r3652: Fix malloc-history dependent failures in smbtorture.

Because -r 3591 removed the over-allocation, realloc() had a chance of
returning a different pointer.  This broke the length calculations in
the trans2 send code.

I think the length calculations coudld be better expressed (less cute
PTR_DIFF tricks) but I'm not going to touch this any more than I need
to.

Andrew Bartlett
(This used to be commit 4bfc916a2c3b9745f47ce4eaa892cdcc431e19db)

diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c
index 32c12382f6a50c44d38a990bbeb0388c96b3dfc3..111a7ded2a1181ed02153d182bc660a64881e91f 100644 (file)
--- a/source4/libcli/raw/rawtrans.c
+++ b/source4/libcli/raw/rawtrans.c
@@ -222,7 +222,13 @@ struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
        if (!req) {
                return NULL;
        }
-       
+
+       /* Watch out, this changes the req->out.* pointers */
+       if (command == SMBtrans && parms->in.trans_name) {
+               namelen = smbcli_req_append_string(req, parms->in.trans_name, 
+                                               STR_TERMINATE);
+       }
+
        /* fill in SMB parameters */
        outparam = req->out.data + padding;
        outdata = outparam + parms->in.params.length;
@@ -230,11 +236,6 @@ struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
        /* make sure we don't leak data via the padding */
        memset(req->out.data, 0, padding);
 
-       if (command == SMBtrans && parms->in.trans_name) {
-               namelen = smbcli_req_append_string(req, parms->in.trans_name, 
-                                               STR_TERMINATE);
-       }
-
        /* primary request */
        SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
        SSVAL(req->out.vwv,VWV(1),parms->in.data.length);