registry: Fix CID 241075 Unchecked return value
[kai/samba-autobuild/.git] / source4 / lib / registry / ldb.c
index 9a26887b4b9e0cbd1132f4d2815e36447996e8b7..1dfffdb7acc5f98f68f90483fc51717ffac5fa1c 100644 (file)
@@ -20,8 +20,8 @@
 
 #include "includes.h"
 #include "registry.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
+#include <ldb.h>
+#include <ldb_errors.h>
 #include "ldb_wrap.h"
 #include "librpc/gen_ndr/winreg.h"
 #include "param/param.h"
@@ -35,6 +35,7 @@ struct ldb_key_data
        struct ldb_dn *dn;
        struct ldb_message **subkeys, **values;
        unsigned int subkey_count, value_count;
+       const char *classname;
 };
 
 static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx,
@@ -48,7 +49,7 @@ static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx,
        if (name != NULL) {
                *name = talloc_strdup(mem_ctx,
                                      ldb_msg_find_attr_as_string(msg, "value",
-                                     NULL));
+                                     ""));
        }
 
        value_type = ldb_msg_find_attr_as_uint(msg, "type", 0);
@@ -61,9 +62,10 @@ static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx,
        case REG_SZ:
        case REG_EXPAND_SZ:
                if (val != NULL) {
+                       /* The data should be provided as UTF16 string */
                        convert_string_talloc(mem_ctx, CH_UTF8, CH_UTF16,
-                                                    val->data, val->length,
-                                                    (void **)&data->data, &data->length, false);
+                                             val->data, val->length,
+                                             (void **)&data->data, &data->length);
                } else {
                        data->data = NULL;
                        data->length = 0;
@@ -71,10 +73,30 @@ static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx,
                break;
 
        case REG_DWORD:
+       case REG_DWORD_BIG_ENDIAN:
                if (val != NULL) {
+                       /* The data is a plain DWORD */
                        uint32_t tmp = strtoul((char *)val->data, NULL, 0);
-                       *data = data_blob_talloc(mem_ctx, NULL, 4);
-                       SIVAL(data->data, 0, tmp);
+                       data->data = talloc_size(mem_ctx, sizeof(uint32_t));
+                       if (data->data != NULL) {
+                               SIVAL(data->data, 0, tmp);
+                       }
+                       data->length = sizeof(uint32_t);
+               } else {
+                       data->data = NULL;
+                       data->length = 0;
+               }
+               break;
+
+       case REG_QWORD:
+               if (val != NULL) {
+                       /* The data is a plain QWORD */
+                       uint64_t tmp = strtoull((char *)val->data, NULL, 0);
+                       data->data = talloc_size(mem_ctx, sizeof(uint64_t));
+                       if (data->data != NULL) {
+                               SBVAL(data->data, 0, tmp);
+                       }
+                       data->length = sizeof(uint64_t);
                } else {
                        data->data = NULL;
                        data->length = 0;
@@ -84,7 +106,9 @@ static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx,
        case REG_BINARY:
        default:
                if (val != NULL) {
-                       *data = data_blob_talloc(mem_ctx, val->data, val->length);
+                       data->data = talloc_memdup(mem_ctx, val->data,
+                                                  val->length);
+                       data->length = val->length;
                } else {
                        data->data = NULL;
                        data->length = 0;
@@ -122,10 +146,9 @@ static struct ldb_message *reg_ldb_pack_value(struct ldb_context *ctx,
        switch (type) {
        case REG_SZ:
        case REG_EXPAND_SZ:
-               if ((data.length > 0) && (data.data != NULL)
-                   && (data.data[0] != '\0')) {
+               if ((data.length > 0) && (data.data != NULL)) {
                        struct ldb_val *val;
-                       bool ret2;
+                       bool ret2 = false;
 
                        val = talloc_zero(msg, struct ldb_val);
                        if (val == NULL) {
@@ -133,27 +156,62 @@ static struct ldb_message *reg_ldb_pack_value(struct ldb_context *ctx,
                                return NULL;
                        }
 
+                       /* The data is provided as UTF16 string */
                        ret2 = convert_string_talloc(mem_ctx, CH_UTF16, CH_UTF8,
                                                     (void *)data.data, data.length,
-                                                    (void **)&val->data, &val->length,
-                                                    false);
-                       ret = ldb_msg_add_value(msg, "data", val, NULL);
+                                                    (void **)&val->data, &val->length);
+                       if (ret2) {
+                               ret = ldb_msg_add_value(msg, "data", val, NULL);
+                       } else {
+                               /* workaround for non-standard data */
+                               ret = ldb_msg_add_empty(msg, "data", LDB_FLAG_MOD_DELETE, NULL);
+                       }
                } else {
                        ret = ldb_msg_add_empty(msg, "data", LDB_FLAG_MOD_DELETE, NULL);
                }
                break;
 
        case REG_DWORD:
+       case REG_DWORD_BIG_ENDIAN:
                if ((data.length > 0) && (data.data != NULL)) {
-                       char *conv_str;
-
-                       conv_str = talloc_asprintf(msg, "0x%x", IVAL(data.data, 0));
-                       if (conv_str == NULL) {
+                       if (data.length == sizeof(uint32_t)) {
+                               char *conv_str;
+
+                               conv_str = talloc_asprintf(msg, "0x%8.8x",
+                                                          IVAL(data.data, 0));
+                               if (conv_str == NULL) {
+                                       talloc_free(msg);
+                                       return NULL;
+                               }
+                               ret = ldb_msg_add_string(msg, "data", conv_str);
+                       } else {
+                               /* workaround for non-standard data */
                                talloc_free(msg);
                                return NULL;
                        }
+               } else {
+                       ret = ldb_msg_add_empty(msg, "data", LDB_FLAG_MOD_DELETE, NULL);
+               }
+               break;
+
+       case REG_QWORD:
+               if ((data.length > 0) && (data.data != NULL)) {
+                       if (data.length == sizeof(uint64_t)) {
+                               char *conv_str;
+
+                               conv_str = talloc_asprintf(msg, "0x%16.16llx",
+                                                          (unsigned long long)BVAL(data.data, 0));
+                               if (conv_str == NULL) {
+                                       talloc_free(msg);
+                                       return NULL;
+                               }
+                               ret = ldb_msg_add_string(msg, "data", conv_str);
+                       } else {
+                               /* workaround for non-standard data */
+                               talloc_free(msg);
+                               return NULL;
 
-                       ret = ldb_msg_add_string(msg, "data", conv_str);
+                       }
                } else {
                        ret = ldb_msg_add_empty(msg, "data", LDB_FLAG_MOD_DELETE, NULL);
                }
@@ -161,8 +219,7 @@ static struct ldb_message *reg_ldb_pack_value(struct ldb_context *ctx,
 
        case REG_BINARY:
        default:
-               if ((data.length > 0) && (data.data != NULL)
-                   && (data.data[0] != '\0')) {
+               if ((data.length > 0) && (data.data != NULL)) {
                        ret = ldb_msg_add_value(msg, "data", &data, NULL);
                } else {
                        ret = ldb_msg_add_empty(msg, "data", LDB_FLAG_MOD_DELETE, NULL);
@@ -218,51 +275,47 @@ static struct ldb_dn *reg_path_to_ldb(TALLOC_CTX *mem_ctx,
                                      const struct hive_key *from,
                                      const char *path, const char *add)
 {
-       TALLOC_CTX *local_ctx;
        struct ldb_dn *ret;
-       char *mypath = talloc_strdup(mem_ctx, path);
+       char *mypath;
        char *begin;
        struct ldb_key_data *kd = talloc_get_type(from, struct ldb_key_data);
        struct ldb_context *ldb = kd->ldb;
 
-       local_ctx = talloc_new(mem_ctx);
+       mypath = talloc_strdup(mem_ctx, path);
+       if (mypath == NULL) {
+               return NULL;
+       }
 
        ret = ldb_dn_new(mem_ctx, ldb, add);
        if (!ldb_dn_validate(ret)) {
                talloc_free(ret);
-               talloc_free(local_ctx);
                return NULL;
        }
 
-       while (mypath) {
-               char *keyname;
-
-               begin = strrchr(mypath, '\\');
+       if (!ldb_dn_add_base(ret, kd->dn)) {
+               talloc_free(ret);
+               return NULL;
+       }
 
-               if (begin) keyname = begin + 1;
-               else keyname = mypath;
+       while (mypath[0] != '\0') {
+               begin = strchr(mypath, '\\');
+               if (begin != NULL) {
+                       *begin = '\0';
+               }
 
-               if (keyname[0] != '\0') {
-                       if (!ldb_dn_add_base_fmt(ret, "key=%s",
-                                                reg_ldb_escape(local_ctx,
-                                                               keyname)))
-                       {
-                               talloc_free(local_ctx);
-                               return NULL;
-                       }
+               if (!ldb_dn_add_child_fmt(ret, "key=%s",
+                                         reg_ldb_escape(mem_ctx, mypath))) {
+                       talloc_free(ret);
+                       return NULL;
                }
 
-               if(begin) {
-                       *begin = '\0';
+               if (begin != NULL) {
+                       mypath = begin + 1;
                } else {
                        break;
                }
        }
 
-       ldb_dn_add_base(ret, kd->dn);
-
-       talloc_free(local_ctx);
-
        return ret;
 }
 
@@ -272,8 +325,8 @@ static WERROR cache_subkeys(struct ldb_key_data *kd)
        struct ldb_result *res;
        int ret;
 
-       ret = ldb_search(c, c, &res, kd->dn, LDB_SCOPE_ONELEVEL, NULL, "(key=*)");
-
+       ret = ldb_search(c, c, &res, kd->dn, LDB_SCOPE_ONELEVEL,
+                        NULL, "(key=*)");
        if (ret != LDB_SUCCESS) {
                DEBUG(0, ("Error getting subkeys for '%s': %s\n",
                        ldb_dn_get_linearized(kd->dn), ldb_errstring(c)));
@@ -295,7 +348,6 @@ static WERROR cache_values(struct ldb_key_data *kd)
 
        ret = ldb_search(c, c, &res, kd->dn, LDB_SCOPE_ONELEVEL,
                         NULL, "(value=*)");
-
        if (ret != LDB_SUCCESS) {
                DEBUG(0, ("Error getting values for '%s': %s\n",
                        ldb_dn_get_linearized(kd->dn), ldb_errstring(c)));
@@ -316,14 +368,13 @@ static WERROR ldb_get_subkey_by_id(TALLOC_CTX *mem_ctx,
                                   const char **classname,
                                   NTTIME *last_mod_time)
 {
-       struct ldb_message_element *el;
        struct ldb_key_data *kd = talloc_get_type(k, struct ldb_key_data);
 
        /* Initialization */
        if (name != NULL)
                *name = NULL;
        if (classname != NULL)
-               *classname = NULL; /* TODO: Store properly */
+               *classname = NULL;
        if (last_mod_time != NULL)
                *last_mod_time = 0; /* TODO: we need to add this to the
                                                ldb backend properly */
@@ -336,19 +387,20 @@ static WERROR ldb_get_subkey_by_id(TALLOC_CTX *mem_ctx,
        if (idx >= kd->subkey_count)
                return WERR_NO_MORE_ITEMS;
 
-       el = ldb_msg_find_element(kd->subkeys[idx], "key");
-       SMB_ASSERT(el != NULL);
-       SMB_ASSERT(el->num_values != 0);
-
        if (name != NULL)
-               *name = talloc_strdup(mem_ctx, (char *)el->values[0].data);
+               *name = talloc_strdup(mem_ctx,
+                                     ldb_msg_find_attr_as_string(kd->subkeys[idx], "key", NULL));
+       if (classname != NULL)
+               *classname = talloc_strdup(mem_ctx,
+                                          ldb_msg_find_attr_as_string(kd->subkeys[idx], "classname", NULL));
 
        return WERR_OK;
 }
 
-static WERROR ldb_get_default_value(TALLOC_CTX *mem_ctx, struct hive_key *k,
-                                 const char **name, uint32_t *data_type,
-                                  DATA_BLOB *data)
+static WERROR ldb_get_default_value(TALLOC_CTX *mem_ctx,
+                                   const struct hive_key *k,
+                                   const char **name, uint32_t *data_type,
+                                   DATA_BLOB *data)
 {
        struct ldb_key_data *kd = talloc_get_type(k, struct ldb_key_data);
        struct ldb_context *c = kd->ldb;
@@ -356,7 +408,8 @@ static WERROR ldb_get_default_value(TALLOC_CTX *mem_ctx, struct hive_key *k,
        struct ldb_result *res;
        int ret;
 
-       ret = ldb_search(c, mem_ctx, &res, kd->dn, LDB_SCOPE_BASE, attrs, "%s", "");
+       ret = ldb_search(c, mem_ctx, &res, kd->dn, LDB_SCOPE_BASE, attrs,
+                        NULL);
 
        if (ret != LDB_SUCCESS) {
                DEBUG(0, ("Error getting default value for '%s': %s\n",
@@ -364,11 +417,15 @@ static WERROR ldb_get_default_value(TALLOC_CTX *mem_ctx, struct hive_key *k,
                return WERR_FOOBAR;
        }
 
-       if (res->count == 0 || res->msgs[0]->num_elements == 0)
+       if (res->count == 0 || res->msgs[0]->num_elements == 0) {
+               talloc_free(res);
                return WERR_BADFILE;
+       }
 
-       reg_ldb_unpack_value(mem_ctx,
-                res->msgs[0], name, data_type, data);
+       if ((data_type != NULL) && (data != NULL)) {
+               reg_ldb_unpack_value(mem_ctx, res->msgs[0], name, data_type,
+                                    data);
+       }
 
        talloc_free(res);
 
@@ -381,7 +438,7 @@ static WERROR ldb_get_value_by_id(TALLOC_CTX *mem_ctx, struct hive_key *k,
 {
        struct ldb_key_data *kd = talloc_get_type(k, struct ldb_key_data);
 
-       /* if default value exists, give it back */
+       /* if the default value exists, give it back */
        if (W_ERROR_IS_OK(ldb_get_default_value(mem_ctx, k, name, data_type,
                data))) {
                if (idx == 0)
@@ -408,68 +465,68 @@ static WERROR ldb_get_value(TALLOC_CTX *mem_ctx, struct hive_key *k,
                            DATA_BLOB *data)
 {
        struct ldb_key_data *kd = talloc_get_type(k, struct ldb_key_data);
-       struct ldb_context *c = kd->ldb;
-       struct ldb_result *res;
-       int ret;
-
-       if (name == NULL) {
-               return WERR_INVALID_PARAM;
-       }
+       const char *res_name;
+       uint32_t idx;
 
+       /* the default value was requested, give it back */
        if (name[0] == '\0') {
-               /* default value */
                return ldb_get_default_value(mem_ctx, k, NULL, data_type, data);
-       } else {
-               /* normal value */
-               ret = ldb_search(c, mem_ctx, &res, kd->dn, LDB_SCOPE_ONELEVEL,
-                                NULL, "(value=%s)", name);
-
-               if (ret != LDB_SUCCESS) {
-                       DEBUG(0, ("Error getting values for '%s': %s\n",
-                               ldb_dn_get_linearized(kd->dn), ldb_errstring(c)));
-                       return WERR_FOOBAR;
-               }
-
-               if (res->count == 0)
-                       return WERR_BADFILE;
+       }
 
-               reg_ldb_unpack_value(mem_ctx, res->msgs[0], NULL, data_type, data);
+       /* Do the search if necessary */
+       if (kd->values == NULL) {
+               W_ERROR_NOT_OK_RETURN(cache_values(kd));
+       }
 
-               talloc_free(res);
+       for (idx = 0; idx < kd->value_count; idx++) {
+               res_name = ldb_msg_find_attr_as_string(kd->values[idx], "value",
+                                                      "");
+               if (ldb_attr_cmp(name, res_name) == 0) {
+                       reg_ldb_unpack_value(mem_ctx, kd->values[idx], NULL,
+                                            data_type, data);
+                       return WERR_OK;
+               }
        }
 
-       return WERR_OK;
+       return WERR_BADFILE;
 }
 
 static WERROR ldb_open_key(TALLOC_CTX *mem_ctx, const struct hive_key *h,
                           const char *name, struct hive_key **key)
 {
        struct ldb_result *res;
-       struct ldb_dn *ldap_path;
+       struct ldb_dn *ldb_path;
        int ret;
        struct ldb_key_data *newkd;
        struct ldb_key_data *kd = talloc_get_type(h, struct ldb_key_data);
        struct ldb_context *c = kd->ldb;
 
-       ldap_path = reg_path_to_ldb(mem_ctx, h, name, NULL);
+       ldb_path = reg_path_to_ldb(mem_ctx, h, name, NULL);
+       W_ERROR_HAVE_NO_MEMORY(ldb_path);
 
-       ret = ldb_search(c, mem_ctx, &res, ldap_path, LDB_SCOPE_BASE, NULL, "(key=*)");
+       ret = ldb_search(c, mem_ctx, &res, ldb_path, LDB_SCOPE_BASE, NULL,
+                        NULL);
 
        if (ret != LDB_SUCCESS) {
                DEBUG(3, ("Error opening key '%s': %s\n",
-                       ldb_dn_get_linearized(ldap_path), ldb_errstring(c)));
+                       ldb_dn_get_linearized(ldb_path), ldb_errstring(c)));
                return WERR_FOOBAR;
        } else if (res->count == 0) {
                DEBUG(3, ("Key '%s' not found\n",
-                       ldb_dn_get_linearized(ldap_path)));
+                       ldb_dn_get_linearized(ldb_path)));
                talloc_free(res);
                return WERR_BADFILE;
        }
 
        newkd = talloc_zero(mem_ctx, struct ldb_key_data);
+       W_ERROR_HAVE_NO_MEMORY(newkd);
        newkd->key.ops = &reg_backend_ldb;
        newkd->ldb = talloc_reference(newkd, kd->ldb);
-       newkd->dn = ldb_dn_copy(mem_ctx, res->msgs[0]->dn);
+       newkd->dn = ldb_dn_copy(newkd, res->msgs[0]->dn);
+       newkd->classname = talloc_steal(newkd,
+                                       ldb_msg_find_attr_as_string(res->msgs[0], "classname", NULL));
+
+       talloc_free(res);
 
        *key = (struct hive_key *)newkd;
 
@@ -526,20 +583,28 @@ static WERROR ldb_add_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
                          struct hive_key **newkey)
 {
        struct ldb_key_data *parentkd = discard_const_p(struct ldb_key_data, parent);
+       struct ldb_dn *ldb_path;
        struct ldb_message *msg;
        struct ldb_key_data *newkd;
        int ret;
 
+       ldb_path = reg_path_to_ldb(mem_ctx, parent, name, NULL);
+       W_ERROR_HAVE_NO_MEMORY(ldb_path);
+
        msg = ldb_msg_new(mem_ctx);
+       W_ERROR_HAVE_NO_MEMORY(msg);
 
-       msg->dn = reg_path_to_ldb(msg, parent, name, NULL);
+       msg->dn = ldb_path;
 
-       ldb_msg_add_string(msg, "key", talloc_strdup(mem_ctx, name));
-       if (classname != NULL)
-               ldb_msg_add_string(msg, "classname",
-                                  talloc_strdup(mem_ctx, classname));
+       ldb_msg_add_string(msg, "key", name);
+       if (classname != NULL) {
+               ldb_msg_add_string(msg, "classname", classname);
+       }
 
        ret = ldb_add(parentkd->ldb, msg);
+
+       talloc_free(msg);
+
        if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
                return WERR_ALREADY_EXISTS;
        }
@@ -549,12 +614,14 @@ static WERROR ldb_add_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
                return WERR_FOOBAR;
        }
 
-       DEBUG(2, ("key added: %s\n", ldb_dn_get_linearized(msg->dn)));
+       DEBUG(2, ("key added: %s\n", ldb_dn_get_linearized(ldb_path)));
 
        newkd = talloc_zero(mem_ctx, struct ldb_key_data);
+       W_ERROR_HAVE_NO_MEMORY(newkd);
        newkd->ldb = talloc_reference(newkd, parentkd->ldb);
        newkd->key.ops = &reg_backend_ldb;
-       newkd->dn = talloc_steal(newkd, msg->dn);
+       newkd->dn = talloc_steal(newkd, ldb_path);
+       newkd->classname = talloc_steal(newkd, classname);
 
        *newkey = (struct hive_key *)newkd;
 
@@ -565,31 +632,40 @@ static WERROR ldb_add_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
        return WERR_OK;
 }
 
-static WERROR ldb_del_value (struct hive_key *key, const char *child)
+static WERROR ldb_del_value(TALLOC_CTX *mem_ctx, struct hive_key *key,
+                           const char *child)
 {
        int ret;
        struct ldb_key_data *kd = talloc_get_type(key, struct ldb_key_data);
-       TALLOC_CTX *mem_ctx;
        struct ldb_message *msg;
        struct ldb_dn *childdn;
 
-       if ((child == NULL) || (child[0] == '\0')) {
+       if (child[0] == '\0') {
                /* default value */
-               mem_ctx = talloc_init("ldb_del_value");
-
                msg = talloc_zero(mem_ctx, struct ldb_message);
+               W_ERROR_HAVE_NO_MEMORY(msg);
                msg->dn = ldb_dn_copy(msg, kd->dn);
-               ldb_msg_add_empty(msg, "data", LDB_FLAG_MOD_DELETE, NULL);
-               ldb_msg_add_empty(msg, "type", LDB_FLAG_MOD_DELETE, NULL);
+               W_ERROR_HAVE_NO_MEMORY(msg->dn);
+               ret = ldb_msg_add_empty(msg, "data", LDB_FLAG_MOD_DELETE, NULL);
+               if (ret != LDB_SUCCESS) {
+                       return WERR_FOOBAR;
+               }
+               ret = ldb_msg_add_empty(msg, "type", LDB_FLAG_MOD_DELETE,
+                                       NULL);
+               if (ret != LDB_SUCCESS) {
+                       return WERR_FOOBAR;
+               }
 
                ret = ldb_modify(kd->ldb, msg);
-               if (ret != LDB_SUCCESS) {
+
+               talloc_free(msg);
+
+               if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
+                       return WERR_BADFILE;
+               } else if (ret != LDB_SUCCESS) {
                        DEBUG(1, ("ldb_del_value: %s\n", ldb_errstring(kd->ldb)));
-                       talloc_free(mem_ctx);
                        return WERR_FOOBAR;
                }
-
-               talloc_free(mem_ctx);
        } else {
                /* normal value */
                childdn = ldb_dn_copy(kd->ldb, kd->dn);
@@ -619,13 +695,13 @@ static WERROR ldb_del_value (struct hive_key *key, const char *child)
        return WERR_OK;
 }
 
-static WERROR ldb_del_key(const struct hive_key *key, const char *name)
+static WERROR ldb_del_key(TALLOC_CTX *mem_ctx, const struct hive_key *key,
+                         const char *name)
 {
        unsigned int i;
        int ret;
        struct ldb_key_data *parentkd = talloc_get_type(key, struct ldb_key_data);
-       struct ldb_dn *ldap_path;
-       TALLOC_CTX *mem_ctx = talloc_init("ldb_del_key");
+       struct ldb_dn *ldb_path;
        struct ldb_context *c = parentkd->ldb;
        struct ldb_result *res_keys;
        struct ldb_result *res_vals;
@@ -635,35 +711,29 @@ static WERROR ldb_del_key(const struct hive_key *key, const char *name)
        /* Verify key exists by opening it */
        werr = ldb_open_key(mem_ctx, key, name, &hk);
        if (!W_ERROR_IS_OK(werr)) {
-               talloc_free(mem_ctx);
                return werr;
        }
 
-       ldap_path = reg_path_to_ldb(mem_ctx, key, name, NULL);
-       if (!ldap_path) {
-               talloc_free(mem_ctx);
-               return WERR_FOOBAR;
-       }
+       ldb_path = reg_path_to_ldb(mem_ctx, key, name, NULL);
+       W_ERROR_HAVE_NO_MEMORY(ldb_path);
 
        /* Search for subkeys */
-       ret = ldb_search(c, mem_ctx, &res_keys, ldap_path, LDB_SCOPE_ONELEVEL,
+       ret = ldb_search(c, mem_ctx, &res_keys, ldb_path, LDB_SCOPE_ONELEVEL,
                         NULL, "(key=*)");
 
        if (ret != LDB_SUCCESS) {
                DEBUG(0, ("Error getting subkeys for '%s': %s\n",
-                     ldb_dn_get_linearized(ldap_path), ldb_errstring(c)));
-               talloc_free(mem_ctx);
+                     ldb_dn_get_linearized(ldb_path), ldb_errstring(c)));
                return WERR_FOOBAR;
        }
 
        /* Search for values */
-       ret = ldb_search(c, mem_ctx, &res_vals, ldap_path, LDB_SCOPE_ONELEVEL,
+       ret = ldb_search(c, mem_ctx, &res_vals, ldb_path, LDB_SCOPE_ONELEVEL,
                         NULL, "(value=*)");
 
        if (ret != LDB_SUCCESS) {
                DEBUG(0, ("Error getting values for '%s': %s\n",
-                     ldb_dn_get_linearized(ldap_path), ldb_errstring(c)));
-               talloc_free(mem_ctx);
+                     ldb_dn_get_linearized(ldb_path), ldb_errstring(c)));
                return WERR_FOOBAR;
        }
 
@@ -672,7 +742,6 @@ static WERROR ldb_del_key(const struct hive_key *key, const char *name)
 
        if (ret != LDB_SUCCESS) {
                DEBUG(0, ("ldb_transaction_start: %s\n", ldb_errstring(c)));
-               talloc_free(mem_ctx);
                return WERR_FOOBAR;
        }
 
@@ -681,12 +750,12 @@ static WERROR ldb_del_key(const struct hive_key *key, const char *name)
                /* Delete any subkeys */
                for (i = 0; i < res_keys->count; i++)
                {
-                       werr = ldb_del_key(hk, ldb_msg_find_attr_as_string(
+                       werr = ldb_del_key(mem_ctx, hk,
+                                          ldb_msg_find_attr_as_string(
                                                        res_keys->msgs[i],
                                                        "key", NULL));
                        if (!W_ERROR_IS_OK(werr)) {
                                ret = ldb_transaction_cancel(c);
-                               talloc_free(mem_ctx);
                                return werr;
                        }
                }
@@ -694,25 +763,26 @@ static WERROR ldb_del_key(const struct hive_key *key, const char *name)
                /* Delete any values */
                for (i = 0; i < res_vals->count; i++)
                {
-                       werr = ldb_del_value(hk, ldb_msg_find_attr_as_string(
+                       werr = ldb_del_value(mem_ctx, hk,
+                                            ldb_msg_find_attr_as_string(
                                                        res_vals->msgs[i],
                                                        "value", NULL));
                        if (!W_ERROR_IS_OK(werr)) {
                                ret = ldb_transaction_cancel(c);
-                               talloc_free(mem_ctx);
                                return werr;
                        }
                }
        }
+       talloc_free(res_keys);
+       talloc_free(res_vals);
 
        /* Delete the key itself */
-       ret = ldb_delete(c, ldap_path);
+       ret = ldb_delete(c, ldb_path);
 
        if (ret != LDB_SUCCESS)
        {
                DEBUG(1, ("ldb_del_key: %s\n", ldb_errstring(c)));
                ret = ldb_transaction_cancel(c);
-               talloc_free(mem_ctx);
                return WERR_FOOBAR;
        }
 
@@ -723,12 +793,9 @@ static WERROR ldb_del_key(const struct hive_key *key, const char *name)
        {
                DEBUG(0, ("ldb_transaction_commit: %s\n", ldb_errstring(c)));
                ret = ldb_transaction_cancel(c);
-               talloc_free(mem_ctx);
                return WERR_FOOBAR;
        }
 
-       talloc_free(mem_ctx);
-
        /* reset cache */
        talloc_free(parentkd->subkeys);
        parentkd->subkeys = NULL;
@@ -747,9 +814,12 @@ static WERROR ldb_set_value(struct hive_key *parent,
        TALLOC_CTX *mem_ctx = talloc_init("ldb_set_value");
 
        msg = reg_ldb_pack_value(kd->ldb, mem_ctx, name, type, data);
+       W_ERROR_HAVE_NO_MEMORY(msg);
+
        msg->dn = ldb_dn_copy(msg, kd->dn);
+       W_ERROR_HAVE_NO_MEMORY(msg->dn);
 
-       if ((name != NULL) && (name[0] != '\0')) {
+       if (name[0] != '\0') {
                /* For a default value, we add/overwrite the attributes to/of the hive.
                   For a normal value, we create a new child. */
                if (!ldb_dn_add_child_fmt(msg->dn, "value=%s",
@@ -770,7 +840,7 @@ static WERROR ldb_set_value(struct hive_key *parent,
        if (ret == LDB_ERR_NO_SUCH_OBJECT) {
                i = 0;
                while (i < msg->num_elements) {
-                       if (msg->elements[i].flags == LDB_FLAG_MOD_DELETE) {
+                       if (LDB_FLAG_MOD_TYPE(msg->elements[i].flags) == LDB_FLAG_MOD_DELETE) {
                                ldb_msg_remove_element(msg, &msg->elements[i]);
                        } else {
                                ++i;
@@ -783,6 +853,8 @@ static WERROR ldb_set_value(struct hive_key *parent,
                ret = LDB_SUCCESS;
        }
 
+       talloc_free(msg);
+
        if (ret != LDB_SUCCESS) {
                DEBUG(1, ("ldb_set_value: %s\n", ldb_errstring(kd->ldb)));
                talloc_free(mem_ctx);
@@ -808,6 +880,9 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
                               uint32_t *max_valbufsize)
 {
        struct ldb_key_data *kd = talloc_get_type(key, struct ldb_key_data);
+       uint32_t default_value_type = REG_NONE;
+       DATA_BLOB default_value = { NULL, 0 };
+       WERROR werr;
 
        /* Initialization */
        if (classname != NULL)
@@ -825,19 +900,36 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
        if (max_valbufsize != NULL)
                *max_valbufsize = 0;
 
+       /* We need this to get the default value (if it exists) for counting
+        * the values under the key and for finding out the longest value buffer
+        * size. If no default value exists the DATA_BLOB "default_value" will
+        * remain { NULL, 0 }. */
+       werr = ldb_get_default_value(mem_ctx, key, NULL, &default_value_type,
+                                    &default_value);
+       if ((!W_ERROR_IS_OK(werr)) && (!W_ERROR_EQUAL(werr, WERR_BADFILE))) {
+               return werr;
+       }
+
        if (kd->subkeys == NULL) {
                W_ERROR_NOT_OK_RETURN(cache_subkeys(kd));
        }
-
        if (kd->values == NULL) {
                W_ERROR_NOT_OK_RETURN(cache_values(kd));
        }
 
+       if (classname != NULL) {
+               *classname = kd->classname;
+       }
+
        if (num_subkeys != NULL) {
                *num_subkeys = kd->subkey_count;
        }
        if (num_values != NULL) {
                *num_values = kd->value_count;
+               /* also consider the default value if it exists */
+               if (default_value.data != NULL) {
+                       ++(*num_values);
+               }
        }
 
 
@@ -845,8 +937,6 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
                unsigned int i;
                struct ldb_message_element *el;
 
-               *max_subkeynamelen = 0;
-
                for (i = 0; i < kd->subkey_count; i++) {
                        el = ldb_msg_find_element(kd->subkeys[i], "key");
                        *max_subkeynamelen = MAX(*max_subkeynamelen, el->values[0].length);
@@ -858,11 +948,11 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
                struct ldb_message_element *el;
                W_ERROR_NOT_OK_RETURN(cache_values(kd));
 
-               if (max_valbufsize != NULL)
-                       *max_valbufsize = 0;
-
-               if (max_valnamelen != NULL)
-                       *max_valnamelen = 0;
+               /* also consider the default value if it exists */
+               if ((max_valbufsize != NULL) && (default_value.data != NULL)) {
+                               *max_valbufsize = MAX(*max_valbufsize,
+                                                     default_value.length);
+               }
 
                for (i = 0; i < kd->value_count; i++) {
                        if (max_valnamelen != NULL) {
@@ -882,6 +972,8 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
                }
        }
 
+       talloc_free(default_value.data);
+
        return WERR_OK;
 }