From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 20 Mar 2017 11:56:00 +0000 (+0100)
Subject: s4:rpc_server/lsa: expect prepared [ref] pointers in dcesrv_lsa_LookupNames_common()
X-Git-Tag: tevent-0.9.36~39
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3339a1c57266181570d5ca5e389719951f26b41d;p=thirdparty%2Fsamba.git

s4:rpc_server/lsa: expect prepared [ref] pointers in dcesrv_lsa_LookupNames_common()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13286

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source4/rpc_server/lsa/lsa_lookup.c b/source4/rpc_server/lsa/lsa_lookup.c
index c2931c182c4..8c100144cd0 100644
--- a/source4/rpc_server/lsa/lsa_lookup.c
+++ b/source4/rpc_server/lsa/lsa_lookup.c
@@ -853,26 +853,22 @@ static NTSTATUS dcesrv_lsa_LookupNames_common(struct dcesrv_call_state *dce_call
 	struct lsa_RefDomainList *domains;
 	uint32_t i;
 
+	*r->out.domains = NULL;
+	r->out.sids->count = 0;
+	r->out.sids->sids = NULL;
+	*r->out.count = 0;
+
 	if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
 	    r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	*r->out.domains = NULL;
-
-	domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
+	domains = talloc_zero(r->out.domains, struct lsa_RefDomainList);
 	if (domains == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
 	*r->out.domains = domains;
 
-	r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray3);
-	if (r->out.sids == NULL) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	*r->out.count = 0;
-
 	r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3, 
 					   r->in.num_names);
 	if (r->out.sids->sids == NULL) {
@@ -979,6 +975,11 @@ NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX
 		DCESRV_FAULT(DCERPC_FAULT_ACCESS_DENIED);
 	}
 
+	*r->out.domains = NULL;
+	r->out.sids->count = 0;
+	r->out.sids->sids = NULL;
+	*r->out.count = 0;
+
 	status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx,
 					     0, /* we skip access checks */
 					     &policy_state);