefa 100644
--- a/source/modules/vfs_afsacl.c
+++ b/source/modules/vfs_afsacl.c
@@ -616,7 +616,7 @@ static size_t afs_to_nt_acl(struct afs_acl *afs_acl,
 	uid_to_sid(&owner_sid, sbuf.st_uid);
 	gid_to_sid(&group_sid, sbuf.st_gid);
 
-	if (num_aces) {
+	if (afs_acl->num_aces) {
 		nt_ace_list = TALLOC_ARRAY(mem_ctx, SEC_ACE, afs_acl->num_aces);
 
 		if (nt_ace_list == NULL)
diff --git a/source/nsswitch/idmap.c b/source/nsswitch/idmap.c
index 5222eba8f36..73a30f60874 100644
--- a/source/nsswitch/idmap.c
+++ b/source/nsswitch/idmap.c
@@ -1025,17 +1025,16 @@ static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
 	DEBUG(10, ("Query backends to map sids->ids\n"));
 
 	/* split list per domain */
-
-	if (num_domains) {
-		dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
-		IDMAP_CHECK_ALLOC(dom_ids);
-		counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
-		IDMAP_CHECK_ALLOC(counters);
-	} else {
-		dom_ids = NULL;
-		counters = NULL;
+	if (num_domains == 0) {
+		DEBUG(1, ("No domains available?\n"));
+		return NT_STATUS_UNSUCCESSFUL;
 	}
 
+	dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
+	IDMAP_CHECK_ALLOC(dom_ids);
+	counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
+	IDMAP_CHECK_ALLOC(counters);
+
 	/* partition the requests by domain */
 
 	for (i = 0; ids[i]; i++) {
diff --git a/source/nsswitch/winbindd_async.c b/source/nsswitch/winbindd_async.c
index a8a92c3caea..eb8631ab868 100644
--- a/source/nsswitch/winbindd_async.c
+++ b/source/nsswitch/winbindd_async.c
@@ -163,6 +163,7 @@ enum winbindd_result winbindd_dual_set_mapping(struct winbindd_domain *domain,
 	map.sid = &sid;
 	map.xid.id = state->request.data.dual_idmapset.id;
 	map.xid.type = state->request.data.dual_idmapset.type;
+	map.status = ID_MAPPED;
 
 	result = idmap_set_mapping(&map);
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
@@ -273,6 +274,11 @@ enum winbindd_result winbindd_dual_sids2xids(struct winbindd_domain *domain,
 
 	DEBUG(3, ("[%5lu]: sids to unix ids\n", (unsigned long)state->pid));
 
+	if (state->request.extra_len == 0) {
+		DEBUG(0, ("Invalid buffer size!\n"));
+		return WINBINDD_ERROR;
+	}
+
 	sids = (DOM_SID *)state->request.extra_data.data;
 	num = state->request.extra_len / sizeof(DOM_SID);
 
diff --git a/source/nsswitch/winbindd_group.c b/source/nsswitch/winbindd_group.c
index 9cf6cc12e0f..1bd00869231 100644
--- a/source/nsswitch/winbindd_group.c
+++ b/source/nsswitch/winbindd_group.c
@@ -479,6 +479,9 @@ void winbindd_getgrnam(struct winbindd_cli_state *state)
 	memset(name_group, 0, sizeof(fstring));
 
 	tmp = state->request.data.groupname;
+
+	name_domain[0] = '\0';
+	name_group[0] = '\0';
 	
 	parse_domain_user(tmp, name_domain, name_group);
 
diff --git a/source/rpc_client/cli_svcctl.c b/source/rpc_client/cli_svcctl.c
index 2df27c2da5b..d183670f5fb 100644
--- a/source/rpc_client/cli_svcctl.c
+++ b/source/rpc_client/cli_svcctl.c
@@ -209,8 +209,12 @@ WERROR rpccli_svcctl_enumerate_services( struct rpc_pipe_client *cli, TALLOC_CTX
 		return out.status;
 		
 	/* pull out the data */
-	if ( !(services = TALLOC_ARRAY( mem_ctx, ENUM_SERVICES_STATUS, out.returned )) ) 
-		return WERR_NOMEM;
+	if (out.returned) {
+		if ( !(services = TALLOC_ARRAY( mem_ctx, ENUM_SERVICES_STATUS, out.returned )) ) 
+			return WERR_NOMEM;
+	} else {
+		services = NULL;
+	}
 		
 	for ( i=0; i<out.returned; i++ ) {
 		svcctl_io_enum_services_status( "", &services[i], &out.buffer, 0 );
diff --git a/source/rpc_parse/parse_misc.c b/source/rpc_parse/parse_misc.c
index a926a5e18ee..9fa7c7d674d 100644
--- a/source/rpc_parse/parse_misc.c
+++ b/source/rpc_parse/parse_misc.c
@@ -530,12 +530,17 @@ BOOL smb_io_unistr(const char *desc, UNISTR *uni, prs_struct *ps, int depth)
  Allocate the RPC_DATA_BLOB memory.
 ********************************************************************/
 
-size_t create_rpc_blob(RPC_DATA_BLOB *str, size_t len)
+static void create_rpc_blob(RPC_DATA_BLOB *str, size_t len)
 {
-	str->buffer = (uint8 *)TALLOC_ZERO(get_talloc_ctx(), len);
-	if (str->buffer == NULL)
-		smb_panic("create_rpc_blob: talloc fail\n");
-	return len;
+	if (len) {
+		str->buffer = (uint8 *)TALLOC_ZERO(get_talloc_ctx(), len);
+		if (str->buffer == NULL)
+			smb_panic("create_rpc_blob: talloc fail\n");
+		str->buf_len = len;
+	} else {
+		str->buffer = NULL;
+		str->buf_len = 0;
+	}
 }
 
 /*******************************************************************
@@ -547,7 +552,7 @@ void init_rpc_blob_uint32(RPC_DATA_BLOB *str, uint32 val)
 	ZERO_STRUCTP(str);
 
 	/* set up string lengths. */
-	str->buf_len = create_rpc_blob(str, sizeof(uint32));
+	create_rpc_blob(str, sizeof(uint32));
 	SIVAL(str->buffer, 0, val);
 }
 
@@ -560,9 +565,10 @@ void init_rpc_blob_str(RPC_DATA_BLOB *str, const char *buf, int len)
 	ZERO_STRUCTP(str);
 
 	/* set up string lengths. */
-	str->buf_len = create_rpc_blob(str, len*2);
-	rpcstr_push(str->buffer, buf, (size_t)str->buf_len, STR_TERMINATE);
-	
+	if (len) {
+		create_rpc_blob(str, len*2);
+		rpcstr_push(str->buffer, buf, (size_t)str->buf_len, STR_TERMINATE);
+	}
 }
 
 /*******************************************************************
@@ -572,8 +578,10 @@ void init_rpc_blob_str(RPC_DATA_BLOB *str, const char *buf, int len)
 void init_rpc_blob_hex(RPC_DATA_BLOB *str, const char *buf)
 {
 	ZERO_STRUCTP(str);
-	str->buf_len = create_rpc_blob(str, strlen(buf));
-	str->buf_len = strhex_to_str((char *)str->buffer, str->buf_len, buf);
+	if (buf && *buf) {
+		create_rpc_blob(str, strlen(buf));
+		str->buf_len = strhex_to_str((char *)str->buffer, str->buf_len, buf);
+	}
 }
 
 /*******************************************************************
@@ -585,8 +593,8 @@ void init_rpc_blob_bytes(RPC_DATA_BLOB *str, uint8 *buf, size_t len)
 	ZERO_STRUCTP(str);
 
 	/* max buffer size (allocated size) */
-	if (buf != NULL) {
-		len = create_rpc_blob(str, len);
+	if (buf != NULL && len) {
+		create_rpc_blob(str, len);
 		memcpy(str->buffer, buf, len);
 	}
 	str->buf_len = len;
diff --git a/source/rpc_server/srv_lsa_nt.c b/source/rpc_server/srv_lsa_nt.c
index b42a851c151..ff35e61e263 100644
--- a/source/rpc_server/srv_lsa_nt.c
+++ b/source/rpc_server/srv_lsa_nt.c
@@ -826,7 +826,11 @@ static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
 	*pp_mapped_count = 0;
 	*pp_ref = NULL;
 	*pp_names = NULL;
-	
+
+	if (num_sids == 0) {
+		return NT_STATUS_OK;
+	}
+
 	names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM2);
 	sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
 	ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
@@ -846,12 +850,10 @@ static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
 		return status;
 	}
 
-	if (num_sids > 0) {
-		names->name = TALLOC_ARRAY(names, LSA_TRANS_NAME2, num_sids);
-		names->uni_name = TALLOC_ARRAY(names, UNISTR2, num_sids);
-		if ((names->name == NULL) || (names->uni_name == NULL)) {
-			return NT_STATUS_NO_MEMORY;
-		}
+	names->name = TALLOC_ARRAY(names, LSA_TRANS_NAME2, num_sids);
+	names->uni_name = TALLOC_ARRAY(names, UNISTR2, num_sids);
+	if ((names->name == NULL) || (names->uni_name == NULL)) {
+		return NT_STATUS_NO_MEMORY;
 	}
 
 	for (i=0; i<MAX_REF_DOMAINS; i++) {
diff --git a/source/smbd/notify.c b/source/smbd/notify.c
index cf60720bc74..d6a2fe76927 100644
--- a/source/smbd/notify.c
+++ b/source/smbd/notify.c
@@ -336,7 +336,7 @@ void notify_fname(connection_struct *conn, uint32 action, uint32 filter,
 static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
 {
 	struct notify_change *change, *changes;
-	char *name2;
+	pstring name2;
 
 	if (fsp->notify == NULL) {
 		/*
@@ -345,11 +345,7 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
 		return;
 	}
 
-	if (!(name2 = talloc_strdup(fsp->notify, name))) {
-		DEBUG(0, ("talloc_strdup failed\n"));
-			return;
-	}
-
+	pstrcpy(name2, name);
 	string_replace(name2, '/', '\\');
 
 	/*
@@ -363,7 +359,6 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
 		 * guard against a DoS here.
 		 */
 		TALLOC_FREE(fsp->notify->changes);
-		TALLOC_FREE(name2);
 		fsp->notify->num_changes = -1;
 		return;
 	}
@@ -376,7 +371,6 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
 		      fsp->notify, fsp->notify->changes,
 		      struct notify_change, fsp->notify->num_changes+1))) {
 		DEBUG(0, ("talloc_realloc failed\n"));
-		TALLOC_FREE(name2);
 		return;
 	}
 
@@ -384,7 +378,11 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
 
 	change = &(fsp->notify->changes[fsp->notify->num_changes]);
 
-	change->name = talloc_move(changes, &name2);
+	if (!(change->name = talloc_strdup(changes, name2))) {
+		DEBUG(0, ("talloc_strdup failed\n"));
+		return;
+	}
+
 	change->action = action;
 	fsp->notify->num_changes += 1;
 
@@ -400,7 +398,7 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
 		 * We have to send the two rename events in one reply. So hold
 		 * the first part back.
 		 */
-	return;
+		return;
 	}
 
 	/*
diff --git a/source/smbd/reply.c b/source/smbd/reply.c
index 2f1f5e0ba34..b8d201328b5 100644
--- a/source/smbd/reply.c
+++ b/source/smbd/reply.c
@@ -2237,6 +2237,7 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
 			exit_server_cleanly("send_file_readbraw sendfile failed");
 		}
 
+		return;
 	}
 
   normal_readbraw: