r22673: Fix for Jerry's reversion. We still need to check size

before talloc.
Jeremy.

diff --git a/source/rpc_parse/parse_samr.c b/source/rpc_parse/parse_samr.c
index 296296ac5a37a3986e8aa55f4c81f81d0bd1c397..529ad319bb806b29dd4c833209a7ca62f56d93ca 100644 (file)
--- a/source/rpc_parse/parse_samr.c
+++ b/source/rpc_parse/parse_samr.c
@@ -4838,9 +4838,14 @@ BOOL samr_io_r_query_aliasmem(const char *desc, SAMR_R_QUERY_ALIASMEM * r_u,
                if(!prs_uint32("num_sids1", ps, depth, &r_u->num_sids1))
                        return False;
 
-               ptr_sid = TALLOC_ARRAY(ps->mem_ctx, uint32, r_u->num_sids1);
-               if (!ptr_sid) {
-                       return False;
+               /* We must always use talloc here even when marshalling. */
+               if (r_u->num_sids1) {
+                       ptr_sid = TALLOC_ARRAY(ps->mem_ctx, uint32, r_u->num_sids1);
+                       if (!ptr_sid) {
+                               return False;
+                       }
+               } else {
+                       ptr_sid = NULL;
                }
                
                for (i = 0; i < r_u->num_sids1; i++) {
@@ -4850,7 +4855,14 @@ BOOL samr_io_r_query_aliasmem(const char *desc, SAMR_R_QUERY_ALIASMEM * r_u,
                }
                
                if (UNMARSHALLING(ps)) {
-                       r_u->sid = TALLOC_ARRAY(ps->mem_ctx, DOM_SID2, r_u->num_sids1);
+                       if (r_u->num_sids1) {
+                               r_u->sid = TALLOC_ARRAY(ps->mem_ctx, DOM_SID2, r_u->num_sids1);
+                               if (!r_u->sid) {
+                                       return False;
+                               }
+                       } else {
+                               r_u->sid = NULL;
+                       }
                }
                
                for (i = 0; i < r_u->num_sids1; i++) {