[Pkg-samba-maint] r4187 - branches/samba/squeeze/debian/patches
bubulle at alioth.debian.org
bubulle at alioth.debian.org
Thu Jan 31 09:39:26 UTC 2013
Author: bubulle
Date: 2013-01-31 09:39:25 +0000 (Thu, 31 Jan 2013)
New Revision: 4187
Added:
branches/samba/squeeze/debian/patches/debian-changes-2:3.5.6~dfsg-3squeeze8
Modified:
branches/samba/squeeze/debian/patches/series
Log:
Add "upstream changes" patch that was included in the -3squeeze8 upload
Added: branches/samba/squeeze/debian/patches/debian-changes-2:3.5.6~dfsg-3squeeze8
===================================================================
--- branches/samba/squeeze/debian/patches/debian-changes-2:3.5.6~dfsg-3squeeze8 (rev 0)
+++ branches/samba/squeeze/debian/patches/debian-changes-2:3.5.6~dfsg-3squeeze8 2013-01-31 09:39:25 UTC (rev 4187)
@@ -0,0 +1,16195 @@
+Description: Upstream changes introduced in version 2:3.5.6~dfsg-3squeeze8
+ This patch has been created by dpkg-source during the package build.
+ Here's the last changelog entry, hopefully it gives details on why
+ those changes were made:
+ .
+ samba (2:3.5.6~dfsg-3squeeze8) stable-security; urgency=high
+ .
+ * Security update, fixing CVE-2012-2111: security=ads allows users to
+ grant themselves additional privileges on the server.
+ .
+ The person named in the Author field signed this changelog entry.
+Author: Steve Langasek <vorlon at debian.org>
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: http://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: <YYYY-MM-DD>
+
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_krb5pac.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_krb5pac.c
+@@ -22,11 +22,13 @@ static enum ndr_err_code ndr_push_PAC_LO
+
+ static enum ndr_err_code ndr_pull_PAC_LOGON_NAME(struct ndr_pull *ndr, int ndr_flags, struct PAC_LOGON_NAME *r)
+ {
++ uint32_t size_account_name_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_NTTIME(ndr, NDR_SCALARS, &r->logon_time));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->size));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->account_name, r->size, sizeof(uint8_t), CH_UTF16));
++ size_account_name_0 = r->size;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->account_name, size_account_name_0, sizeof(uint8_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -469,25 +471,28 @@ _PUBLIC_ enum ndr_err_code ndr_push_PAC_
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_PAC_DATA(struct ndr_pull *ndr, int ndr_flags, struct PAC_DATA *r)
+ {
++ uint32_t size_buffers_0 = 0;
+ uint32_t cntr_buffers_0;
+ TALLOC_CTX *_mem_save_buffers_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_buffers));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->version));
+- NDR_PULL_ALLOC_N(ndr, r->buffers, r->num_buffers);
++ size_buffers_0 = r->num_buffers;
++ NDR_PULL_ALLOC_N(ndr, r->buffers, size_buffers_0);
+ _mem_save_buffers_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->buffers, 0);
+- for (cntr_buffers_0 = 0; cntr_buffers_0 < r->num_buffers; cntr_buffers_0++) {
++ for (cntr_buffers_0 = 0; cntr_buffers_0 < size_buffers_0; cntr_buffers_0++) {
+ NDR_CHECK(ndr_pull_PAC_BUFFER(ndr, NDR_SCALARS, &r->buffers[cntr_buffers_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffers_0, 0);
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_buffers_0 = r->num_buffers;
+ _mem_save_buffers_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->buffers, 0);
+- for (cntr_buffers_0 = 0; cntr_buffers_0 < r->num_buffers; cntr_buffers_0++) {
++ for (cntr_buffers_0 = 0; cntr_buffers_0 < size_buffers_0; cntr_buffers_0++) {
+ NDR_CHECK(ndr_pull_PAC_BUFFER(ndr, NDR_BUFFERS, &r->buffers[cntr_buffers_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffers_0, 0);
+@@ -636,25 +641,28 @@ _PUBLIC_ enum ndr_err_code ndr_push_PAC_
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_PAC_DATA_RAW(struct ndr_pull *ndr, int ndr_flags, struct PAC_DATA_RAW *r)
+ {
++ uint32_t size_buffers_0 = 0;
+ uint32_t cntr_buffers_0;
+ TALLOC_CTX *_mem_save_buffers_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_buffers));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->version));
+- NDR_PULL_ALLOC_N(ndr, r->buffers, r->num_buffers);
++ size_buffers_0 = r->num_buffers;
++ NDR_PULL_ALLOC_N(ndr, r->buffers, size_buffers_0);
+ _mem_save_buffers_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->buffers, 0);
+- for (cntr_buffers_0 = 0; cntr_buffers_0 < r->num_buffers; cntr_buffers_0++) {
++ for (cntr_buffers_0 = 0; cntr_buffers_0 < size_buffers_0; cntr_buffers_0++) {
+ NDR_CHECK(ndr_pull_PAC_BUFFER_RAW(ndr, NDR_SCALARS, &r->buffers[cntr_buffers_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffers_0, 0);
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_buffers_0 = r->num_buffers;
+ _mem_save_buffers_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->buffers, 0);
+- for (cntr_buffers_0 = 0; cntr_buffers_0 < r->num_buffers; cntr_buffers_0++) {
++ for (cntr_buffers_0 = 0; cntr_buffers_0 < size_buffers_0; cntr_buffers_0++) {
+ NDR_CHECK(ndr_pull_PAC_BUFFER_RAW(ndr, NDR_BUFFERS, &r->buffers[cntr_buffers_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffers_0, 0);
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_echo.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_echo.c
+@@ -616,16 +616,18 @@ static enum ndr_err_code ndr_push_echo_S
+
+ static enum ndr_err_code ndr_pull_echo_Surrounding(struct ndr_pull *ndr, int ndr_flags, struct echo_Surrounding *r)
+ {
++ uint32_t size_surrounding_0 = 0;
+ uint32_t cntr_surrounding_0;
+ TALLOC_CTX *_mem_save_surrounding_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->surrounding));
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->x));
+- NDR_PULL_ALLOC_N(ndr, r->surrounding, ndr_get_array_size(ndr, &r->surrounding));
++ size_surrounding_0 = ndr_get_array_size(ndr, &r->surrounding);
++ NDR_PULL_ALLOC_N(ndr, r->surrounding, size_surrounding_0);
+ _mem_save_surrounding_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->surrounding, 0);
+- for (cntr_surrounding_0 = 0; cntr_surrounding_0 < r->x; cntr_surrounding_0++) {
++ for (cntr_surrounding_0 = 0; cntr_surrounding_0 < size_surrounding_0; cntr_surrounding_0++) {
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->surrounding[cntr_surrounding_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_surrounding_0, 0);
+@@ -735,21 +737,25 @@ static enum ndr_err_code ndr_push_echo_E
+
+ static enum ndr_err_code ndr_pull_echo_EchoData(struct ndr_pull *ndr, int flags, struct echo_EchoData *r)
+ {
++ uint32_t size_in_data_0 = 0;
++ uint32_t size_out_data_0 = 0;
+ if (flags & NDR_IN) {
+ ZERO_STRUCT(r->out);
+
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.len));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.in_data));
+- NDR_PULL_ALLOC_N(ndr, r->in.in_data, ndr_get_array_size(ndr, &r->in.in_data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.in_data, ndr_get_array_size(ndr, &r->in.in_data)));
++ size_in_data_0 = ndr_get_array_size(ndr, &r->in.in_data);
++ NDR_PULL_ALLOC_N(ndr, r->in.in_data, size_in_data_0);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.in_data, size_in_data_0));
+ if (r->in.in_data) {
+ NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->in.in_data, r->in.len));
+ }
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.out_data));
+- NDR_PULL_ALLOC_N(ndr, r->out.out_data, ndr_get_array_size(ndr, &r->out.out_data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.out_data, ndr_get_array_size(ndr, &r->out.out_data)));
++ size_out_data_0 = ndr_get_array_size(ndr, &r->out.out_data);
++ NDR_PULL_ALLOC_N(ndr, r->out.out_data, size_out_data_0);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.out_data, size_out_data_0));
+ if (r->out.out_data) {
+ NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->out.out_data, r->in.len));
+ }
+@@ -794,11 +800,13 @@ static enum ndr_err_code ndr_push_echo_S
+
+ static enum ndr_err_code ndr_pull_echo_SinkData(struct ndr_pull *ndr, int flags, struct echo_SinkData *r)
+ {
++ uint32_t size_data_0 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.len));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.data));
+- NDR_PULL_ALLOC_N(ndr, r->in.data, ndr_get_array_size(ndr, &r->in.data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.data, ndr_get_array_size(ndr, &r->in.data)));
++ size_data_0 = ndr_get_array_size(ndr, &r->in.data);
++ NDR_PULL_ALLOC_N(ndr, r->in.data, size_data_0);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.data, size_data_0));
+ if (r->in.data) {
+ NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->in.data, r->in.len));
+ }
+@@ -844,6 +852,7 @@ static enum ndr_err_code ndr_push_echo_S
+
+ static enum ndr_err_code ndr_pull_echo_SourceData(struct ndr_pull *ndr, int flags, struct echo_SourceData *r)
+ {
++ uint32_t size_data_0 = 0;
+ if (flags & NDR_IN) {
+ ZERO_STRUCT(r->out);
+
+@@ -851,8 +860,9 @@ static enum ndr_err_code ndr_pull_echo_S
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.data));
+- NDR_PULL_ALLOC_N(ndr, r->out.data, ndr_get_array_size(ndr, &r->out.data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.data, ndr_get_array_size(ndr, &r->out.data)));
++ size_data_0 = ndr_get_array_size(ndr, &r->out.data);
++ NDR_PULL_ALLOC_N(ndr, r->out.data, size_data_0);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.data, size_data_0));
+ if (r->out.data) {
+ NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->out.data, r->in.len));
+ }
+@@ -910,7 +920,11 @@ static enum ndr_err_code ndr_push_echo_T
+
+ static enum ndr_err_code ndr_pull_echo_TestCall(struct ndr_pull *ndr, int flags, struct echo_TestCall *r)
+ {
++ uint32_t size_s1_1 = 0;
++ uint32_t length_s1_1 = 0;
+ uint32_t _ptr_s2;
++ uint32_t size_s2_2 = 0;
++ uint32_t length_s2_2 = 0;
+ TALLOC_CTX *_mem_save_s2_0;
+ TALLOC_CTX *_mem_save_s2_1;
+ if (flags & NDR_IN) {
+@@ -918,11 +932,13 @@ static enum ndr_err_code ndr_pull_echo_T
+
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.s1));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.s1));
+- if (ndr_get_array_length(ndr, &r->in.s1) > ndr_get_array_size(ndr, &r->in.s1)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.s1), ndr_get_array_length(ndr, &r->in.s1));
++ size_s1_1 = ndr_get_array_size(ndr, &r->in.s1);
++ length_s1_1 = ndr_get_array_length(ndr, &r->in.s1);
++ if (length_s1_1 > size_s1_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_s1_1, length_s1_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.s1), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.s1, ndr_get_array_length(ndr, &r->in.s1), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_s1_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.s1, length_s1_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_ALLOC(ndr, r->out.s2);
+ ZERO_STRUCTP(r->out.s2);
+ }
+@@ -943,11 +959,13 @@ static enum ndr_err_code ndr_pull_echo_T
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.s2, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->out.s2));
+ NDR_CHECK(ndr_pull_array_length(ndr, r->out.s2));
+- if (ndr_get_array_length(ndr, r->out.s2) > ndr_get_array_size(ndr, r->out.s2)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, r->out.s2), ndr_get_array_length(ndr, r->out.s2));
++ size_s2_2 = ndr_get_array_size(ndr, r->out.s2);
++ length_s2_2 = ndr_get_array_length(ndr, r->out.s2);
++ if (length_s2_2 > size_s2_2) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_s2_2, length_s2_2);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, r->out.s2), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.s2, ndr_get_array_length(ndr, r->out.s2), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_s2_2, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.s2, length_s2_2, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s2_1, 0);
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s2_0, LIBNDR_FLAG_REF_ALLOC);
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_dcerpc.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_dcerpc.c
+@@ -24,6 +24,7 @@ static enum ndr_err_code ndr_push_dcerpc
+
+ static enum ndr_err_code ndr_pull_dcerpc_ctx_list(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_ctx_list *r)
+ {
++ uint32_t size_transfer_syntaxes_0 = 0;
+ uint32_t cntr_transfer_syntaxes_0;
+ TALLOC_CTX *_mem_save_transfer_syntaxes_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -31,10 +32,11 @@ static enum ndr_err_code ndr_pull_dcerpc
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->context_id));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->num_transfer_syntaxes));
+ NDR_CHECK(ndr_pull_ndr_syntax_id(ndr, NDR_SCALARS, &r->abstract_syntax));
+- NDR_PULL_ALLOC_N(ndr, r->transfer_syntaxes, r->num_transfer_syntaxes);
++ size_transfer_syntaxes_0 = r->num_transfer_syntaxes;
++ NDR_PULL_ALLOC_N(ndr, r->transfer_syntaxes, size_transfer_syntaxes_0);
+ _mem_save_transfer_syntaxes_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->transfer_syntaxes, 0);
+- for (cntr_transfer_syntaxes_0 = 0; cntr_transfer_syntaxes_0 < r->num_transfer_syntaxes; cntr_transfer_syntaxes_0++) {
++ for (cntr_transfer_syntaxes_0 = 0; cntr_transfer_syntaxes_0 < size_transfer_syntaxes_0; cntr_transfer_syntaxes_0++) {
+ NDR_CHECK(ndr_pull_ndr_syntax_id(ndr, NDR_SCALARS, &r->transfer_syntaxes[cntr_transfer_syntaxes_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_transfer_syntaxes_0, 0);
+@@ -99,6 +101,7 @@ static enum ndr_err_code ndr_push_dcerpc
+
+ static enum ndr_err_code ndr_pull_dcerpc_bind(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_bind *r)
+ {
++ uint32_t size_ctx_list_0 = 0;
+ uint32_t cntr_ctx_list_0;
+ TALLOC_CTX *_mem_save_ctx_list_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -107,10 +110,11 @@ static enum ndr_err_code ndr_pull_dcerpc
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->max_recv_frag));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->assoc_group_id));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->num_contexts));
+- NDR_PULL_ALLOC_N(ndr, r->ctx_list, r->num_contexts);
++ size_ctx_list_0 = r->num_contexts;
++ NDR_PULL_ALLOC_N(ndr, r->ctx_list, size_ctx_list_0);
+ _mem_save_ctx_list_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->ctx_list, 0);
+- for (cntr_ctx_list_0 = 0; cntr_ctx_list_0 < r->num_contexts; cntr_ctx_list_0++) {
++ for (cntr_ctx_list_0 = 0; cntr_ctx_list_0 < size_ctx_list_0; cntr_ctx_list_0++) {
+ NDR_CHECK(ndr_pull_dcerpc_ctx_list(ndr, NDR_SCALARS, &r->ctx_list[cntr_ctx_list_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ctx_list_0, 0);
+@@ -406,6 +410,8 @@ static enum ndr_err_code ndr_push_dcerpc
+
+ static enum ndr_err_code ndr_pull_dcerpc_bind_ack(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_bind_ack *r)
+ {
++ uint32_t size_secondary_address_0 = 0;
++ uint32_t size_ctx_list_0 = 0;
+ uint32_t cntr_ctx_list_0;
+ TALLOC_CTX *_mem_save_ctx_list_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -414,7 +420,8 @@ static enum ndr_err_code ndr_pull_dcerpc
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->max_recv_frag));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->assoc_group_id));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->secondary_address_size));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->secondary_address, r->secondary_address_size, sizeof(uint8_t), CH_DOS));
++ size_secondary_address_0 = r->secondary_address_size;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->secondary_address, size_secondary_address_0, sizeof(uint8_t), CH_DOS));
+ {
+ uint32_t _flags_save_DATA_BLOB = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_FLAG_ALIGN4);
+@@ -422,10 +429,11 @@ static enum ndr_err_code ndr_pull_dcerpc
+ ndr->flags = _flags_save_DATA_BLOB;
+ }
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->num_results));
+- NDR_PULL_ALLOC_N(ndr, r->ctx_list, r->num_results);
++ size_ctx_list_0 = r->num_results;
++ NDR_PULL_ALLOC_N(ndr, r->ctx_list, size_ctx_list_0);
+ _mem_save_ctx_list_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->ctx_list, 0);
+- for (cntr_ctx_list_0 = 0; cntr_ctx_list_0 < r->num_results; cntr_ctx_list_0++) {
++ for (cntr_ctx_list_0 = 0; cntr_ctx_list_0 < size_ctx_list_0; cntr_ctx_list_0++) {
+ NDR_CHECK(ndr_pull_dcerpc_ack_ctx(ndr, NDR_SCALARS, &r->ctx_list[cntr_ctx_list_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ctx_list_0, 0);
+@@ -486,15 +494,17 @@ static enum ndr_err_code ndr_push_dcerpc
+
+ static enum ndr_err_code ndr_pull_dcerpc_bind_nak_versions(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_bind_nak_versions *r)
+ {
++ uint32_t size_versions_0 = 0;
+ uint32_t cntr_versions_0;
+ TALLOC_CTX *_mem_save_versions_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_versions));
+- NDR_PULL_ALLOC_N(ndr, r->versions, r->num_versions);
++ size_versions_0 = r->num_versions;
++ NDR_PULL_ALLOC_N(ndr, r->versions, size_versions_0);
+ _mem_save_versions_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->versions, 0);
+- for (cntr_versions_0 = 0; cntr_versions_0 < r->num_versions; cntr_versions_0++) {
++ for (cntr_versions_0 = 0; cntr_versions_0 < size_versions_0; cntr_versions_0++) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->versions[cntr_versions_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_versions_0, 0);
+@@ -1107,6 +1117,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_dcer
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_dcerpc_fack(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_fack *r)
+ {
++ uint32_t size_selack_0 = 0;
+ uint32_t cntr_selack_0;
+ TALLOC_CTX *_mem_save_selack_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -1118,10 +1129,11 @@ _PUBLIC_ enum ndr_err_code ndr_pull_dcer
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->max_frag_size));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->serial_no));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->selack_size));
+- NDR_PULL_ALLOC_N(ndr, r->selack, r->selack_size);
++ size_selack_0 = r->selack_size;
++ NDR_PULL_ALLOC_N(ndr, r->selack, size_selack_0);
+ _mem_save_selack_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->selack, 0);
+- for (cntr_selack_0 = 0; cntr_selack_0 < r->selack_size; cntr_selack_0++) {
++ for (cntr_selack_0 = 0; cntr_selack_0 < size_selack_0; cntr_selack_0++) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->selack[cntr_selack_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_selack_0, 0);
+@@ -1753,13 +1765,15 @@ _PUBLIC_ enum ndr_err_code ndr_push_ncac
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_ncacn_packet(struct ndr_pull *ndr, int ndr_flags, struct ncacn_packet *r)
+ {
++ uint32_t size_drep_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->rpc_vers));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->rpc_vers_minor));
+ NDR_CHECK(ndr_pull_dcerpc_pkt_type(ndr, NDR_SCALARS, &r->ptype));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->pfc_flags));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->drep, 4));
++ size_drep_0 = 4;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->drep, size_drep_0));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->frag_length));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->auth_length));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->call_id));
+@@ -1825,13 +1839,15 @@ _PUBLIC_ enum ndr_err_code ndr_push_ncad
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_ncadg_packet(struct ndr_pull *ndr, int ndr_flags, struct ncadg_packet *r)
+ {
++ uint32_t size_drep_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->rpc_vers));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->ptype));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->pfc_flags));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->ncadg_flags));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->drep, 3));
++ size_drep_0 = 3;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->drep, size_drep_0));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->serial_high));
+ NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->object));
+ NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->iface));
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_wkssvc.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_wkssvc.c
+@@ -36,8 +36,12 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaInfo100(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetWkstaInfo100 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ uint32_t _ptr_domain_name;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ TALLOC_CTX *_mem_save_domain_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -64,11 +68,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (r->domain_name) {
+@@ -76,11 +82,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain_name));
+- if (ndr_get_array_length(ndr, &r->domain_name) > ndr_get_array_size(ndr, &r->domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain_name), ndr_get_array_length(ndr, &r->domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_name_0, 0);
+ }
+ }
+@@ -147,10 +155,16 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaInfo101(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetWkstaInfo101 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ uint32_t _ptr_domain_name;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ TALLOC_CTX *_mem_save_domain_name_0;
+ uint32_t _ptr_lan_root;
++ uint32_t size_lan_root_1 = 0;
++ uint32_t length_lan_root_1 = 0;
+ TALLOC_CTX *_mem_save_lan_root_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -183,11 +197,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (r->domain_name) {
+@@ -195,11 +211,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain_name));
+- if (ndr_get_array_length(ndr, &r->domain_name) > ndr_get_array_size(ndr, &r->domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain_name), ndr_get_array_length(ndr, &r->domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_name_0, 0);
+ }
+ if (r->lan_root) {
+@@ -207,11 +225,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->lan_root, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->lan_root));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->lan_root));
+- if (ndr_get_array_length(ndr, &r->lan_root) > ndr_get_array_size(ndr, &r->lan_root)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->lan_root), ndr_get_array_length(ndr, &r->lan_root));
++ size_lan_root_1 = ndr_get_array_size(ndr, &r->lan_root);
++ length_lan_root_1 = ndr_get_array_length(ndr, &r->lan_root);
++ if (length_lan_root_1 > size_lan_root_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_lan_root_1, length_lan_root_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->lan_root), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->lan_root, ndr_get_array_length(ndr, &r->lan_root), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_lan_root_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->lan_root, length_lan_root_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_lan_root_0, 0);
+ }
+ }
+@@ -285,10 +305,16 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaInfo102(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetWkstaInfo102 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ uint32_t _ptr_domain_name;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ TALLOC_CTX *_mem_save_domain_name_0;
+ uint32_t _ptr_lan_root;
++ uint32_t size_lan_root_1 = 0;
++ uint32_t length_lan_root_1 = 0;
+ TALLOC_CTX *_mem_save_lan_root_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -322,11 +348,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (r->domain_name) {
+@@ -334,11 +362,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain_name));
+- if (ndr_get_array_length(ndr, &r->domain_name) > ndr_get_array_size(ndr, &r->domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain_name), ndr_get_array_length(ndr, &r->domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_name_0, 0);
+ }
+ if (r->lan_root) {
+@@ -346,11 +376,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->lan_root, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->lan_root));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->lan_root));
+- if (ndr_get_array_length(ndr, &r->lan_root) > ndr_get_array_size(ndr, &r->lan_root)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->lan_root), ndr_get_array_length(ndr, &r->lan_root));
++ size_lan_root_1 = ndr_get_array_size(ndr, &r->lan_root);
++ length_lan_root_1 = ndr_get_array_length(ndr, &r->lan_root);
++ if (length_lan_root_1 > size_lan_root_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_lan_root_1, length_lan_root_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->lan_root), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->lan_root, ndr_get_array_length(ndr, &r->lan_root), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_lan_root_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->lan_root, length_lan_root_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_lan_root_0, 0);
+ }
+ }
+@@ -1932,41 +1964,77 @@ static enum ndr_err_code ndr_pull_wkssvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info100_0;
++ uint32_t _ptr_info100;
+ TALLOC_CTX *_mem_save_info101_0;
++ uint32_t _ptr_info101;
+ TALLOC_CTX *_mem_save_info102_0;
++ uint32_t _ptr_info102;
+ TALLOC_CTX *_mem_save_info502_0;
++ uint32_t _ptr_info502;
+ TALLOC_CTX *_mem_save_info1010_0;
++ uint32_t _ptr_info1010;
+ TALLOC_CTX *_mem_save_info1011_0;
++ uint32_t _ptr_info1011;
+ TALLOC_CTX *_mem_save_info1012_0;
++ uint32_t _ptr_info1012;
+ TALLOC_CTX *_mem_save_info1013_0;
++ uint32_t _ptr_info1013;
+ TALLOC_CTX *_mem_save_info1018_0;
++ uint32_t _ptr_info1018;
+ TALLOC_CTX *_mem_save_info1023_0;
++ uint32_t _ptr_info1023;
+ TALLOC_CTX *_mem_save_info1027_0;
++ uint32_t _ptr_info1027;
+ TALLOC_CTX *_mem_save_info1028_0;
++ uint32_t _ptr_info1028;
+ TALLOC_CTX *_mem_save_info1032_0;
++ uint32_t _ptr_info1032;
+ TALLOC_CTX *_mem_save_info1033_0;
++ uint32_t _ptr_info1033;
+ TALLOC_CTX *_mem_save_info1041_0;
++ uint32_t _ptr_info1041;
+ TALLOC_CTX *_mem_save_info1042_0;
++ uint32_t _ptr_info1042;
+ TALLOC_CTX *_mem_save_info1043_0;
++ uint32_t _ptr_info1043;
+ TALLOC_CTX *_mem_save_info1044_0;
++ uint32_t _ptr_info1044;
+ TALLOC_CTX *_mem_save_info1045_0;
++ uint32_t _ptr_info1045;
+ TALLOC_CTX *_mem_save_info1046_0;
++ uint32_t _ptr_info1046;
+ TALLOC_CTX *_mem_save_info1047_0;
++ uint32_t _ptr_info1047;
+ TALLOC_CTX *_mem_save_info1048_0;
++ uint32_t _ptr_info1048;
+ TALLOC_CTX *_mem_save_info1049_0;
++ uint32_t _ptr_info1049;
+ TALLOC_CTX *_mem_save_info1050_0;
++ uint32_t _ptr_info1050;
+ TALLOC_CTX *_mem_save_info1051_0;
++ uint32_t _ptr_info1051;
+ TALLOC_CTX *_mem_save_info1052_0;
++ uint32_t _ptr_info1052;
+ TALLOC_CTX *_mem_save_info1053_0;
++ uint32_t _ptr_info1053;
+ TALLOC_CTX *_mem_save_info1054_0;
++ uint32_t _ptr_info1054;
+ TALLOC_CTX *_mem_save_info1055_0;
++ uint32_t _ptr_info1055;
+ TALLOC_CTX *_mem_save_info1056_0;
++ uint32_t _ptr_info1056;
+ TALLOC_CTX *_mem_save_info1057_0;
++ uint32_t _ptr_info1057;
+ TALLOC_CTX *_mem_save_info1058_0;
++ uint32_t _ptr_info1058;
+ TALLOC_CTX *_mem_save_info1059_0;
++ uint32_t _ptr_info1059;
+ TALLOC_CTX *_mem_save_info1060_0;
++ uint32_t _ptr_info1060;
+ TALLOC_CTX *_mem_save_info1061_0;
++ uint32_t _ptr_info1061;
+ TALLOC_CTX *_mem_save_info1062_0;
++ uint32_t _ptr_info1062;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -1976,7 +2044,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 100: {
+- uint32_t _ptr_info100;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info100));
+ if (_ptr_info100) {
+ NDR_PULL_ALLOC(ndr, r->info100);
+@@ -1986,7 +2053,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 101: {
+- uint32_t _ptr_info101;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info101));
+ if (_ptr_info101) {
+ NDR_PULL_ALLOC(ndr, r->info101);
+@@ -1996,7 +2062,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 102: {
+- uint32_t _ptr_info102;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info102));
+ if (_ptr_info102) {
+ NDR_PULL_ALLOC(ndr, r->info102);
+@@ -2006,7 +2071,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 502: {
+- uint32_t _ptr_info502;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info502));
+ if (_ptr_info502) {
+ NDR_PULL_ALLOC(ndr, r->info502);
+@@ -2016,7 +2080,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1010: {
+- uint32_t _ptr_info1010;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1010));
+ if (_ptr_info1010) {
+ NDR_PULL_ALLOC(ndr, r->info1010);
+@@ -2026,7 +2089,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1011: {
+- uint32_t _ptr_info1011;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1011));
+ if (_ptr_info1011) {
+ NDR_PULL_ALLOC(ndr, r->info1011);
+@@ -2036,7 +2098,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1012: {
+- uint32_t _ptr_info1012;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1012));
+ if (_ptr_info1012) {
+ NDR_PULL_ALLOC(ndr, r->info1012);
+@@ -2046,7 +2107,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1013: {
+- uint32_t _ptr_info1013;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1013));
+ if (_ptr_info1013) {
+ NDR_PULL_ALLOC(ndr, r->info1013);
+@@ -2056,7 +2116,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1018: {
+- uint32_t _ptr_info1018;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1018));
+ if (_ptr_info1018) {
+ NDR_PULL_ALLOC(ndr, r->info1018);
+@@ -2066,7 +2125,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1023: {
+- uint32_t _ptr_info1023;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1023));
+ if (_ptr_info1023) {
+ NDR_PULL_ALLOC(ndr, r->info1023);
+@@ -2076,7 +2134,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1027: {
+- uint32_t _ptr_info1027;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1027));
+ if (_ptr_info1027) {
+ NDR_PULL_ALLOC(ndr, r->info1027);
+@@ -2086,7 +2143,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1028: {
+- uint32_t _ptr_info1028;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1028));
+ if (_ptr_info1028) {
+ NDR_PULL_ALLOC(ndr, r->info1028);
+@@ -2096,7 +2152,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1032: {
+- uint32_t _ptr_info1032;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1032));
+ if (_ptr_info1032) {
+ NDR_PULL_ALLOC(ndr, r->info1032);
+@@ -2106,7 +2161,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1033: {
+- uint32_t _ptr_info1033;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1033));
+ if (_ptr_info1033) {
+ NDR_PULL_ALLOC(ndr, r->info1033);
+@@ -2116,7 +2170,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1041: {
+- uint32_t _ptr_info1041;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1041));
+ if (_ptr_info1041) {
+ NDR_PULL_ALLOC(ndr, r->info1041);
+@@ -2126,7 +2179,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1042: {
+- uint32_t _ptr_info1042;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1042));
+ if (_ptr_info1042) {
+ NDR_PULL_ALLOC(ndr, r->info1042);
+@@ -2136,7 +2188,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1043: {
+- uint32_t _ptr_info1043;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1043));
+ if (_ptr_info1043) {
+ NDR_PULL_ALLOC(ndr, r->info1043);
+@@ -2146,7 +2197,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1044: {
+- uint32_t _ptr_info1044;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1044));
+ if (_ptr_info1044) {
+ NDR_PULL_ALLOC(ndr, r->info1044);
+@@ -2156,7 +2206,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1045: {
+- uint32_t _ptr_info1045;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1045));
+ if (_ptr_info1045) {
+ NDR_PULL_ALLOC(ndr, r->info1045);
+@@ -2166,7 +2215,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1046: {
+- uint32_t _ptr_info1046;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1046));
+ if (_ptr_info1046) {
+ NDR_PULL_ALLOC(ndr, r->info1046);
+@@ -2176,7 +2224,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1047: {
+- uint32_t _ptr_info1047;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1047));
+ if (_ptr_info1047) {
+ NDR_PULL_ALLOC(ndr, r->info1047);
+@@ -2186,7 +2233,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1048: {
+- uint32_t _ptr_info1048;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1048));
+ if (_ptr_info1048) {
+ NDR_PULL_ALLOC(ndr, r->info1048);
+@@ -2196,7 +2242,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1049: {
+- uint32_t _ptr_info1049;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1049));
+ if (_ptr_info1049) {
+ NDR_PULL_ALLOC(ndr, r->info1049);
+@@ -2206,7 +2251,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1050: {
+- uint32_t _ptr_info1050;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1050));
+ if (_ptr_info1050) {
+ NDR_PULL_ALLOC(ndr, r->info1050);
+@@ -2216,7 +2260,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1051: {
+- uint32_t _ptr_info1051;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1051));
+ if (_ptr_info1051) {
+ NDR_PULL_ALLOC(ndr, r->info1051);
+@@ -2226,7 +2269,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1052: {
+- uint32_t _ptr_info1052;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1052));
+ if (_ptr_info1052) {
+ NDR_PULL_ALLOC(ndr, r->info1052);
+@@ -2236,7 +2278,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1053: {
+- uint32_t _ptr_info1053;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1053));
+ if (_ptr_info1053) {
+ NDR_PULL_ALLOC(ndr, r->info1053);
+@@ -2246,7 +2287,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1054: {
+- uint32_t _ptr_info1054;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1054));
+ if (_ptr_info1054) {
+ NDR_PULL_ALLOC(ndr, r->info1054);
+@@ -2256,7 +2296,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1055: {
+- uint32_t _ptr_info1055;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1055));
+ if (_ptr_info1055) {
+ NDR_PULL_ALLOC(ndr, r->info1055);
+@@ -2266,7 +2305,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1056: {
+- uint32_t _ptr_info1056;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1056));
+ if (_ptr_info1056) {
+ NDR_PULL_ALLOC(ndr, r->info1056);
+@@ -2276,7 +2314,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1057: {
+- uint32_t _ptr_info1057;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1057));
+ if (_ptr_info1057) {
+ NDR_PULL_ALLOC(ndr, r->info1057);
+@@ -2286,7 +2323,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1058: {
+- uint32_t _ptr_info1058;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1058));
+ if (_ptr_info1058) {
+ NDR_PULL_ALLOC(ndr, r->info1058);
+@@ -2296,7 +2332,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1059: {
+- uint32_t _ptr_info1059;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1059));
+ if (_ptr_info1059) {
+ NDR_PULL_ALLOC(ndr, r->info1059);
+@@ -2306,7 +2341,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1060: {
+- uint32_t _ptr_info1060;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1060));
+ if (_ptr_info1060) {
+ NDR_PULL_ALLOC(ndr, r->info1060);
+@@ -2316,7 +2350,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1061: {
+- uint32_t _ptr_info1061;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1061));
+ if (_ptr_info1061) {
+ NDR_PULL_ALLOC(ndr, r->info1061);
+@@ -2326,7 +2359,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1062: {
+- uint32_t _ptr_info1062;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1062));
+ if (_ptr_info1062) {
+ NDR_PULL_ALLOC(ndr, r->info1062);
+@@ -3031,6 +3063,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWkstaUserInfo0(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrWkstaUserInfo0 *r)
+ {
+ uint32_t _ptr_user_name;
++ uint32_t size_user_name_1 = 0;
++ uint32_t length_user_name_1 = 0;
+ TALLOC_CTX *_mem_save_user_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3048,11 +3082,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user_name));
+- if (ndr_get_array_length(ndr, &r->user_name) > ndr_get_array_size(ndr, &r->user_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user_name), ndr_get_array_length(ndr, &r->user_name));
++ size_user_name_1 = ndr_get_array_size(ndr, &r->user_name);
++ length_user_name_1 = ndr_get_array_length(ndr, &r->user_name);
++ if (length_user_name_1 > size_user_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_name_1, length_user_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user_name, ndr_get_array_length(ndr, &r->user_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user_name, length_user_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_name_0, 0);
+ }
+ }
+@@ -3098,6 +3134,7 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaEnumUsersCtr0(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetWkstaEnumUsersCtr0 *r)
+ {
+ uint32_t _ptr_user0;
++ uint32_t size_user0_1 = 0;
+ uint32_t cntr_user0_1;
+ TALLOC_CTX *_mem_save_user0_0;
+ TALLOC_CTX *_mem_save_user0_1;
+@@ -3117,13 +3154,14 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_user0_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->user0, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user0));
+- NDR_PULL_ALLOC_N(ndr, r->user0, ndr_get_array_size(ndr, &r->user0));
++ size_user0_1 = ndr_get_array_size(ndr, &r->user0);
++ NDR_PULL_ALLOC_N(ndr, r->user0, size_user0_1);
+ _mem_save_user0_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->user0, 0);
+- for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
++ for (cntr_user0_1 = 0; cntr_user0_1 < size_user0_1; cntr_user0_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrWkstaUserInfo0(ndr, NDR_SCALARS, &r->user0[cntr_user0_1]));
+ }
+- for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
++ for (cntr_user0_1 = 0; cntr_user0_1 < size_user0_1; cntr_user0_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrWkstaUserInfo0(ndr, NDR_BUFFERS, &r->user0[cntr_user0_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user0_1, 0);
+@@ -3202,12 +3240,20 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWkstaUserInfo1(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrWkstaUserInfo1 *r)
+ {
+ uint32_t _ptr_user_name;
++ uint32_t size_user_name_1 = 0;
++ uint32_t length_user_name_1 = 0;
+ TALLOC_CTX *_mem_save_user_name_0;
+ uint32_t _ptr_logon_domain;
++ uint32_t size_logon_domain_1 = 0;
++ uint32_t length_logon_domain_1 = 0;
+ TALLOC_CTX *_mem_save_logon_domain_0;
+ uint32_t _ptr_other_domains;
++ uint32_t size_other_domains_1 = 0;
++ uint32_t length_other_domains_1 = 0;
+ TALLOC_CTX *_mem_save_other_domains_0;
+ uint32_t _ptr_logon_server;
++ uint32_t size_logon_server_1 = 0;
++ uint32_t length_logon_server_1 = 0;
+ TALLOC_CTX *_mem_save_logon_server_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3243,11 +3289,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user_name));
+- if (ndr_get_array_length(ndr, &r->user_name) > ndr_get_array_size(ndr, &r->user_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user_name), ndr_get_array_length(ndr, &r->user_name));
++ size_user_name_1 = ndr_get_array_size(ndr, &r->user_name);
++ length_user_name_1 = ndr_get_array_length(ndr, &r->user_name);
++ if (length_user_name_1 > size_user_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_name_1, length_user_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user_name, ndr_get_array_length(ndr, &r->user_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user_name, length_user_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_name_0, 0);
+ }
+ if (r->logon_domain) {
+@@ -3255,11 +3303,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->logon_domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->logon_domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->logon_domain));
+- if (ndr_get_array_length(ndr, &r->logon_domain) > ndr_get_array_size(ndr, &r->logon_domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->logon_domain), ndr_get_array_length(ndr, &r->logon_domain));
++ size_logon_domain_1 = ndr_get_array_size(ndr, &r->logon_domain);
++ length_logon_domain_1 = ndr_get_array_length(ndr, &r->logon_domain);
++ if (length_logon_domain_1 > size_logon_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_logon_domain_1, length_logon_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->logon_domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->logon_domain, ndr_get_array_length(ndr, &r->logon_domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_logon_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->logon_domain, length_logon_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_logon_domain_0, 0);
+ }
+ if (r->other_domains) {
+@@ -3267,11 +3317,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->other_domains, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->other_domains));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->other_domains));
+- if (ndr_get_array_length(ndr, &r->other_domains) > ndr_get_array_size(ndr, &r->other_domains)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->other_domains), ndr_get_array_length(ndr, &r->other_domains));
++ size_other_domains_1 = ndr_get_array_size(ndr, &r->other_domains);
++ length_other_domains_1 = ndr_get_array_length(ndr, &r->other_domains);
++ if (length_other_domains_1 > size_other_domains_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_other_domains_1, length_other_domains_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->other_domains), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->other_domains, ndr_get_array_length(ndr, &r->other_domains), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_other_domains_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->other_domains, length_other_domains_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_other_domains_0, 0);
+ }
+ if (r->logon_server) {
+@@ -3279,11 +3331,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->logon_server, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->logon_server));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->logon_server));
+- if (ndr_get_array_length(ndr, &r->logon_server) > ndr_get_array_size(ndr, &r->logon_server)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->logon_server), ndr_get_array_length(ndr, &r->logon_server));
++ size_logon_server_1 = ndr_get_array_size(ndr, &r->logon_server);
++ length_logon_server_1 = ndr_get_array_length(ndr, &r->logon_server);
++ if (length_logon_server_1 > size_logon_server_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_logon_server_1, length_logon_server_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->logon_server), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->logon_server, ndr_get_array_length(ndr, &r->logon_server), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_logon_server_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->logon_server, length_logon_server_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_logon_server_0, 0);
+ }
+ }
+@@ -3347,6 +3401,7 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaEnumUsersCtr1(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetWkstaEnumUsersCtr1 *r)
+ {
+ uint32_t _ptr_user1;
++ uint32_t size_user1_1 = 0;
+ uint32_t cntr_user1_1;
+ TALLOC_CTX *_mem_save_user1_0;
+ TALLOC_CTX *_mem_save_user1_1;
+@@ -3366,13 +3421,14 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_user1_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->user1, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user1));
+- NDR_PULL_ALLOC_N(ndr, r->user1, ndr_get_array_size(ndr, &r->user1));
++ size_user1_1 = ndr_get_array_size(ndr, &r->user1);
++ NDR_PULL_ALLOC_N(ndr, r->user1, size_user1_1);
+ _mem_save_user1_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->user1, 0);
+- for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
++ for (cntr_user1_1 = 0; cntr_user1_1 < size_user1_1; cntr_user1_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrWkstaUserInfo1(ndr, NDR_SCALARS, &r->user1[cntr_user1_1]));
+ }
+- for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
++ for (cntr_user1_1 = 0; cntr_user1_1 < size_user1_1; cntr_user1_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrWkstaUserInfo1(ndr, NDR_BUFFERS, &r->user1[cntr_user1_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user1_1, 0);
+@@ -3455,7 +3511,9 @@ static enum ndr_err_code ndr_pull_wkssvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_user0_0;
++ uint32_t _ptr_user0;
+ TALLOC_CTX *_mem_save_user1_0;
++ uint32_t _ptr_user1;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -3465,7 +3523,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_user0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_user0));
+ if (_ptr_user0) {
+ NDR_PULL_ALLOC(ndr, r->user0);
+@@ -3475,7 +3532,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_user1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_user1));
+ if (_ptr_user1) {
+ NDR_PULL_ALLOC(ndr, r->user1);
+@@ -3605,6 +3661,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWkstaUserInfo1101(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrWkstaUserInfo1101 *r)
+ {
+ uint32_t _ptr_other_domains;
++ uint32_t size_other_domains_1 = 0;
++ uint32_t length_other_domains_1 = 0;
+ TALLOC_CTX *_mem_save_other_domains_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3622,11 +3680,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->other_domains, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->other_domains));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->other_domains));
+- if (ndr_get_array_length(ndr, &r->other_domains) > ndr_get_array_size(ndr, &r->other_domains)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->other_domains), ndr_get_array_length(ndr, &r->other_domains));
++ size_other_domains_1 = ndr_get_array_size(ndr, &r->other_domains);
++ length_other_domains_1 = ndr_get_array_length(ndr, &r->other_domains);
++ if (length_other_domains_1 > size_other_domains_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_other_domains_1, length_other_domains_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->other_domains), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->other_domains, ndr_get_array_length(ndr, &r->other_domains), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_other_domains_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->other_domains, length_other_domains_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_other_domains_0, 0);
+ }
+ }
+@@ -3702,8 +3762,11 @@ static enum ndr_err_code ndr_pull_wkssvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info0_0;
++ uint32_t _ptr_info0;
+ TALLOC_CTX *_mem_save_info1_0;
++ uint32_t _ptr_info1;
+ TALLOC_CTX *_mem_save_info1101_0;
++ uint32_t _ptr_info1101;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -3713,7 +3776,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_info0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info0));
+ if (_ptr_info0) {
+ NDR_PULL_ALLOC(ndr, r->info0);
+@@ -3723,7 +3785,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_info1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1));
+ if (_ptr_info1) {
+ NDR_PULL_ALLOC(ndr, r->info1);
+@@ -3733,7 +3794,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1101: {
+- uint32_t _ptr_info1101;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1101));
+ if (_ptr_info1101) {
+ NDR_PULL_ALLOC(ndr, r->info1101);
+@@ -3851,8 +3911,12 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaTransportInfo0(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetWkstaTransportInfo0 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_address;
++ uint32_t size_address_1 = 0;
++ uint32_t length_address_1 = 0;
+ TALLOC_CTX *_mem_save_address_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3879,11 +3943,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->address) {
+@@ -3891,11 +3957,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->address, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->address));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->address));
+- if (ndr_get_array_length(ndr, &r->address) > ndr_get_array_size(ndr, &r->address)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->address), ndr_get_array_length(ndr, &r->address));
++ size_address_1 = ndr_get_array_size(ndr, &r->address);
++ length_address_1 = ndr_get_array_length(ndr, &r->address);
++ if (length_address_1 > size_address_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_address_1, length_address_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->address), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->address, ndr_get_array_length(ndr, &r->address), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_address_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->address, length_address_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_address_0, 0);
+ }
+ }
+@@ -3950,6 +4018,7 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaTransportCtr0(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetWkstaTransportCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -3969,13 +4038,14 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -4048,6 +4118,7 @@ static enum ndr_err_code ndr_pull_wkssvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -4057,7 +4128,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -4176,8 +4246,12 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseInfo3(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrUseInfo3 *r)
+ {
+ uint32_t _ptr_unknown1;
++ uint32_t size_unknown1_1 = 0;
++ uint32_t length_unknown1_1 = 0;
+ TALLOC_CTX *_mem_save_unknown1_0;
+ uint32_t _ptr_unknown2;
++ uint32_t size_unknown2_1 = 0;
++ uint32_t length_unknown2_1 = 0;
+ TALLOC_CTX *_mem_save_unknown2_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4201,11 +4275,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->unknown1, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->unknown1));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->unknown1));
+- if (ndr_get_array_length(ndr, &r->unknown1) > ndr_get_array_size(ndr, &r->unknown1)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->unknown1), ndr_get_array_length(ndr, &r->unknown1));
++ size_unknown1_1 = ndr_get_array_size(ndr, &r->unknown1);
++ length_unknown1_1 = ndr_get_array_length(ndr, &r->unknown1);
++ if (length_unknown1_1 > size_unknown1_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown1_1, length_unknown1_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->unknown1), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->unknown1, ndr_get_array_length(ndr, &r->unknown1), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown1_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->unknown1, length_unknown1_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown1_0, 0);
+ }
+ if (r->unknown2) {
+@@ -4213,11 +4289,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->unknown2, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->unknown2));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->unknown2));
+- if (ndr_get_array_length(ndr, &r->unknown2) > ndr_get_array_size(ndr, &r->unknown2)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->unknown2), ndr_get_array_length(ndr, &r->unknown2));
++ size_unknown2_1 = ndr_get_array_size(ndr, &r->unknown2);
++ length_unknown2_1 = ndr_get_array_length(ndr, &r->unknown2);
++ if (length_unknown2_1 > size_unknown2_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown2_1, length_unknown2_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->unknown2), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->unknown2, ndr_get_array_length(ndr, &r->unknown2), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown2_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->unknown2, length_unknown2_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown2_0, 0);
+ }
+ }
+@@ -4296,14 +4374,24 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseInfo2(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrUseInfo2 *r)
+ {
+ uint32_t _ptr_local;
++ uint32_t size_local_1 = 0;
++ uint32_t length_local_1 = 0;
+ TALLOC_CTX *_mem_save_local_0;
+ uint32_t _ptr_remote;
++ uint32_t size_remote_1 = 0;
++ uint32_t length_remote_1 = 0;
+ TALLOC_CTX *_mem_save_remote_0;
+ uint32_t _ptr_password;
++ uint32_t size_password_1 = 0;
++ uint32_t length_password_1 = 0;
+ TALLOC_CTX *_mem_save_password_0;
+ uint32_t _ptr_user_name;
++ uint32_t size_user_name_1 = 0;
++ uint32_t length_user_name_1 = 0;
+ TALLOC_CTX *_mem_save_user_name_0;
+ uint32_t _ptr_domain_name;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ TALLOC_CTX *_mem_save_domain_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4349,11 +4437,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->local, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->local));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->local));
+- if (ndr_get_array_length(ndr, &r->local) > ndr_get_array_size(ndr, &r->local)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->local), ndr_get_array_length(ndr, &r->local));
++ size_local_1 = ndr_get_array_size(ndr, &r->local);
++ length_local_1 = ndr_get_array_length(ndr, &r->local);
++ if (length_local_1 > size_local_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_local_1, length_local_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->local), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->local, ndr_get_array_length(ndr, &r->local), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_local_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->local, length_local_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_local_0, 0);
+ }
+ if (r->remote) {
+@@ -4361,11 +4451,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->remote, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->remote));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->remote));
+- if (ndr_get_array_length(ndr, &r->remote) > ndr_get_array_size(ndr, &r->remote)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->remote), ndr_get_array_length(ndr, &r->remote));
++ size_remote_1 = ndr_get_array_size(ndr, &r->remote);
++ length_remote_1 = ndr_get_array_length(ndr, &r->remote);
++ if (length_remote_1 > size_remote_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_remote_1, length_remote_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->remote), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote, ndr_get_array_length(ndr, &r->remote), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_remote_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote, length_remote_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_remote_0, 0);
+ }
+ if (r->password) {
+@@ -4373,11 +4465,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->password));
+- if (ndr_get_array_length(ndr, &r->password) > ndr_get_array_size(ndr, &r->password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->password), ndr_get_array_length(ndr, &r->password));
++ size_password_1 = ndr_get_array_size(ndr, &r->password);
++ length_password_1 = ndr_get_array_length(ndr, &r->password);
++ if (length_password_1 > size_password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_password_1, length_password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, length_password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_password_0, 0);
+ }
+ if (r->user_name) {
+@@ -4385,11 +4479,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user_name));
+- if (ndr_get_array_length(ndr, &r->user_name) > ndr_get_array_size(ndr, &r->user_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user_name), ndr_get_array_length(ndr, &r->user_name));
++ size_user_name_1 = ndr_get_array_size(ndr, &r->user_name);
++ length_user_name_1 = ndr_get_array_length(ndr, &r->user_name);
++ if (length_user_name_1 > size_user_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_name_1, length_user_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user_name, ndr_get_array_length(ndr, &r->user_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user_name, length_user_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_name_0, 0);
+ }
+ if (r->domain_name) {
+@@ -4397,11 +4493,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain_name));
+- if (ndr_get_array_length(ndr, &r->domain_name) > ndr_get_array_size(ndr, &r->domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain_name), ndr_get_array_length(ndr, &r->domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_name_0, 0);
+ }
+ }
+@@ -4488,10 +4586,16 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseInfo1(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrUseInfo1 *r)
+ {
+ uint32_t _ptr_local;
++ uint32_t size_local_1 = 0;
++ uint32_t length_local_1 = 0;
+ TALLOC_CTX *_mem_save_local_0;
+ uint32_t _ptr_remote;
++ uint32_t size_remote_1 = 0;
++ uint32_t length_remote_1 = 0;
+ TALLOC_CTX *_mem_save_remote_0;
+ uint32_t _ptr_password;
++ uint32_t size_password_1 = 0;
++ uint32_t length_password_1 = 0;
+ TALLOC_CTX *_mem_save_password_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4525,11 +4629,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->local, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->local));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->local));
+- if (ndr_get_array_length(ndr, &r->local) > ndr_get_array_size(ndr, &r->local)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->local), ndr_get_array_length(ndr, &r->local));
++ size_local_1 = ndr_get_array_size(ndr, &r->local);
++ length_local_1 = ndr_get_array_length(ndr, &r->local);
++ if (length_local_1 > size_local_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_local_1, length_local_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->local), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->local, ndr_get_array_length(ndr, &r->local), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_local_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->local, length_local_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_local_0, 0);
+ }
+ if (r->remote) {
+@@ -4537,11 +4643,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->remote, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->remote));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->remote));
+- if (ndr_get_array_length(ndr, &r->remote) > ndr_get_array_size(ndr, &r->remote)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->remote), ndr_get_array_length(ndr, &r->remote));
++ size_remote_1 = ndr_get_array_size(ndr, &r->remote);
++ length_remote_1 = ndr_get_array_length(ndr, &r->remote);
++ if (length_remote_1 > size_remote_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_remote_1, length_remote_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->remote), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote, ndr_get_array_length(ndr, &r->remote), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_remote_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote, length_remote_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_remote_0, 0);
+ }
+ if (r->password) {
+@@ -4549,11 +4657,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->password));
+- if (ndr_get_array_length(ndr, &r->password) > ndr_get_array_size(ndr, &r->password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->password), ndr_get_array_length(ndr, &r->password));
++ size_password_1 = ndr_get_array_size(ndr, &r->password);
++ length_password_1 = ndr_get_array_length(ndr, &r->password);
++ if (length_password_1 > size_password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_password_1, length_password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, length_password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_password_0, 0);
+ }
+ }
+@@ -4617,8 +4727,12 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseInfo0(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrUseInfo0 *r)
+ {
+ uint32_t _ptr_local;
++ uint32_t size_local_1 = 0;
++ uint32_t length_local_1 = 0;
+ TALLOC_CTX *_mem_save_local_0;
+ uint32_t _ptr_remote;
++ uint32_t size_remote_1 = 0;
++ uint32_t length_remote_1 = 0;
+ TALLOC_CTX *_mem_save_remote_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4642,11 +4756,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->local, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->local));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->local));
+- if (ndr_get_array_length(ndr, &r->local) > ndr_get_array_size(ndr, &r->local)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->local), ndr_get_array_length(ndr, &r->local));
++ size_local_1 = ndr_get_array_size(ndr, &r->local);
++ length_local_1 = ndr_get_array_length(ndr, &r->local);
++ if (length_local_1 > size_local_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_local_1, length_local_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->local), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->local, ndr_get_array_length(ndr, &r->local), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_local_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->local, length_local_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_local_0, 0);
+ }
+ if (r->remote) {
+@@ -4654,11 +4770,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->remote, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->remote));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->remote));
+- if (ndr_get_array_length(ndr, &r->remote) > ndr_get_array_size(ndr, &r->remote)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->remote), ndr_get_array_length(ndr, &r->remote));
++ size_remote_1 = ndr_get_array_size(ndr, &r->remote);
++ length_remote_1 = ndr_get_array_length(ndr, &r->remote);
++ if (length_remote_1 > size_remote_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_remote_1, length_remote_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->remote), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote, ndr_get_array_length(ndr, &r->remote), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_remote_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote, length_remote_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_remote_0, 0);
+ }
+ }
+@@ -4750,9 +4868,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info0_0;
++ uint32_t _ptr_info0;
+ TALLOC_CTX *_mem_save_info1_0;
++ uint32_t _ptr_info1;
+ TALLOC_CTX *_mem_save_info2_0;
++ uint32_t _ptr_info2;
+ TALLOC_CTX *_mem_save_info3_0;
++ uint32_t _ptr_info3;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -4762,7 +4884,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_info0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info0));
+ if (_ptr_info0) {
+ NDR_PULL_ALLOC(ndr, r->info0);
+@@ -4772,7 +4893,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_info1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1));
+ if (_ptr_info1) {
+ NDR_PULL_ALLOC(ndr, r->info1);
+@@ -4782,7 +4902,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 2: {
+- uint32_t _ptr_info2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info2));
+ if (_ptr_info2) {
+ NDR_PULL_ALLOC(ndr, r->info2);
+@@ -4792,7 +4911,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 3: {
+- uint32_t _ptr_info3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info3));
+ if (_ptr_info3) {
+ NDR_PULL_ALLOC(ndr, r->info3);
+@@ -4923,6 +5041,7 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseEnumCtr2(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrUseEnumCtr2 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -4942,13 +5061,14 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrUseInfo2(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrUseInfo2(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5011,6 +5131,7 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseEnumCtr1(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrUseEnumCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -5030,13 +5151,14 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrUseInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrUseInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5099,6 +5221,7 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseEnumCtr0(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_NetrUseEnumCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -5118,13 +5241,14 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrUseInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_wkssvc_NetrUseInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5217,8 +5341,11 @@ static enum ndr_err_code ndr_pull_wkssvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ TALLOC_CTX *_mem_save_ctr2_0;
++ uint32_t _ptr_ctr2;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -5228,7 +5355,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -5238,7 +5364,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -5248,7 +5373,6 @@ static enum ndr_err_code ndr_pull_wkssvc
+ break; }
+
+ case 2: {
+- uint32_t _ptr_ctr2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr2));
+ if (_ptr_ctr2) {
+ NDR_PULL_ALLOC(ndr, r->ctr2);
+@@ -5621,12 +5745,14 @@ static enum ndr_err_code ndr_push_wkssvc
+
+ static enum ndr_err_code ndr_pull_wkssvc_PasswordBuffer(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_PasswordBuffer *r)
+ {
++ uint32_t size_data_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, 524));
++ size_data_0 = 524;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 1));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -5734,6 +5860,7 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_ComputerNamesCtr(struct ndr_pull *ndr, int ndr_flags, struct wkssvc_ComputerNamesCtr *r)
+ {
+ uint32_t _ptr_computer_name;
++ uint32_t size_computer_name_1 = 0;
+ uint32_t cntr_computer_name_1;
+ TALLOC_CTX *_mem_save_computer_name_0;
+ TALLOC_CTX *_mem_save_computer_name_1;
+@@ -5753,13 +5880,14 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_computer_name_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->computer_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->computer_name));
+- NDR_PULL_ALLOC_N(ndr, r->computer_name, ndr_get_array_size(ndr, &r->computer_name));
++ size_computer_name_1 = ndr_get_array_size(ndr, &r->computer_name);
++ NDR_PULL_ALLOC_N(ndr, r->computer_name, size_computer_name_1);
+ _mem_save_computer_name_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->computer_name, 0);
+- for (cntr_computer_name_1 = 0; cntr_computer_name_1 < r->count; cntr_computer_name_1++) {
++ for (cntr_computer_name_1 = 0; cntr_computer_name_1 < size_computer_name_1; cntr_computer_name_1++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS, &r->computer_name[cntr_computer_name_1]));
+ }
+- for (cntr_computer_name_1 = 0; cntr_computer_name_1 < r->count; cntr_computer_name_1++) {
++ for (cntr_computer_name_1 = 0; cntr_computer_name_1 < size_computer_name_1; cntr_computer_name_1++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_BUFFERS, &r->computer_name[cntr_computer_name_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_computer_name_1, 0);
+@@ -5822,6 +5950,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaGetInfo(struct ndr_pull *ndr, int flags, struct wkssvc_NetWkstaGetInfo *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+@@ -5838,11 +5968,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -5930,6 +6062,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaSetInfo(struct ndr_pull *ndr, int flags, struct wkssvc_NetWkstaSetInfo *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_info_0;
+ TALLOC_CTX *_mem_save_parm_error_0;
+@@ -5947,11 +6081,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -6068,6 +6204,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaEnumUsers(struct ndr_pull *ndr, int flags, struct wkssvc_NetWkstaEnumUsers *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -6087,11 +6225,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -6229,6 +6369,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWkstaUserGetInfo(struct ndr_pull *ndr, int flags, struct wkssvc_NetrWkstaUserGetInfo *r)
+ {
+ uint32_t _ptr_unknown;
++ uint32_t size_unknown_1 = 0;
++ uint32_t length_unknown_1 = 0;
+ TALLOC_CTX *_mem_save_unknown_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+@@ -6245,11 +6387,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.unknown, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.unknown));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.unknown));
+- if (ndr_get_array_length(ndr, &r->in.unknown) > ndr_get_array_size(ndr, &r->in.unknown)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.unknown), ndr_get_array_length(ndr, &r->in.unknown));
++ size_unknown_1 = ndr_get_array_size(ndr, &r->in.unknown);
++ length_unknown_1 = ndr_get_array_length(ndr, &r->in.unknown);
++ if (length_unknown_1 > size_unknown_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown_1, length_unknown_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.unknown), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown, ndr_get_array_length(ndr, &r->in.unknown), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown, length_unknown_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -6337,6 +6481,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWkstaUserSetInfo(struct ndr_pull *ndr, int flags, struct wkssvc_NetrWkstaUserSetInfo *r)
+ {
+ uint32_t _ptr_unknown;
++ uint32_t size_unknown_1 = 0;
++ uint32_t length_unknown_1 = 0;
+ uint32_t _ptr_parm_err;
+ TALLOC_CTX *_mem_save_unknown_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -6355,11 +6501,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.unknown, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.unknown));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.unknown));
+- if (ndr_get_array_length(ndr, &r->in.unknown) > ndr_get_array_size(ndr, &r->in.unknown)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.unknown), ndr_get_array_length(ndr, &r->in.unknown));
++ size_unknown_1 = ndr_get_array_size(ndr, &r->in.unknown);
++ length_unknown_1 = ndr_get_array_length(ndr, &r->in.unknown);
++ if (length_unknown_1 > size_unknown_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown_1, length_unknown_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.unknown), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown, ndr_get_array_length(ndr, &r->in.unknown), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown, length_unknown_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -6488,6 +6636,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetWkstaTransportEnum(struct ndr_pull *ndr, int flags, struct wkssvc_NetWkstaTransportEnum *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -6507,11 +6657,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -6656,6 +6808,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWkstaTransportAdd(struct ndr_pull *ndr, int flags, struct wkssvc_NetrWkstaTransportAdd *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_parm_err;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_info0_0;
+@@ -6674,11 +6828,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -6792,7 +6948,11 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWkstaTransportDel(struct ndr_pull *ndr, int flags, struct wkssvc_NetrWkstaTransportDel *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_transport_name;
++ uint32_t size_transport_name_1 = 0;
++ uint32_t length_transport_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_transport_name_0;
+ if (flags & NDR_IN) {
+@@ -6807,11 +6967,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_transport_name));
+@@ -6825,11 +6987,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.transport_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.transport_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.transport_name));
+- if (ndr_get_array_length(ndr, &r->in.transport_name) > ndr_get_array_size(ndr, &r->in.transport_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.transport_name), ndr_get_array_length(ndr, &r->in.transport_name));
++ size_transport_name_1 = ndr_get_array_size(ndr, &r->in.transport_name);
++ length_transport_name_1 = ndr_get_array_length(ndr, &r->in.transport_name);
++ if (length_transport_name_1 > size_transport_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_transport_name_1, length_transport_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.transport_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.transport_name, ndr_get_array_length(ndr, &r->in.transport_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_transport_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.transport_name, length_transport_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_transport_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.unknown3));
+@@ -6908,6 +7072,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseAdd(struct ndr_pull *ndr, int flags, struct wkssvc_NetrUseAdd *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_parm_err;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_ctr_0;
+@@ -6926,11 +7092,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -7051,6 +7219,10 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseGetInfo(struct ndr_pull *ndr, int flags, struct wkssvc_NetrUseGetInfo *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_use_name_1 = 0;
++ uint32_t length_use_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_ctr_0;
+ if (flags & NDR_IN) {
+@@ -7067,20 +7239,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.use_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.use_name));
+- if (ndr_get_array_length(ndr, &r->in.use_name) > ndr_get_array_size(ndr, &r->in.use_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.use_name), ndr_get_array_length(ndr, &r->in.use_name));
++ size_use_name_1 = ndr_get_array_size(ndr, &r->in.use_name);
++ length_use_name_1 = ndr_get_array_length(ndr, &r->in.use_name);
++ if (length_use_name_1 > size_use_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_use_name_1, length_use_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.use_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.use_name, ndr_get_array_length(ndr, &r->in.use_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_use_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.use_name, length_use_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+ NDR_PULL_ALLOC(ndr, r->out.ctr);
+ ZERO_STRUCTP(r->out.ctr);
+@@ -7164,6 +7340,10 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseDel(struct ndr_pull *ndr, int flags, struct wkssvc_NetrUseDel *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_use_name_1 = 0;
++ uint32_t length_use_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_name));
+@@ -7177,20 +7357,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.use_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.use_name));
+- if (ndr_get_array_length(ndr, &r->in.use_name) > ndr_get_array_size(ndr, &r->in.use_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.use_name), ndr_get_array_length(ndr, &r->in.use_name));
++ size_use_name_1 = ndr_get_array_size(ndr, &r->in.use_name);
++ length_use_name_1 = ndr_get_array_length(ndr, &r->in.use_name);
++ if (length_use_name_1 > size_use_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_use_name_1, length_use_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.use_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.use_name, ndr_get_array_length(ndr, &r->in.use_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_use_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.use_name, length_use_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.force_cond));
+ }
+ if (flags & NDR_OUT) {
+@@ -7272,6 +7456,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUseEnum(struct ndr_pull *ndr, int flags, struct wkssvc_NetrUseEnum *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -7291,11 +7477,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -7447,7 +7635,14 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrMessageBufferSend(struct ndr_pull *ndr, int flags, struct wkssvc_NetrMessageBufferSend *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_message_name_1 = 0;
++ uint32_t length_message_name_1 = 0;
+ uint32_t _ptr_message_sender_name;
++ uint32_t size_message_sender_name_1 = 0;
++ uint32_t length_message_sender_name_1 = 0;
++ uint32_t size_message_buffer_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_message_sender_name_0;
+ if (flags & NDR_IN) {
+@@ -7462,20 +7657,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.message_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.message_name));
+- if (ndr_get_array_length(ndr, &r->in.message_name) > ndr_get_array_size(ndr, &r->in.message_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.message_name), ndr_get_array_length(ndr, &r->in.message_name));
++ size_message_name_1 = ndr_get_array_size(ndr, &r->in.message_name);
++ length_message_name_1 = ndr_get_array_length(ndr, &r->in.message_name);
++ if (length_message_name_1 > size_message_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_message_name_1, length_message_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.message_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.message_name, ndr_get_array_length(ndr, &r->in.message_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_message_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.message_name, length_message_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_message_sender_name));
+ if (_ptr_message_sender_name) {
+ NDR_PULL_ALLOC(ndr, r->in.message_sender_name);
+@@ -7487,18 +7686,21 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.message_sender_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.message_sender_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.message_sender_name));
+- if (ndr_get_array_length(ndr, &r->in.message_sender_name) > ndr_get_array_size(ndr, &r->in.message_sender_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.message_sender_name), ndr_get_array_length(ndr, &r->in.message_sender_name));
++ size_message_sender_name_1 = ndr_get_array_size(ndr, &r->in.message_sender_name);
++ length_message_sender_name_1 = ndr_get_array_length(ndr, &r->in.message_sender_name);
++ if (length_message_sender_name_1 > size_message_sender_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_message_sender_name_1, length_message_sender_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.message_sender_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.message_sender_name, ndr_get_array_length(ndr, &r->in.message_sender_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_message_sender_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.message_sender_name, length_message_sender_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_message_sender_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.message_buffer));
++ size_message_buffer_1 = ndr_get_array_size(ndr, &r->in.message_buffer);
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+- NDR_PULL_ALLOC_N(ndr, r->in.message_buffer, ndr_get_array_size(ndr, &r->in.message_buffer));
++ NDR_PULL_ALLOC_N(ndr, r->in.message_buffer, size_message_buffer_1);
+ }
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.message_buffer, ndr_get_array_size(ndr, &r->in.message_buffer)));
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.message_buffer, size_message_buffer_1));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.message_size));
+ if (r->in.message_buffer) {
+ NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->in.message_buffer, r->in.message_size));
+@@ -7588,7 +7790,11 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrWorkstationStatisticsGet(struct ndr_pull *ndr, int flags, struct wkssvc_NetrWorkstationStatisticsGet *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_unknown2;
++ uint32_t size_unknown2_1 = 0;
++ uint32_t length_unknown2_1 = 0;
+ uint32_t _ptr_info;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_unknown2_0;
+@@ -7608,11 +7814,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_unknown2));
+@@ -7626,11 +7834,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.unknown2, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.unknown2));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.unknown2));
+- if (ndr_get_array_length(ndr, &r->in.unknown2) > ndr_get_array_size(ndr, &r->in.unknown2)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.unknown2), ndr_get_array_length(ndr, &r->in.unknown2));
++ size_unknown2_1 = ndr_get_array_size(ndr, &r->in.unknown2);
++ length_unknown2_1 = ndr_get_array_length(ndr, &r->in.unknown2);
++ if (length_unknown2_1 > size_unknown2_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown2_1, length_unknown2_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.unknown2), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown2, ndr_get_array_length(ndr, &r->in.unknown2), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown2_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown2, length_unknown2_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown2_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.unknown3));
+@@ -7725,14 +7935,18 @@ static enum ndr_err_code ndr_push_wkssvc
+
+ static enum ndr_err_code ndr_pull_wkssvc_NetrLogonDomainNameAdd(struct ndr_pull *ndr, int flags, struct wkssvc_NetrLogonDomainNameAdd *r)
+ {
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.domain_name));
+- if (ndr_get_array_length(ndr, &r->in.domain_name) > ndr_get_array_size(ndr, &r->in.domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.domain_name), ndr_get_array_length(ndr, &r->in.domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->in.domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->in.domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->out.result));
+@@ -7784,14 +7998,18 @@ static enum ndr_err_code ndr_push_wkssvc
+
+ static enum ndr_err_code ndr_pull_wkssvc_NetrLogonDomainNameDel(struct ndr_pull *ndr, int flags, struct wkssvc_NetrLogonDomainNameDel *r)
+ {
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.domain_name));
+- if (ndr_get_array_length(ndr, &r->in.domain_name) > ndr_get_array_size(ndr, &r->in.domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.domain_name), ndr_get_array_length(ndr, &r->in.domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->in.domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->in.domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->out.result));
+@@ -7873,9 +8091,19 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrJoinDomain(struct ndr_pull *ndr, int flags, struct wkssvc_NetrJoinDomain *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ uint32_t _ptr_account_ou;
++ uint32_t size_account_ou_1 = 0;
++ uint32_t length_account_ou_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_password;
++ uint32_t size_password_1 = 0;
++ uint32_t length_password_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_account_ou_0;
+ TALLOC_CTX *_mem_save_Account_0;
+@@ -7892,20 +8120,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.domain_name));
+- if (ndr_get_array_length(ndr, &r->in.domain_name) > ndr_get_array_size(ndr, &r->in.domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.domain_name), ndr_get_array_length(ndr, &r->in.domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->in.domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->in.domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_account_ou));
+ if (_ptr_account_ou) {
+ NDR_PULL_ALLOC(ndr, r->in.account_ou);
+@@ -7917,11 +8149,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.account_ou, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.account_ou));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.account_ou));
+- if (ndr_get_array_length(ndr, &r->in.account_ou) > ndr_get_array_size(ndr, &r->in.account_ou)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.account_ou), ndr_get_array_length(ndr, &r->in.account_ou));
++ size_account_ou_1 = ndr_get_array_size(ndr, &r->in.account_ou);
++ length_account_ou_1 = ndr_get_array_length(ndr, &r->in.account_ou);
++ if (length_account_ou_1 > size_account_ou_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_account_ou_1, length_account_ou_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.account_ou), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.account_ou, ndr_get_array_length(ndr, &r->in.account_ou), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_account_ou_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.account_ou, length_account_ou_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_account_ou_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+@@ -7935,11 +8169,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_password));
+@@ -7953,11 +8189,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.password));
+- if (ndr_get_array_length(ndr, &r->in.password) > ndr_get_array_size(ndr, &r->in.password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.password), ndr_get_array_length(ndr, &r->in.password));
++ size_password_1 = ndr_get_array_size(ndr, &r->in.password);
++ length_password_1 = ndr_get_array_length(ndr, &r->in.password);
++ if (length_password_1 > size_password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_password_1, length_password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.password, ndr_get_array_length(ndr, &r->in.password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.password, length_password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_password_0, 0);
+ }
+ NDR_CHECK(ndr_pull_wkssvc_joinflags(ndr, NDR_SCALARS, &r->in.join_flags));
+@@ -8053,8 +8291,14 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUnjoinDomain(struct ndr_pull *ndr, int flags, struct wkssvc_NetrUnjoinDomain *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_password;
++ uint32_t size_password_1 = 0;
++ uint32_t length_password_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_Account_0;
+ TALLOC_CTX *_mem_save_password_0;
+@@ -8070,11 +8314,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+@@ -8088,11 +8334,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_password));
+@@ -8106,11 +8354,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.password));
+- if (ndr_get_array_length(ndr, &r->in.password) > ndr_get_array_size(ndr, &r->in.password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.password), ndr_get_array_length(ndr, &r->in.password));
++ size_password_1 = ndr_get_array_size(ndr, &r->in.password);
++ length_password_1 = ndr_get_array_length(ndr, &r->in.password);
++ if (length_password_1 > size_password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_password_1, length_password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.password, ndr_get_array_length(ndr, &r->in.password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.password, length_password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_password_0, 0);
+ }
+ NDR_CHECK(ndr_pull_wkssvc_joinflags(ndr, NDR_SCALARS, &r->in.unjoin_flags));
+@@ -8203,9 +8453,17 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrRenameMachineInDomain(struct ndr_pull *ndr, int flags, struct wkssvc_NetrRenameMachineInDomain *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_NewMachineName;
++ uint32_t size_NewMachineName_1 = 0;
++ uint32_t length_NewMachineName_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_password;
++ uint32_t size_password_1 = 0;
++ uint32_t length_password_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_NewMachineName_0;
+ TALLOC_CTX *_mem_save_Account_0;
+@@ -8222,11 +8480,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_NewMachineName));
+@@ -8240,11 +8500,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.NewMachineName, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.NewMachineName));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.NewMachineName));
+- if (ndr_get_array_length(ndr, &r->in.NewMachineName) > ndr_get_array_size(ndr, &r->in.NewMachineName)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.NewMachineName), ndr_get_array_length(ndr, &r->in.NewMachineName));
++ size_NewMachineName_1 = ndr_get_array_size(ndr, &r->in.NewMachineName);
++ length_NewMachineName_1 = ndr_get_array_length(ndr, &r->in.NewMachineName);
++ if (length_NewMachineName_1 > size_NewMachineName_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_NewMachineName_1, length_NewMachineName_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.NewMachineName), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.NewMachineName, ndr_get_array_length(ndr, &r->in.NewMachineName), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_NewMachineName_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.NewMachineName, length_NewMachineName_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_NewMachineName_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+@@ -8258,11 +8520,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_password));
+@@ -8276,11 +8540,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.password));
+- if (ndr_get_array_length(ndr, &r->in.password) > ndr_get_array_size(ndr, &r->in.password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.password), ndr_get_array_length(ndr, &r->in.password));
++ size_password_1 = ndr_get_array_size(ndr, &r->in.password);
++ length_password_1 = ndr_get_array_length(ndr, &r->in.password);
++ if (length_password_1 > size_password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_password_1, length_password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.password, ndr_get_array_length(ndr, &r->in.password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.password, length_password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_password_0, 0);
+ }
+ NDR_CHECK(ndr_pull_wkssvc_renameflags(ndr, NDR_SCALARS, &r->in.RenameOptions));
+@@ -8379,8 +8645,16 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrValidateName(struct ndr_pull *ndr, int flags, struct wkssvc_NetrValidateName *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_Password;
++ uint32_t size_Password_1 = 0;
++ uint32_t length_Password_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_Account_0;
+ TALLOC_CTX *_mem_save_Password_0;
+@@ -8396,20 +8670,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.name));
+- if (ndr_get_array_length(ndr, &r->in.name) > ndr_get_array_size(ndr, &r->in.name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.name), ndr_get_array_length(ndr, &r->in.name));
++ size_name_1 = ndr_get_array_size(ndr, &r->in.name);
++ length_name_1 = ndr_get_array_length(ndr, &r->in.name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name, ndr_get_array_length(ndr, &r->in.name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+ if (_ptr_Account) {
+ NDR_PULL_ALLOC(ndr, r->in.Account);
+@@ -8421,11 +8699,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Password));
+@@ -8439,11 +8719,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Password));
+- if (ndr_get_array_length(ndr, &r->in.Password) > ndr_get_array_size(ndr, &r->in.Password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Password), ndr_get_array_length(ndr, &r->in.Password));
++ size_Password_1 = ndr_get_array_size(ndr, &r->in.Password);
++ length_Password_1 = ndr_get_array_length(ndr, &r->in.Password);
++ if (length_Password_1 > size_Password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Password_1, length_Password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Password, ndr_get_array_length(ndr, &r->in.Password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Password, length_Password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Password_0, 0);
+ }
+ NDR_CHECK(ndr_pull_wkssvc_NetValidateNameType(ndr, NDR_SCALARS, &r->in.name_type));
+@@ -8542,7 +8824,11 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrGetJoinInformation(struct ndr_pull *ndr, int flags, struct wkssvc_NetrGetJoinInformation *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_name_buffer;
++ uint32_t size_name_buffer_2 = 0;
++ uint32_t length_name_buffer_2 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_name_buffer_0;
+ TALLOC_CTX *_mem_save_name_buffer_1;
+@@ -8561,11 +8847,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -8584,11 +8872,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, *r->in.name_buffer, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->in.name_buffer));
+ NDR_CHECK(ndr_pull_array_length(ndr, r->in.name_buffer));
+- if (ndr_get_array_length(ndr, r->in.name_buffer) > ndr_get_array_size(ndr, r->in.name_buffer)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, r->in.name_buffer), ndr_get_array_length(ndr, r->in.name_buffer));
++ size_name_buffer_2 = ndr_get_array_size(ndr, r->in.name_buffer);
++ length_name_buffer_2 = ndr_get_array_length(ndr, r->in.name_buffer);
++ if (length_name_buffer_2 > size_name_buffer_2) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_buffer_2, length_name_buffer_2);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, r->in.name_buffer), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->in.name_buffer, ndr_get_array_length(ndr, r->in.name_buffer), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_buffer_2, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->in.name_buffer, length_name_buffer_2, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_buffer_1, 0);
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_buffer_0, LIBNDR_FLAG_REF_ALLOC);
+@@ -8614,11 +8904,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.name_buffer, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->out.name_buffer));
+ NDR_CHECK(ndr_pull_array_length(ndr, r->out.name_buffer));
+- if (ndr_get_array_length(ndr, r->out.name_buffer) > ndr_get_array_size(ndr, r->out.name_buffer)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, r->out.name_buffer), ndr_get_array_length(ndr, r->out.name_buffer));
++ size_name_buffer_2 = ndr_get_array_size(ndr, r->out.name_buffer);
++ length_name_buffer_2 = ndr_get_array_length(ndr, r->out.name_buffer);
++ if (length_name_buffer_2 > size_name_buffer_2) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_buffer_2, length_name_buffer_2);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, r->out.name_buffer), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.name_buffer, ndr_get_array_length(ndr, r->out.name_buffer), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_buffer_2, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.name_buffer, length_name_buffer_2, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_buffer_1, 0);
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_buffer_0, LIBNDR_FLAG_REF_ALLOC);
+@@ -8751,10 +9043,21 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrGetJoinableOus(struct ndr_pull *ndr, int flags, struct wkssvc_NetrGetJoinableOus *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_unknown;
++ uint32_t size_unknown_1 = 0;
++ uint32_t length_unknown_1 = 0;
+ uint32_t _ptr_ous;
++ uint32_t size_ous_2 = 0;
+ uint32_t cntr_ous_2;
++ uint32_t size_ous_4 = 0;
++ uint32_t length_ous_4 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_Account_0;
+ TALLOC_CTX *_mem_save_unknown_0;
+@@ -8777,20 +9080,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.domain_name));
+- if (ndr_get_array_length(ndr, &r->in.domain_name) > ndr_get_array_size(ndr, &r->in.domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.domain_name), ndr_get_array_length(ndr, &r->in.domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->in.domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->in.domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+ if (_ptr_Account) {
+ NDR_PULL_ALLOC(ndr, r->in.Account);
+@@ -8802,11 +9109,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_unknown));
+@@ -8820,11 +9129,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.unknown, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.unknown));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.unknown));
+- if (ndr_get_array_length(ndr, &r->in.unknown) > ndr_get_array_size(ndr, &r->in.unknown)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.unknown), ndr_get_array_length(ndr, &r->in.unknown));
++ size_unknown_1 = ndr_get_array_size(ndr, &r->in.unknown);
++ length_unknown_1 = ndr_get_array_length(ndr, &r->in.unknown);
++ if (length_unknown_1 > size_unknown_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown_1, length_unknown_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.unknown), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown, ndr_get_array_length(ndr, &r->in.unknown), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown, length_unknown_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -8862,10 +9173,11 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_ous_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.ous, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->out.ous));
+- NDR_PULL_ALLOC_N(ndr, *r->out.ous, ndr_get_array_size(ndr, r->out.ous));
++ size_ous_2 = ndr_get_array_size(ndr, r->out.ous);
++ NDR_PULL_ALLOC_N(ndr, *r->out.ous, size_ous_2);
+ _mem_save_ous_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.ous, 0);
+- for (cntr_ous_2 = 0; cntr_ous_2 < *r->out.num_ous; cntr_ous_2++) {
++ for (cntr_ous_2 = 0; cntr_ous_2 < size_ous_2; cntr_ous_2++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ous));
+ if (_ptr_ous) {
+ NDR_PULL_ALLOC(ndr, (*r->out.ous)[cntr_ous_2]);
+@@ -8873,17 +9185,19 @@ static enum ndr_err_code ndr_pull_wkssvc
+ (*r->out.ous)[cntr_ous_2] = NULL;
+ }
+ }
+- for (cntr_ous_2 = 0; cntr_ous_2 < *r->out.num_ous; cntr_ous_2++) {
++ for (cntr_ous_2 = 0; cntr_ous_2 < size_ous_2; cntr_ous_2++) {
+ if ((*r->out.ous)[cntr_ous_2]) {
+ _mem_save_ous_3 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, (*r->out.ous)[cntr_ous_2], 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &(*r->out.ous)[cntr_ous_2]));
+ NDR_CHECK(ndr_pull_array_length(ndr, &(*r->out.ous)[cntr_ous_2]));
+- if (ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]) > ndr_get_array_size(ndr, &(*r->out.ous)[cntr_ous_2])) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &(*r->out.ous)[cntr_ous_2]), ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]));
++ size_ous_4 = ndr_get_array_size(ndr, &(*r->out.ous)[cntr_ous_2]);
++ length_ous_4 = ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]);
++ if (length_ous_4 > size_ous_4) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_ous_4, length_ous_4);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &(*r->out.ous)[cntr_ous_2], ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_ous_4, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &(*r->out.ous)[cntr_ous_2], length_ous_4, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ous_3, 0);
+ }
+ }
+@@ -9020,8 +9334,16 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrJoinDomain2(struct ndr_pull *ndr, int flags, struct wkssvc_NetrJoinDomain2 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ uint32_t _ptr_account_ou;
++ uint32_t size_account_ou_1 = 0;
++ uint32_t length_account_ou_1 = 0;
+ uint32_t _ptr_admin_account;
++ uint32_t size_admin_account_1 = 0;
++ uint32_t length_admin_account_1 = 0;
+ uint32_t _ptr_encrypted_password;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_account_ou_0;
+@@ -9039,20 +9361,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.domain_name));
+- if (ndr_get_array_length(ndr, &r->in.domain_name) > ndr_get_array_size(ndr, &r->in.domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.domain_name), ndr_get_array_length(ndr, &r->in.domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->in.domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->in.domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_account_ou));
+ if (_ptr_account_ou) {
+ NDR_PULL_ALLOC(ndr, r->in.account_ou);
+@@ -9064,11 +9390,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.account_ou, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.account_ou));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.account_ou));
+- if (ndr_get_array_length(ndr, &r->in.account_ou) > ndr_get_array_size(ndr, &r->in.account_ou)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.account_ou), ndr_get_array_length(ndr, &r->in.account_ou));
++ size_account_ou_1 = ndr_get_array_size(ndr, &r->in.account_ou);
++ length_account_ou_1 = ndr_get_array_length(ndr, &r->in.account_ou);
++ if (length_account_ou_1 > size_account_ou_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_account_ou_1, length_account_ou_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.account_ou), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.account_ou, ndr_get_array_length(ndr, &r->in.account_ou), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_account_ou_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.account_ou, length_account_ou_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_account_ou_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_admin_account));
+@@ -9082,11 +9410,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.admin_account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.admin_account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.admin_account));
+- if (ndr_get_array_length(ndr, &r->in.admin_account) > ndr_get_array_size(ndr, &r->in.admin_account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.admin_account), ndr_get_array_length(ndr, &r->in.admin_account));
++ size_admin_account_1 = ndr_get_array_size(ndr, &r->in.admin_account);
++ length_admin_account_1 = ndr_get_array_length(ndr, &r->in.admin_account);
++ if (length_admin_account_1 > size_admin_account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_admin_account_1, length_admin_account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.admin_account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.admin_account, ndr_get_array_length(ndr, &r->in.admin_account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_admin_account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.admin_account, length_admin_account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_admin_account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_encrypted_password));
+@@ -9191,7 +9521,11 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrUnjoinDomain2(struct ndr_pull *ndr, int flags, struct wkssvc_NetrUnjoinDomain2 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_account;
++ uint32_t size_account_1 = 0;
++ uint32_t length_account_1 = 0;
+ uint32_t _ptr_encrypted_password;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_account_0;
+@@ -9208,11 +9542,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_account));
+@@ -9226,11 +9562,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.account));
+- if (ndr_get_array_length(ndr, &r->in.account) > ndr_get_array_size(ndr, &r->in.account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.account), ndr_get_array_length(ndr, &r->in.account));
++ size_account_1 = ndr_get_array_size(ndr, &r->in.account);
++ length_account_1 = ndr_get_array_length(ndr, &r->in.account);
++ if (length_account_1 > size_account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_account_1, length_account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.account, ndr_get_array_length(ndr, &r->in.account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.account, length_account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_encrypted_password));
+@@ -9332,8 +9670,14 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrRenameMachineInDomain2(struct ndr_pull *ndr, int flags, struct wkssvc_NetrRenameMachineInDomain2 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_NewMachineName;
++ uint32_t size_NewMachineName_1 = 0;
++ uint32_t length_NewMachineName_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_EncryptedPassword;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_NewMachineName_0;
+@@ -9351,11 +9695,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_NewMachineName));
+@@ -9369,11 +9715,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.NewMachineName, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.NewMachineName));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.NewMachineName));
+- if (ndr_get_array_length(ndr, &r->in.NewMachineName) > ndr_get_array_size(ndr, &r->in.NewMachineName)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.NewMachineName), ndr_get_array_length(ndr, &r->in.NewMachineName));
++ size_NewMachineName_1 = ndr_get_array_size(ndr, &r->in.NewMachineName);
++ length_NewMachineName_1 = ndr_get_array_length(ndr, &r->in.NewMachineName);
++ if (length_NewMachineName_1 > size_NewMachineName_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_NewMachineName_1, length_NewMachineName_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.NewMachineName), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.NewMachineName, ndr_get_array_length(ndr, &r->in.NewMachineName), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_NewMachineName_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.NewMachineName, length_NewMachineName_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_NewMachineName_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+@@ -9387,11 +9735,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_EncryptedPassword));
+@@ -9499,7 +9849,13 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrValidateName2(struct ndr_pull *ndr, int flags, struct wkssvc_NetrValidateName2 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_EncryptedPassword;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_Account_0;
+@@ -9516,20 +9872,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.name));
+- if (ndr_get_array_length(ndr, &r->in.name) > ndr_get_array_size(ndr, &r->in.name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.name), ndr_get_array_length(ndr, &r->in.name));
++ size_name_1 = ndr_get_array_size(ndr, &r->in.name);
++ length_name_1 = ndr_get_array_length(ndr, &r->in.name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name, ndr_get_array_length(ndr, &r->in.name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+ if (_ptr_Account) {
+ NDR_PULL_ALLOC(ndr, r->in.Account);
+@@ -9541,11 +9901,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_EncryptedPassword));
+@@ -9677,10 +10039,19 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrGetJoinableOus2(struct ndr_pull *ndr, int flags, struct wkssvc_NetrGetJoinableOus2 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_EncryptedPassword;
+ uint32_t _ptr_ous;
++ uint32_t size_ous_2 = 0;
+ uint32_t cntr_ous_2;
++ uint32_t size_ous_4 = 0;
++ uint32_t length_ous_4 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_Account_0;
+ TALLOC_CTX *_mem_save_EncryptedPassword_0;
+@@ -9703,20 +10074,24 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.domain_name));
+- if (ndr_get_array_length(ndr, &r->in.domain_name) > ndr_get_array_size(ndr, &r->in.domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.domain_name), ndr_get_array_length(ndr, &r->in.domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->in.domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->in.domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, ndr_get_array_length(ndr, &r->in.domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+ if (_ptr_Account) {
+ NDR_PULL_ALLOC(ndr, r->in.Account);
+@@ -9728,11 +10103,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_EncryptedPassword));
+@@ -9782,10 +10159,11 @@ static enum ndr_err_code ndr_pull_wkssvc
+ _mem_save_ous_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.ous, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->out.ous));
+- NDR_PULL_ALLOC_N(ndr, *r->out.ous, ndr_get_array_size(ndr, r->out.ous));
++ size_ous_2 = ndr_get_array_size(ndr, r->out.ous);
++ NDR_PULL_ALLOC_N(ndr, *r->out.ous, size_ous_2);
+ _mem_save_ous_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.ous, 0);
+- for (cntr_ous_2 = 0; cntr_ous_2 < *r->out.num_ous; cntr_ous_2++) {
++ for (cntr_ous_2 = 0; cntr_ous_2 < size_ous_2; cntr_ous_2++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ous));
+ if (_ptr_ous) {
+ NDR_PULL_ALLOC(ndr, (*r->out.ous)[cntr_ous_2]);
+@@ -9793,17 +10171,19 @@ static enum ndr_err_code ndr_pull_wkssvc
+ (*r->out.ous)[cntr_ous_2] = NULL;
+ }
+ }
+- for (cntr_ous_2 = 0; cntr_ous_2 < *r->out.num_ous; cntr_ous_2++) {
++ for (cntr_ous_2 = 0; cntr_ous_2 < size_ous_2; cntr_ous_2++) {
+ if ((*r->out.ous)[cntr_ous_2]) {
+ _mem_save_ous_3 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, (*r->out.ous)[cntr_ous_2], 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &(*r->out.ous)[cntr_ous_2]));
+ NDR_CHECK(ndr_pull_array_length(ndr, &(*r->out.ous)[cntr_ous_2]));
+- if (ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]) > ndr_get_array_size(ndr, &(*r->out.ous)[cntr_ous_2])) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &(*r->out.ous)[cntr_ous_2]), ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]));
++ size_ous_4 = ndr_get_array_size(ndr, &(*r->out.ous)[cntr_ous_2]);
++ length_ous_4 = ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]);
++ if (length_ous_4 > size_ous_4) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_ous_4, length_ous_4);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &(*r->out.ous)[cntr_ous_2], ndr_get_array_length(ndr, &(*r->out.ous)[cntr_ous_2]), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_ous_4, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &(*r->out.ous)[cntr_ous_2], length_ous_4, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ous_3, 0);
+ }
+ }
+@@ -9933,8 +10313,14 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrAddAlternateComputerName(struct ndr_pull *ndr, int flags, struct wkssvc_NetrAddAlternateComputerName *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_NewAlternateMachineName;
++ uint32_t size_NewAlternateMachineName_1 = 0;
++ uint32_t length_NewAlternateMachineName_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_EncryptedPassword;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_NewAlternateMachineName_0;
+@@ -9952,11 +10338,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_NewAlternateMachineName));
+@@ -9970,11 +10358,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.NewAlternateMachineName, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.NewAlternateMachineName));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.NewAlternateMachineName));
+- if (ndr_get_array_length(ndr, &r->in.NewAlternateMachineName) > ndr_get_array_size(ndr, &r->in.NewAlternateMachineName)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.NewAlternateMachineName), ndr_get_array_length(ndr, &r->in.NewAlternateMachineName));
++ size_NewAlternateMachineName_1 = ndr_get_array_size(ndr, &r->in.NewAlternateMachineName);
++ length_NewAlternateMachineName_1 = ndr_get_array_length(ndr, &r->in.NewAlternateMachineName);
++ if (length_NewAlternateMachineName_1 > size_NewAlternateMachineName_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_NewAlternateMachineName_1, length_NewAlternateMachineName_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.NewAlternateMachineName), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.NewAlternateMachineName, ndr_get_array_length(ndr, &r->in.NewAlternateMachineName), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_NewAlternateMachineName_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.NewAlternateMachineName, length_NewAlternateMachineName_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_NewAlternateMachineName_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+@@ -9988,11 +10378,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_EncryptedPassword));
+@@ -10100,8 +10492,14 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrRemoveAlternateComputerName(struct ndr_pull *ndr, int flags, struct wkssvc_NetrRemoveAlternateComputerName *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_AlternateMachineNameToRemove;
++ uint32_t size_AlternateMachineNameToRemove_1 = 0;
++ uint32_t length_AlternateMachineNameToRemove_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_EncryptedPassword;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_AlternateMachineNameToRemove_0;
+@@ -10119,11 +10517,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_AlternateMachineNameToRemove));
+@@ -10137,11 +10537,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.AlternateMachineNameToRemove, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.AlternateMachineNameToRemove));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.AlternateMachineNameToRemove));
+- if (ndr_get_array_length(ndr, &r->in.AlternateMachineNameToRemove) > ndr_get_array_size(ndr, &r->in.AlternateMachineNameToRemove)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.AlternateMachineNameToRemove), ndr_get_array_length(ndr, &r->in.AlternateMachineNameToRemove));
++ size_AlternateMachineNameToRemove_1 = ndr_get_array_size(ndr, &r->in.AlternateMachineNameToRemove);
++ length_AlternateMachineNameToRemove_1 = ndr_get_array_length(ndr, &r->in.AlternateMachineNameToRemove);
++ if (length_AlternateMachineNameToRemove_1 > size_AlternateMachineNameToRemove_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_AlternateMachineNameToRemove_1, length_AlternateMachineNameToRemove_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.AlternateMachineNameToRemove), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.AlternateMachineNameToRemove, ndr_get_array_length(ndr, &r->in.AlternateMachineNameToRemove), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_AlternateMachineNameToRemove_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.AlternateMachineNameToRemove, length_AlternateMachineNameToRemove_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_AlternateMachineNameToRemove_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+@@ -10155,11 +10557,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_EncryptedPassword));
+@@ -10267,8 +10671,14 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrSetPrimaryComputername(struct ndr_pull *ndr, int flags, struct wkssvc_NetrSetPrimaryComputername *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_primary_name;
++ uint32_t size_primary_name_1 = 0;
++ uint32_t length_primary_name_1 = 0;
+ uint32_t _ptr_Account;
++ uint32_t size_Account_1 = 0;
++ uint32_t length_Account_1 = 0;
+ uint32_t _ptr_EncryptedPassword;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_primary_name_0;
+@@ -10286,11 +10696,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_primary_name));
+@@ -10304,11 +10716,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.primary_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.primary_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.primary_name));
+- if (ndr_get_array_length(ndr, &r->in.primary_name) > ndr_get_array_size(ndr, &r->in.primary_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.primary_name), ndr_get_array_length(ndr, &r->in.primary_name));
++ size_primary_name_1 = ndr_get_array_size(ndr, &r->in.primary_name);
++ length_primary_name_1 = ndr_get_array_length(ndr, &r->in.primary_name);
++ if (length_primary_name_1 > size_primary_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_primary_name_1, length_primary_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.primary_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.primary_name, ndr_get_array_length(ndr, &r->in.primary_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_primary_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.primary_name, length_primary_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_primary_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_Account));
+@@ -10322,11 +10736,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.Account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.Account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.Account));
+- if (ndr_get_array_length(ndr, &r->in.Account) > ndr_get_array_size(ndr, &r->in.Account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.Account), ndr_get_array_length(ndr, &r->in.Account));
++ size_Account_1 = ndr_get_array_size(ndr, &r->in.Account);
++ length_Account_1 = ndr_get_array_length(ndr, &r->in.Account);
++ if (length_Account_1 > size_Account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_Account_1, length_Account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, ndr_get_array_length(ndr, &r->in.Account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_Account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.Account, length_Account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_Account_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_EncryptedPassword));
+@@ -10424,6 +10840,8 @@ static enum ndr_err_code ndr_push_wkssvc
+ static enum ndr_err_code ndr_pull_wkssvc_NetrEnumerateComputerNames(struct ndr_pull *ndr, int flags, struct wkssvc_NetrEnumerateComputerNames *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ uint32_t _ptr_ctr;
+ TALLOC_CTX *_mem_save_server_name_0;
+ TALLOC_CTX *_mem_save_ctr_0;
+@@ -10442,11 +10860,13 @@ static enum ndr_err_code ndr_pull_wkssvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_name));
+- if (ndr_get_array_length(ndr, &r->in.server_name) > ndr_get_array_size(ndr, &r->in.server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_name), ndr_get_array_length(ndr, &r->in.server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->in.server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->in.server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, ndr_get_array_length(ndr, &r->in.server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_wkssvc_ComputerNameType(ndr, NDR_SCALARS, &r->in.name_type));
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_lsa.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_lsa.c
+@@ -28,6 +28,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_String(struct ndr_pull *ndr, int ndr_flags, struct lsa_String *r)
+ {
+ uint32_t _ptr_string;
++ uint32_t size_string_1 = 0;
++ uint32_t length_string_1 = 0;
+ TALLOC_CTX *_mem_save_string_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -47,10 +49,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ NDR_PULL_SET_MEM_CTX(ndr, r->string, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->string));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->string));
+- if (ndr_get_array_length(ndr, &r->string) > ndr_get_array_size(ndr, &r->string)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->string), ndr_get_array_length(ndr, &r->string));
++ size_string_1 = ndr_get_array_size(ndr, &r->string);
++ length_string_1 = ndr_get_array_length(ndr, &r->string);
++ if (length_string_1 > size_string_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_string_1, length_string_1);
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, ndr_get_array_length(ndr, &r->string), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, length_string_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_string_0, 0);
+ }
+ if (r->string) {
+@@ -101,6 +105,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_StringLarge(struct ndr_pull *ndr, int ndr_flags, struct lsa_StringLarge *r)
+ {
+ uint32_t _ptr_string;
++ uint32_t size_string_1 = 0;
++ uint32_t length_string_1 = 0;
+ TALLOC_CTX *_mem_save_string_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -120,10 +126,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ NDR_PULL_SET_MEM_CTX(ndr, r->string, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->string));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->string));
+- if (ndr_get_array_length(ndr, &r->string) > ndr_get_array_size(ndr, &r->string)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->string), ndr_get_array_length(ndr, &r->string));
++ size_string_1 = ndr_get_array_size(ndr, &r->string);
++ length_string_1 = ndr_get_array_length(ndr, &r->string);
++ if (length_string_1 > size_string_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_string_1, length_string_1);
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, ndr_get_array_length(ndr, &r->string), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, length_string_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_string_0, 0);
+ }
+ if (r->string) {
+@@ -177,6 +185,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_Strings(struct ndr_pull *ndr, int ndr_flags, struct lsa_Strings *r)
+ {
+ uint32_t _ptr_names;
++ uint32_t size_names_1 = 0;
+ uint32_t cntr_names_1;
+ TALLOC_CTX *_mem_save_names_0;
+ TALLOC_CTX *_mem_save_names_1;
+@@ -196,13 +205,14 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->names));
+- NDR_PULL_ALLOC_N(ndr, r->names, ndr_get_array_size(ndr, &r->names));
++ size_names_1 = ndr_get_array_size(ndr, &r->names);
++ NDR_PULL_ALLOC_N(ndr, r->names, size_names_1);
+ _mem_save_names_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS, &r->names[cntr_names_1]));
+ }
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_BUFFERS, &r->names[cntr_names_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_1, 0);
+@@ -262,6 +272,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_AsciiString(struct ndr_pull *ndr, int ndr_flags, struct lsa_AsciiString *r)
+ {
+ uint32_t _ptr_string;
++ uint32_t size_string_1 = 0;
++ uint32_t length_string_1 = 0;
+ TALLOC_CTX *_mem_save_string_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -281,10 +293,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ NDR_PULL_SET_MEM_CTX(ndr, r->string, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->string));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->string));
+- if (ndr_get_array_length(ndr, &r->string) > ndr_get_array_size(ndr, &r->string)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->string), ndr_get_array_length(ndr, &r->string));
++ size_string_1 = ndr_get_array_size(ndr, &r->string);
++ length_string_1 = ndr_get_array_length(ndr, &r->string);
++ if (length_string_1 > size_string_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_string_1, length_string_1);
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, ndr_get_array_length(ndr, &r->string), sizeof(uint8_t), CH_DOS));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, length_string_1, sizeof(uint8_t), CH_DOS));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_string_0, 0);
+ }
+ if (r->string) {
+@@ -335,6 +349,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_AsciiStringLarge(struct ndr_pull *ndr, int ndr_flags, struct lsa_AsciiStringLarge *r)
+ {
+ uint32_t _ptr_string;
++ uint32_t size_string_1 = 0;
++ uint32_t length_string_1 = 0;
+ TALLOC_CTX *_mem_save_string_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -354,10 +370,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ NDR_PULL_SET_MEM_CTX(ndr, r->string, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->string));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->string));
+- if (ndr_get_array_length(ndr, &r->string) > ndr_get_array_size(ndr, &r->string)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->string), ndr_get_array_length(ndr, &r->string));
++ size_string_1 = ndr_get_array_size(ndr, &r->string);
++ length_string_1 = ndr_get_array_length(ndr, &r->string);
++ if (length_string_1 > size_string_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_string_1, length_string_1);
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, ndr_get_array_length(ndr, &r->string), sizeof(uint8_t), CH_DOS));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string, length_string_1, sizeof(uint8_t), CH_DOS));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_string_0, 0);
+ }
+ if (r->string) {
+@@ -411,6 +429,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_BinaryString(struct ndr_pull *ndr, int ndr_flags, struct lsa_BinaryString *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
++ uint32_t length_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -432,13 +452,15 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->array));
+- if (ndr_get_array_length(ndr, &r->array) > ndr_get_array_size(ndr, &r->array)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->array), ndr_get_array_length(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ length_array_1 = ndr_get_array_length(ndr, &r->array);
++ if (length_array_1 > size_array_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_array_1, length_array_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < ndr_get_array_length(ndr, &r->array); cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < length_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -577,6 +599,7 @@ static enum ndr_err_code ndr_push_lsa_Pr
+ static enum ndr_err_code ndr_pull_lsa_PrivArray(struct ndr_pull *ndr, int ndr_flags, struct lsa_PrivArray *r)
+ {
+ uint32_t _ptr_privs;
++ uint32_t size_privs_1 = 0;
+ uint32_t cntr_privs_1;
+ TALLOC_CTX *_mem_save_privs_0;
+ TALLOC_CTX *_mem_save_privs_1;
+@@ -596,13 +619,14 @@ static enum ndr_err_code ndr_pull_lsa_Pr
+ _mem_save_privs_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->privs, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->privs));
+- NDR_PULL_ALLOC_N(ndr, r->privs, ndr_get_array_size(ndr, &r->privs));
++ size_privs_1 = ndr_get_array_size(ndr, &r->privs);
++ NDR_PULL_ALLOC_N(ndr, r->privs, size_privs_1);
+ _mem_save_privs_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->privs, 0);
+- for (cntr_privs_1 = 0; cntr_privs_1 < r->count; cntr_privs_1++) {
++ for (cntr_privs_1 = 0; cntr_privs_1 < size_privs_1; cntr_privs_1++) {
+ NDR_CHECK(ndr_pull_lsa_PrivEntry(ndr, NDR_SCALARS, &r->privs[cntr_privs_1]));
+ }
+- for (cntr_privs_1 = 0; cntr_privs_1 < r->count; cntr_privs_1++) {
++ for (cntr_privs_1 = 0; cntr_privs_1 < size_privs_1; cntr_privs_1++) {
+ NDR_CHECK(ndr_pull_lsa_PrivEntry(ndr, NDR_BUFFERS, &r->privs[cntr_privs_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_privs_1, 0);
+@@ -717,6 +741,8 @@ static enum ndr_err_code ndr_pull_lsa_Ob
+ uint32_t _ptr_root_dir;
+ TALLOC_CTX *_mem_save_root_dir_0;
+ uint32_t _ptr_object_name;
++ uint32_t size_object_name_1 = 0;
++ uint32_t length_object_name_1 = 0;
+ TALLOC_CTX *_mem_save_object_name_0;
+ uint32_t _ptr_sec_desc;
+ TALLOC_CTX *_mem_save_sec_desc_0;
+@@ -764,11 +790,13 @@ static enum ndr_err_code ndr_pull_lsa_Ob
+ NDR_PULL_SET_MEM_CTX(ndr, r->object_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->object_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->object_name));
+- if (ndr_get_array_length(ndr, &r->object_name) > ndr_get_array_size(ndr, &r->object_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->object_name), ndr_get_array_length(ndr, &r->object_name));
++ size_object_name_1 = ndr_get_array_size(ndr, &r->object_name);
++ length_object_name_1 = ndr_get_array_length(ndr, &r->object_name);
++ if (length_object_name_1 > size_object_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_object_name_1, length_object_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->object_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_name, ndr_get_array_length(ndr, &r->object_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_object_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_name, length_object_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_object_name_0, 0);
+ }
+ if (r->sec_desc) {
+@@ -1029,6 +1057,7 @@ static enum ndr_err_code ndr_push_lsa_Au
+ static enum ndr_err_code ndr_pull_lsa_AuditEventsInfo(struct ndr_pull *ndr, int ndr_flags, struct lsa_AuditEventsInfo *r)
+ {
+ uint32_t _ptr_settings;
++ uint32_t size_settings_1 = 0;
+ uint32_t cntr_settings_1;
+ TALLOC_CTX *_mem_save_settings_0;
+ TALLOC_CTX *_mem_save_settings_1;
+@@ -1049,10 +1078,11 @@ static enum ndr_err_code ndr_pull_lsa_Au
+ _mem_save_settings_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->settings, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->settings));
+- NDR_PULL_ALLOC_N(ndr, r->settings, ndr_get_array_size(ndr, &r->settings));
++ size_settings_1 = ndr_get_array_size(ndr, &r->settings);
++ NDR_PULL_ALLOC_N(ndr, r->settings, size_settings_1);
+ _mem_save_settings_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->settings, 0);
+- for (cntr_settings_1 = 0; cntr_settings_1 < r->count; cntr_settings_1++) {
++ for (cntr_settings_1 = 0; cntr_settings_1 < size_settings_1; cntr_settings_1++) {
+ NDR_CHECK(ndr_pull_lsa_PolicyAuditPolicy(ndr, NDR_SCALARS, &r->settings[cntr_settings_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_settings_1, 0);
+@@ -1939,6 +1969,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_SidArray(struct ndr_pull *ndr, int ndr_flags, struct lsa_SidArray *r)
+ {
+ uint32_t _ptr_sids;
++ uint32_t size_sids_1 = 0;
+ uint32_t cntr_sids_1;
+ TALLOC_CTX *_mem_save_sids_0;
+ TALLOC_CTX *_mem_save_sids_1;
+@@ -1961,13 +1992,14 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ _mem_save_sids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->sids));
+- NDR_PULL_ALLOC_N(ndr, r->sids, ndr_get_array_size(ndr, &r->sids));
++ size_sids_1 = ndr_get_array_size(ndr, &r->sids);
++ NDR_PULL_ALLOC_N(ndr, r->sids, size_sids_1);
+ _mem_save_sids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->num_sids; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ NDR_CHECK(ndr_pull_lsa_SidPtr(ndr, NDR_SCALARS, &r->sids[cntr_sids_1]));
+ }
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->num_sids; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ NDR_CHECK(ndr_pull_lsa_SidPtr(ndr, NDR_BUFFERS, &r->sids[cntr_sids_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sids_1, 0);
+@@ -2030,6 +2062,7 @@ static enum ndr_err_code ndr_push_lsa_Do
+ static enum ndr_err_code ndr_pull_lsa_DomainList(struct ndr_pull *ndr, int ndr_flags, struct lsa_DomainList *r)
+ {
+ uint32_t _ptr_domains;
++ uint32_t size_domains_1 = 0;
+ uint32_t cntr_domains_1;
+ TALLOC_CTX *_mem_save_domains_0;
+ TALLOC_CTX *_mem_save_domains_1;
+@@ -2049,13 +2082,14 @@ static enum ndr_err_code ndr_pull_lsa_Do
+ _mem_save_domains_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->domains, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domains));
+- NDR_PULL_ALLOC_N(ndr, r->domains, ndr_get_array_size(ndr, &r->domains));
++ size_domains_1 = ndr_get_array_size(ndr, &r->domains);
++ NDR_PULL_ALLOC_N(ndr, r->domains, size_domains_1);
+ _mem_save_domains_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->domains, 0);
+- for (cntr_domains_1 = 0; cntr_domains_1 < r->count; cntr_domains_1++) {
++ for (cntr_domains_1 = 0; cntr_domains_1 < size_domains_1; cntr_domains_1++) {
+ NDR_CHECK(ndr_pull_lsa_DomainInfo(ndr, NDR_SCALARS, &r->domains[cntr_domains_1]));
+ }
+- for (cntr_domains_1 = 0; cntr_domains_1 < r->count; cntr_domains_1++) {
++ for (cntr_domains_1 = 0; cntr_domains_1 < size_domains_1; cntr_domains_1++) {
+ NDR_CHECK(ndr_pull_lsa_DomainInfo(ndr, NDR_BUFFERS, &r->domains[cntr_domains_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domains_1, 0);
+@@ -2186,6 +2220,7 @@ static enum ndr_err_code ndr_push_lsa_Tr
+ static enum ndr_err_code ndr_pull_lsa_TransSidArray(struct ndr_pull *ndr, int ndr_flags, struct lsa_TransSidArray *r)
+ {
+ uint32_t _ptr_sids;
++ uint32_t size_sids_1 = 0;
+ uint32_t cntr_sids_1;
+ TALLOC_CTX *_mem_save_sids_0;
+ TALLOC_CTX *_mem_save_sids_1;
+@@ -2208,10 +2243,11 @@ static enum ndr_err_code ndr_pull_lsa_Tr
+ _mem_save_sids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->sids));
+- NDR_PULL_ALLOC_N(ndr, r->sids, ndr_get_array_size(ndr, &r->sids));
++ size_sids_1 = ndr_get_array_size(ndr, &r->sids);
++ NDR_PULL_ALLOC_N(ndr, r->sids, size_sids_1);
+ _mem_save_sids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->count; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedSid(ndr, NDR_SCALARS, &r->sids[cntr_sids_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sids_1, 0);
+@@ -2275,6 +2311,7 @@ static enum ndr_err_code ndr_push_lsa_Re
+ static enum ndr_err_code ndr_pull_lsa_RefDomainList(struct ndr_pull *ndr, int ndr_flags, struct lsa_RefDomainList *r)
+ {
+ uint32_t _ptr_domains;
++ uint32_t size_domains_1 = 0;
+ uint32_t cntr_domains_1;
+ TALLOC_CTX *_mem_save_domains_0;
+ TALLOC_CTX *_mem_save_domains_1;
+@@ -2298,13 +2335,14 @@ static enum ndr_err_code ndr_pull_lsa_Re
+ _mem_save_domains_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->domains, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domains));
+- NDR_PULL_ALLOC_N(ndr, r->domains, ndr_get_array_size(ndr, &r->domains));
++ size_domains_1 = ndr_get_array_size(ndr, &r->domains);
++ NDR_PULL_ALLOC_N(ndr, r->domains, size_domains_1);
+ _mem_save_domains_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->domains, 0);
+- for (cntr_domains_1 = 0; cntr_domains_1 < r->count; cntr_domains_1++) {
++ for (cntr_domains_1 = 0; cntr_domains_1 < size_domains_1; cntr_domains_1++) {
+ NDR_CHECK(ndr_pull_lsa_DomainInfo(ndr, NDR_SCALARS, &r->domains[cntr_domains_1]));
+ }
+- for (cntr_domains_1 = 0; cntr_domains_1 < r->count; cntr_domains_1++) {
++ for (cntr_domains_1 = 0; cntr_domains_1 < size_domains_1; cntr_domains_1++) {
+ NDR_CHECK(ndr_pull_lsa_DomainInfo(ndr, NDR_BUFFERS, &r->domains[cntr_domains_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domains_1, 0);
+@@ -2438,6 +2476,7 @@ static enum ndr_err_code ndr_push_lsa_Tr
+ static enum ndr_err_code ndr_pull_lsa_TransNameArray(struct ndr_pull *ndr, int ndr_flags, struct lsa_TransNameArray *r)
+ {
+ uint32_t _ptr_names;
++ uint32_t size_names_1 = 0;
+ uint32_t cntr_names_1;
+ TALLOC_CTX *_mem_save_names_0;
+ TALLOC_CTX *_mem_save_names_1;
+@@ -2460,13 +2499,14 @@ static enum ndr_err_code ndr_pull_lsa_Tr
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->names));
+- NDR_PULL_ALLOC_N(ndr, r->names, ndr_get_array_size(ndr, &r->names));
++ size_names_1 = ndr_get_array_size(ndr, &r->names);
++ NDR_PULL_ALLOC_N(ndr, r->names, size_names_1);
+ _mem_save_names_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedName(ndr, NDR_SCALARS, &r->names[cntr_names_1]));
+ }
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedName(ndr, NDR_BUFFERS, &r->names[cntr_names_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_1, 0);
+@@ -2558,6 +2598,7 @@ static enum ndr_err_code ndr_push_lsa_Pr
+
+ static enum ndr_err_code ndr_pull_lsa_PrivilegeSet(struct ndr_pull *ndr, int ndr_flags, struct lsa_PrivilegeSet *r)
+ {
++ uint32_t size_set_0 = 0;
+ uint32_t cntr_set_0;
+ TALLOC_CTX *_mem_save_set_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -2568,10 +2609,11 @@ static enum ndr_err_code ndr_pull_lsa_Pr
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->unknown));
+- NDR_PULL_ALLOC_N(ndr, r->set, ndr_get_array_size(ndr, &r->set));
++ size_set_0 = ndr_get_array_size(ndr, &r->set);
++ NDR_PULL_ALLOC_N(ndr, r->set, size_set_0);
+ _mem_save_set_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->set, 0);
+- for (cntr_set_0 = 0; cntr_set_0 < r->count; cntr_set_0++) {
++ for (cntr_set_0 = 0; cntr_set_0 < size_set_0; cntr_set_0++) {
+ NDR_CHECK(ndr_pull_lsa_LUIDAttribute(ndr, NDR_SCALARS, &r->set[cntr_set_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_set_0, 0);
+@@ -2633,6 +2675,8 @@ static enum ndr_err_code ndr_push_lsa_DA
+ static enum ndr_err_code ndr_pull_lsa_DATA_BUF(struct ndr_pull *ndr, int ndr_flags, struct lsa_DATA_BUF *r)
+ {
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
++ uint32_t length_data_1 = 0;
+ TALLOC_CTX *_mem_save_data_0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+@@ -2655,11 +2699,13 @@ static enum ndr_err_code ndr_pull_lsa_DA
+ NDR_PULL_SET_MEM_CTX(ndr, r->data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->data));
+- if (ndr_get_array_length(ndr, &r->data) > ndr_get_array_size(ndr, &r->data)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->data), ndr_get_array_length(ndr, &r->data));
++ size_data_1 = ndr_get_array_size(ndr, &r->data);
++ length_data_1 = ndr_get_array_length(ndr, &r->data);
++ if (length_data_1 > size_data_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_data_1, length_data_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_length(ndr, &r->data)));
++ NDR_PULL_ALLOC_N(ndr, r->data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, length_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ if (r->data) {
+@@ -2719,6 +2765,7 @@ static enum ndr_err_code ndr_push_lsa_DA
+ static enum ndr_err_code ndr_pull_lsa_DATA_BUF2(struct ndr_pull *ndr, int ndr_flags, struct lsa_DATA_BUF2 *r)
+ {
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
+ TALLOC_CTX *_mem_save_data_0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+@@ -2742,8 +2789,9 @@ static enum ndr_err_code ndr_pull_lsa_DA
+ _mem_save_data_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
+- NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_size(ndr, &r->data)));
++ size_data_1 = ndr_get_array_size(ndr, &r->data);
++ NDR_PULL_ALLOC_N(ndr, r->data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ if (r->data) {
+@@ -2948,6 +2996,7 @@ static enum ndr_err_code ndr_push_lsa_Tr
+ static enum ndr_err_code ndr_pull_lsa_TrustDomainInfoControllers(struct ndr_pull *ndr, int ndr_flags, struct lsa_TrustDomainInfoControllers *r)
+ {
+ uint32_t _ptr_netbios_names;
++ uint32_t size_netbios_names_1 = 0;
+ uint32_t cntr_netbios_names_1;
+ TALLOC_CTX *_mem_save_netbios_names_0;
+ TALLOC_CTX *_mem_save_netbios_names_1;
+@@ -2967,13 +3016,14 @@ static enum ndr_err_code ndr_pull_lsa_Tr
+ _mem_save_netbios_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->netbios_names, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->netbios_names));
+- NDR_PULL_ALLOC_N(ndr, r->netbios_names, ndr_get_array_size(ndr, &r->netbios_names));
++ size_netbios_names_1 = ndr_get_array_size(ndr, &r->netbios_names);
++ NDR_PULL_ALLOC_N(ndr, r->netbios_names, size_netbios_names_1);
+ _mem_save_netbios_names_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->netbios_names, 0);
+- for (cntr_netbios_names_1 = 0; cntr_netbios_names_1 < r->entries; cntr_netbios_names_1++) {
++ for (cntr_netbios_names_1 = 0; cntr_netbios_names_1 < size_netbios_names_1; cntr_netbios_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_StringLarge(ndr, NDR_SCALARS, &r->netbios_names[cntr_netbios_names_1]));
+ }
+- for (cntr_netbios_names_1 = 0; cntr_netbios_names_1 < r->entries; cntr_netbios_names_1++) {
++ for (cntr_netbios_names_1 = 0; cntr_netbios_names_1 < size_netbios_names_1; cntr_netbios_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_StringLarge(ndr, NDR_BUFFERS, &r->netbios_names[cntr_netbios_names_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_netbios_names_1, 0);
+@@ -3587,6 +3637,7 @@ static enum ndr_err_code ndr_push_lsa_Tr
+ static enum ndr_err_code ndr_pull_lsa_TrustDomainInfoInfoEx2Internal(struct ndr_pull *ndr, int ndr_flags, struct lsa_TrustDomainInfoInfoEx2Internal *r)
+ {
+ uint32_t _ptr_forest_trust_data;
++ uint32_t size_forest_trust_data_1 = 0;
+ TALLOC_CTX *_mem_save_forest_trust_data_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3606,8 +3657,9 @@ static enum ndr_err_code ndr_pull_lsa_Tr
+ _mem_save_forest_trust_data_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->forest_trust_data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->forest_trust_data));
+- NDR_PULL_ALLOC_N(ndr, r->forest_trust_data, ndr_get_array_size(ndr, &r->forest_trust_data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->forest_trust_data, ndr_get_array_size(ndr, &r->forest_trust_data)));
++ size_forest_trust_data_1 = ndr_get_array_size(ndr, &r->forest_trust_data);
++ NDR_PULL_ALLOC_N(ndr, r->forest_trust_data, size_forest_trust_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->forest_trust_data, size_forest_trust_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_forest_trust_data_0, 0);
+ }
+ if (r->forest_trust_data) {
+@@ -4098,6 +4150,7 @@ static enum ndr_err_code ndr_push_lsa_Ri
+ static enum ndr_err_code ndr_pull_lsa_RightSet(struct ndr_pull *ndr, int ndr_flags, struct lsa_RightSet *r)
+ {
+ uint32_t _ptr_names;
++ uint32_t size_names_1 = 0;
+ uint32_t cntr_names_1;
+ TALLOC_CTX *_mem_save_names_0;
+ TALLOC_CTX *_mem_save_names_1;
+@@ -4120,13 +4173,14 @@ static enum ndr_err_code ndr_pull_lsa_Ri
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->names));
+- NDR_PULL_ALLOC_N(ndr, r->names, ndr_get_array_size(ndr, &r->names));
++ size_names_1 = ndr_get_array_size(ndr, &r->names);
++ NDR_PULL_ALLOC_N(ndr, r->names, size_names_1);
+ _mem_save_names_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_StringLarge(ndr, NDR_SCALARS, &r->names[cntr_names_1]));
+ }
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_StringLarge(ndr, NDR_BUFFERS, &r->names[cntr_names_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_1, 0);
+@@ -4189,6 +4243,7 @@ static enum ndr_err_code ndr_push_lsa_Do
+ static enum ndr_err_code ndr_pull_lsa_DomainListEx(struct ndr_pull *ndr, int ndr_flags, struct lsa_DomainListEx *r)
+ {
+ uint32_t _ptr_domains;
++ uint32_t size_domains_1 = 0;
+ uint32_t cntr_domains_1;
+ TALLOC_CTX *_mem_save_domains_0;
+ TALLOC_CTX *_mem_save_domains_1;
+@@ -4208,13 +4263,14 @@ static enum ndr_err_code ndr_pull_lsa_Do
+ _mem_save_domains_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->domains, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domains));
+- NDR_PULL_ALLOC_N(ndr, r->domains, ndr_get_array_size(ndr, &r->domains));
++ size_domains_1 = ndr_get_array_size(ndr, &r->domains);
++ NDR_PULL_ALLOC_N(ndr, r->domains, size_domains_1);
+ _mem_save_domains_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->domains, 0);
+- for (cntr_domains_1 = 0; cntr_domains_1 < r->count; cntr_domains_1++) {
++ for (cntr_domains_1 = 0; cntr_domains_1 < size_domains_1; cntr_domains_1++) {
+ NDR_CHECK(ndr_pull_lsa_TrustDomainInfoInfoEx(ndr, NDR_SCALARS, &r->domains[cntr_domains_1]));
+ }
+- for (cntr_domains_1 = 0; cntr_domains_1 < r->count; cntr_domains_1++) {
++ for (cntr_domains_1 = 0; cntr_domains_1 < size_domains_1; cntr_domains_1++) {
+ NDR_CHECK(ndr_pull_lsa_TrustDomainInfoInfoEx(ndr, NDR_BUFFERS, &r->domains[cntr_domains_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domains_1, 0);
+@@ -4318,6 +4374,7 @@ static enum ndr_err_code ndr_push_lsa_Do
+ static enum ndr_err_code ndr_pull_lsa_DomainInfoEfs(struct ndr_pull *ndr, int ndr_flags, struct lsa_DomainInfoEfs *r)
+ {
+ uint32_t _ptr_efs_blob;
++ uint32_t size_efs_blob_1 = 0;
+ TALLOC_CTX *_mem_save_efs_blob_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4335,8 +4392,9 @@ static enum ndr_err_code ndr_pull_lsa_Do
+ _mem_save_efs_blob_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->efs_blob, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->efs_blob));
+- NDR_PULL_ALLOC_N(ndr, r->efs_blob, ndr_get_array_size(ndr, &r->efs_blob));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->efs_blob, ndr_get_array_size(ndr, &r->efs_blob)));
++ size_efs_blob_1 = ndr_get_array_size(ndr, &r->efs_blob);
++ NDR_PULL_ALLOC_N(ndr, r->efs_blob, size_efs_blob_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->efs_blob, size_efs_blob_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_efs_blob_0, 0);
+ }
+ if (r->efs_blob) {
+@@ -4524,6 +4582,7 @@ static enum ndr_err_code ndr_push_lsa_Tr
+ static enum ndr_err_code ndr_pull_lsa_TransNameArray2(struct ndr_pull *ndr, int ndr_flags, struct lsa_TransNameArray2 *r)
+ {
+ uint32_t _ptr_names;
++ uint32_t size_names_1 = 0;
+ uint32_t cntr_names_1;
+ TALLOC_CTX *_mem_save_names_0;
+ TALLOC_CTX *_mem_save_names_1;
+@@ -4546,13 +4605,14 @@ static enum ndr_err_code ndr_pull_lsa_Tr
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->names));
+- NDR_PULL_ALLOC_N(ndr, r->names, ndr_get_array_size(ndr, &r->names));
++ size_names_1 = ndr_get_array_size(ndr, &r->names);
++ NDR_PULL_ALLOC_N(ndr, r->names, size_names_1);
+ _mem_save_names_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedName2(ndr, NDR_SCALARS, &r->names[cntr_names_1]));
+ }
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedName2(ndr, NDR_BUFFERS, &r->names[cntr_names_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_1, 0);
+@@ -4703,6 +4763,7 @@ static enum ndr_err_code ndr_push_lsa_Tr
+ static enum ndr_err_code ndr_pull_lsa_TransSidArray2(struct ndr_pull *ndr, int ndr_flags, struct lsa_TransSidArray2 *r)
+ {
+ uint32_t _ptr_sids;
++ uint32_t size_sids_1 = 0;
+ uint32_t cntr_sids_1;
+ TALLOC_CTX *_mem_save_sids_0;
+ TALLOC_CTX *_mem_save_sids_1;
+@@ -4725,10 +4786,11 @@ static enum ndr_err_code ndr_pull_lsa_Tr
+ _mem_save_sids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->sids));
+- NDR_PULL_ALLOC_N(ndr, r->sids, ndr_get_array_size(ndr, &r->sids));
++ size_sids_1 = ndr_get_array_size(ndr, &r->sids);
++ NDR_PULL_ALLOC_N(ndr, r->sids, size_sids_1);
+ _mem_save_sids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->count; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedSid2(ndr, NDR_SCALARS, &r->sids[cntr_sids_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sids_1, 0);
+@@ -4853,6 +4915,7 @@ static enum ndr_err_code ndr_push_lsa_Tr
+ static enum ndr_err_code ndr_pull_lsa_TransSidArray3(struct ndr_pull *ndr, int ndr_flags, struct lsa_TransSidArray3 *r)
+ {
+ uint32_t _ptr_sids;
++ uint32_t size_sids_1 = 0;
+ uint32_t cntr_sids_1;
+ TALLOC_CTX *_mem_save_sids_0;
+ TALLOC_CTX *_mem_save_sids_1;
+@@ -4875,13 +4938,14 @@ static enum ndr_err_code ndr_pull_lsa_Tr
+ _mem_save_sids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->sids));
+- NDR_PULL_ALLOC_N(ndr, r->sids, ndr_get_array_size(ndr, &r->sids));
++ size_sids_1 = ndr_get_array_size(ndr, &r->sids);
++ NDR_PULL_ALLOC_N(ndr, r->sids, size_sids_1);
+ _mem_save_sids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->count; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedSid3(ndr, NDR_SCALARS, &r->sids[cntr_sids_1]));
+ }
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->count; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ NDR_CHECK(ndr_pull_lsa_TranslatedSid3(ndr, NDR_BUFFERS, &r->sids[cntr_sids_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sids_1, 0);
+@@ -4938,6 +5002,7 @@ static enum ndr_err_code ndr_push_lsa_Fo
+ static enum ndr_err_code ndr_pull_lsa_ForestTrustBinaryData(struct ndr_pull *ndr, int ndr_flags, struct lsa_ForestTrustBinaryData *r)
+ {
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
+ TALLOC_CTX *_mem_save_data_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4958,8 +5023,9 @@ static enum ndr_err_code ndr_pull_lsa_Fo
+ _mem_save_data_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
+- NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_size(ndr, &r->data)));
++ size_data_1 = ndr_get_array_size(ndr, &r->data);
++ NDR_PULL_ALLOC_N(ndr, r->data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ if (r->data) {
+@@ -5274,6 +5340,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_ForestTrustInformation(struct ndr_pull *ndr, int ndr_flags, struct lsa_ForestTrustInformation *r)
+ {
+ uint32_t _ptr_entries;
++ uint32_t size_entries_1 = 0;
+ uint32_t cntr_entries_1;
+ TALLOC_CTX *_mem_save_entries_0;
+ TALLOC_CTX *_mem_save_entries_1;
+@@ -5297,10 +5364,11 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->entries));
+- NDR_PULL_ALLOC_N(ndr, r->entries, ndr_get_array_size(ndr, &r->entries));
++ size_entries_1 = ndr_get_array_size(ndr, &r->entries);
++ NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_1);
+ _mem_save_entries_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_entries));
+ if (_ptr_entries) {
+ NDR_PULL_ALLOC(ndr, r->entries[cntr_entries_1]);
+@@ -5308,7 +5376,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ r->entries[cntr_entries_1] = NULL;
+ }
+ }
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ if (r->entries[cntr_entries_1]) {
+ _mem_save_entries_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries[cntr_entries_1], 0);
+@@ -6617,6 +6685,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_LookupNames(struct ndr_pull *ndr, int flags, struct lsa_LookupNames *r)
+ {
++ uint32_t size_names_0 = 0;
+ uint32_t cntr_names_0;
+ uint32_t _ptr_domains;
+ TALLOC_CTX *_mem_save_handle_0;
+@@ -6640,13 +6709,14 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.names));
+- NDR_PULL_ALLOC_N(ndr, r->in.names, ndr_get_array_size(ndr, &r->in.names));
++ size_names_0 = ndr_get_array_size(ndr, &r->in.names);
++ NDR_PULL_ALLOC_N(ndr, r->in.names, size_names_0);
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.names, 0);
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS, &r->in.names[cntr_names_0]));
+ }
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_BUFFERS, &r->in.names[cntr_names_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_0, 0);
+@@ -9680,6 +9750,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_OpenPolicy2(struct ndr_pull *ndr, int flags, struct lsa_OpenPolicy2 *r)
+ {
+ uint32_t _ptr_system_name;
++ uint32_t size_system_name_1 = 0;
++ uint32_t length_system_name_1 = 0;
+ TALLOC_CTX *_mem_save_system_name_0;
+ TALLOC_CTX *_mem_save_attr_0;
+ TALLOC_CTX *_mem_save_handle_0;
+@@ -9697,11 +9769,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.system_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.system_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.system_name));
+- if (ndr_get_array_length(ndr, &r->in.system_name) > ndr_get_array_size(ndr, &r->in.system_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.system_name), ndr_get_array_length(ndr, &r->in.system_name));
++ size_system_name_1 = ndr_get_array_size(ndr, &r->in.system_name);
++ length_system_name_1 = ndr_get_array_length(ndr, &r->in.system_name);
++ if (length_system_name_1 > size_system_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_system_name_1, length_system_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_system_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, length_system_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_system_name_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -9812,6 +9886,8 @@ static enum ndr_err_code ndr_push_lsa_Ge
+ static enum ndr_err_code ndr_pull_lsa_GetUserName(struct ndr_pull *ndr, int flags, struct lsa_GetUserName *r)
+ {
+ uint32_t _ptr_system_name;
++ uint32_t size_system_name_1 = 0;
++ uint32_t length_system_name_1 = 0;
+ uint32_t _ptr_account_name;
+ uint32_t _ptr_authority_name;
+ TALLOC_CTX *_mem_save_system_name_0;
+@@ -9833,11 +9909,13 @@ static enum ndr_err_code ndr_pull_lsa_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.system_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.system_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.system_name));
+- if (ndr_get_array_length(ndr, &r->in.system_name) > ndr_get_array_size(ndr, &r->in.system_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.system_name), ndr_get_array_length(ndr, &r->in.system_name));
++ size_system_name_1 = ndr_get_array_size(ndr, &r->in.system_name);
++ length_system_name_1 = ndr_get_array_length(ndr, &r->in.system_name);
++ if (length_system_name_1 > size_system_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_system_name_1, length_system_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_system_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, length_system_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_system_name_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -11247,6 +11325,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_LookupNames2(struct ndr_pull *ndr, int flags, struct lsa_LookupNames2 *r)
+ {
++ uint32_t size_names_0 = 0;
+ uint32_t cntr_names_0;
+ uint32_t _ptr_domains;
+ TALLOC_CTX *_mem_save_handle_0;
+@@ -11270,13 +11349,14 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.names));
+- NDR_PULL_ALLOC_N(ndr, r->in.names, ndr_get_array_size(ndr, &r->in.names));
++ size_names_0 = ndr_get_array_size(ndr, &r->in.names);
++ NDR_PULL_ALLOC_N(ndr, r->in.names, size_names_0);
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.names, 0);
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS, &r->in.names[cntr_names_0]));
+ }
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_BUFFERS, &r->in.names[cntr_names_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_0, 0);
+@@ -11901,6 +11981,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_lsa_
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_LookupNames3(struct ndr_pull *ndr, int flags, struct lsa_LookupNames3 *r)
+ {
++ uint32_t size_names_0 = 0;
+ uint32_t cntr_names_0;
+ uint32_t _ptr_domains;
+ TALLOC_CTX *_mem_save_handle_0;
+@@ -11924,13 +12005,14 @@ _PUBLIC_ enum ndr_err_code ndr_pull_lsa_
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.names));
+- NDR_PULL_ALLOC_N(ndr, r->in.names, ndr_get_array_size(ndr, &r->in.names));
++ size_names_0 = ndr_get_array_size(ndr, &r->in.names);
++ NDR_PULL_ALLOC_N(ndr, r->in.names, size_names_0);
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.names, 0);
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS, &r->in.names[cntr_names_0]));
+ }
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_BUFFERS, &r->in.names[cntr_names_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_0, 0);
+@@ -12647,6 +12729,7 @@ static enum ndr_err_code ndr_push_lsa_Lo
+
+ static enum ndr_err_code ndr_pull_lsa_LookupNames4(struct ndr_pull *ndr, int flags, struct lsa_LookupNames4 *r)
+ {
++ uint32_t size_names_0 = 0;
+ uint32_t cntr_names_0;
+ uint32_t _ptr_domains;
+ TALLOC_CTX *_mem_save_names_0;
+@@ -12662,13 +12745,14 @@ static enum ndr_err_code ndr_pull_lsa_Lo
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.names));
+- NDR_PULL_ALLOC_N(ndr, r->in.names, ndr_get_array_size(ndr, &r->in.names));
++ size_names_0 = ndr_get_array_size(ndr, &r->in.names);
++ NDR_PULL_ALLOC_N(ndr, r->in.names, size_names_0);
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.names, 0);
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS, &r->in.names[cntr_names_0]));
+ }
+- for (cntr_names_0 = 0; cntr_names_0 < r->in.num_names; cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < size_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_BUFFERS, &r->in.names[cntr_names_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_0, 0);
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_dssetup.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_dssetup.c
+@@ -96,10 +96,16 @@ static enum ndr_err_code ndr_push_dssetu
+ static enum ndr_err_code ndr_pull_dssetup_DsRolePrimaryDomInfoBasic(struct ndr_pull *ndr, int ndr_flags, struct dssetup_DsRolePrimaryDomInfoBasic *r)
+ {
+ uint32_t _ptr_domain;
++ uint32_t size_domain_1 = 0;
++ uint32_t length_domain_1 = 0;
+ TALLOC_CTX *_mem_save_domain_0;
+ uint32_t _ptr_dns_domain;
++ uint32_t size_dns_domain_1 = 0;
++ uint32_t length_dns_domain_1 = 0;
+ TALLOC_CTX *_mem_save_dns_domain_0;
+ uint32_t _ptr_forest;
++ uint32_t size_forest_1 = 0;
++ uint32_t length_forest_1 = 0;
+ TALLOC_CTX *_mem_save_forest_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -132,11 +138,13 @@ static enum ndr_err_code ndr_pull_dssetu
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain));
+- if (ndr_get_array_length(ndr, &r->domain) > ndr_get_array_size(ndr, &r->domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain), ndr_get_array_length(ndr, &r->domain));
++ size_domain_1 = ndr_get_array_size(ndr, &r->domain);
++ length_domain_1 = ndr_get_array_length(ndr, &r->domain);
++ if (length_domain_1 > size_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_1, length_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, length_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_0, 0);
+ }
+ if (r->dns_domain) {
+@@ -144,11 +152,13 @@ static enum ndr_err_code ndr_pull_dssetu
+ NDR_PULL_SET_MEM_CTX(ndr, r->dns_domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dns_domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dns_domain));
+- if (ndr_get_array_length(ndr, &r->dns_domain) > ndr_get_array_size(ndr, &r->dns_domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dns_domain), ndr_get_array_length(ndr, &r->dns_domain));
++ size_dns_domain_1 = ndr_get_array_size(ndr, &r->dns_domain);
++ length_dns_domain_1 = ndr_get_array_length(ndr, &r->dns_domain);
++ if (length_dns_domain_1 > size_dns_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dns_domain_1, length_dns_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dns_domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_domain, ndr_get_array_length(ndr, &r->dns_domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dns_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_domain, length_dns_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dns_domain_0, 0);
+ }
+ if (r->forest) {
+@@ -156,11 +166,13 @@ static enum ndr_err_code ndr_pull_dssetu
+ NDR_PULL_SET_MEM_CTX(ndr, r->forest, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->forest));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->forest));
+- if (ndr_get_array_length(ndr, &r->forest) > ndr_get_array_size(ndr, &r->forest)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->forest), ndr_get_array_length(ndr, &r->forest));
++ size_forest_1 = ndr_get_array_size(ndr, &r->forest);
++ length_forest_1 = ndr_get_array_length(ndr, &r->forest);
++ if (length_forest_1 > size_forest_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_forest_1, length_forest_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->forest), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->forest, ndr_get_array_length(ndr, &r->forest), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_forest_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->forest, length_forest_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_forest_0, 0);
+ }
+ }
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_epmapper.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_epmapper.c
+@@ -1590,6 +1590,7 @@ static enum ndr_err_code ndr_push_epm_to
+
+ static enum ndr_err_code ndr_pull_epm_tower(struct ndr_pull *ndr, int ndr_flags, struct epm_tower *r)
+ {
++ uint32_t size_floors_0 = 0;
+ uint32_t cntr_floors_0;
+ TALLOC_CTX *_mem_save_floors_0;
+ {
+@@ -1598,10 +1599,11 @@ static enum ndr_err_code ndr_pull_epm_to
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 2));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->num_floors));
+- NDR_PULL_ALLOC_N(ndr, r->floors, r->num_floors);
++ size_floors_0 = r->num_floors;
++ NDR_PULL_ALLOC_N(ndr, r->floors, size_floors_0);
+ _mem_save_floors_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->floors, 0);
+- for (cntr_floors_0 = 0; cntr_floors_0 < r->num_floors; cntr_floors_0++) {
++ for (cntr_floors_0 = 0; cntr_floors_0 < size_floors_0; cntr_floors_0++) {
+ NDR_CHECK(ndr_pull_epm_floor(ndr, NDR_SCALARS, &r->floors[cntr_floors_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_floors_0, 0);
+@@ -1712,6 +1714,7 @@ static enum ndr_err_code ndr_pull_epm_en
+ {
+ uint32_t _ptr_tower;
+ TALLOC_CTX *_mem_save_tower_0;
++ uint32_t size_annotation_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->object));
+@@ -1723,7 +1726,8 @@ static enum ndr_err_code ndr_pull_epm_en
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__annotation_offset));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__annotation_length));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->annotation, r->__annotation_length, sizeof(uint8_t), CH_DOS));
++ size_annotation_0 = r->__annotation_length;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->annotation, size_annotation_0, sizeof(uint8_t), CH_DOS));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -1867,18 +1871,20 @@ static enum ndr_err_code ndr_push_epm_In
+
+ static enum ndr_err_code ndr_pull_epm_Insert(struct ndr_pull *ndr, int flags, struct epm_Insert *r)
+ {
++ uint32_t size_entries_0 = 0;
+ uint32_t cntr_entries_0;
+ TALLOC_CTX *_mem_save_entries_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.num_ents));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.entries));
+- NDR_PULL_ALLOC_N(ndr, r->in.entries, ndr_get_array_size(ndr, &r->in.entries));
++ size_entries_0 = ndr_get_array_size(ndr, &r->in.entries);
++ NDR_PULL_ALLOC_N(ndr, r->in.entries, size_entries_0);
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.entries, 0);
+- for (cntr_entries_0 = 0; cntr_entries_0 < r->in.num_ents; cntr_entries_0++) {
++ for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
+ NDR_CHECK(ndr_pull_epm_entry_t(ndr, NDR_SCALARS, &r->in.entries[cntr_entries_0]));
+ }
+- for (cntr_entries_0 = 0; cntr_entries_0 < r->in.num_ents; cntr_entries_0++) {
++ for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
+ NDR_CHECK(ndr_pull_epm_entry_t(ndr, NDR_BUFFERS, &r->in.entries[cntr_entries_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_0, 0);
+@@ -1948,18 +1954,20 @@ static enum ndr_err_code ndr_push_epm_De
+
+ static enum ndr_err_code ndr_pull_epm_Delete(struct ndr_pull *ndr, int flags, struct epm_Delete *r)
+ {
++ uint32_t size_entries_0 = 0;
+ uint32_t cntr_entries_0;
+ TALLOC_CTX *_mem_save_entries_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.num_ents));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.entries));
+- NDR_PULL_ALLOC_N(ndr, r->in.entries, ndr_get_array_size(ndr, &r->in.entries));
++ size_entries_0 = ndr_get_array_size(ndr, &r->in.entries);
++ NDR_PULL_ALLOC_N(ndr, r->in.entries, size_entries_0);
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.entries, 0);
+- for (cntr_entries_0 = 0; cntr_entries_0 < r->in.num_ents; cntr_entries_0++) {
++ for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
+ NDR_CHECK(ndr_pull_epm_entry_t(ndr, NDR_SCALARS, &r->in.entries[cntr_entries_0]));
+ }
+- for (cntr_entries_0 = 0; cntr_entries_0 < r->in.num_ents; cntr_entries_0++) {
++ for (cntr_entries_0 = 0; cntr_entries_0 < size_entries_0; cntr_entries_0++) {
+ NDR_CHECK(ndr_pull_epm_entry_t(ndr, NDR_BUFFERS, &r->in.entries[cntr_entries_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_0, 0);
+@@ -2053,6 +2061,8 @@ static enum ndr_err_code ndr_pull_epm_Lo
+ {
+ uint32_t _ptr_object;
+ uint32_t _ptr_interface_id;
++ uint32_t size_entries_0 = 0;
++ uint32_t length_entries_0 = 0;
+ uint32_t cntr_entries_0;
+ TALLOC_CTX *_mem_save_object_0;
+ TALLOC_CTX *_mem_save_interface_id_0;
+@@ -2118,16 +2128,18 @@ static enum ndr_err_code ndr_pull_epm_Lo
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_num_ents_0, LIBNDR_FLAG_REF_ALLOC);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.entries));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.entries));
+- if (ndr_get_array_length(ndr, &r->out.entries) > ndr_get_array_size(ndr, &r->out.entries)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.entries), ndr_get_array_length(ndr, &r->out.entries));
++ size_entries_0 = ndr_get_array_size(ndr, &r->out.entries);
++ length_entries_0 = ndr_get_array_length(ndr, &r->out.entries);
++ if (length_entries_0 > size_entries_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_entries_0, length_entries_0);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->out.entries, ndr_get_array_size(ndr, &r->out.entries));
++ NDR_PULL_ALLOC_N(ndr, r->out.entries, size_entries_0);
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->out.entries, 0);
+- for (cntr_entries_0 = 0; cntr_entries_0 < ndr_get_array_length(ndr, &r->out.entries); cntr_entries_0++) {
++ for (cntr_entries_0 = 0; cntr_entries_0 < length_entries_0; cntr_entries_0++) {
+ NDR_CHECK(ndr_pull_epm_entry_t(ndr, NDR_SCALARS, &r->out.entries[cntr_entries_0]));
+ }
+- for (cntr_entries_0 = 0; cntr_entries_0 < ndr_get_array_length(ndr, &r->out.entries); cntr_entries_0++) {
++ for (cntr_entries_0 = 0; cntr_entries_0 < length_entries_0; cntr_entries_0++) {
+ NDR_CHECK(ndr_pull_epm_entry_t(ndr, NDR_BUFFERS, &r->out.entries[cntr_entries_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_0, 0);
+@@ -2246,6 +2258,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_epm_
+ {
+ uint32_t _ptr_object;
+ uint32_t _ptr_map_tower;
++ uint32_t size_towers_0 = 0;
++ uint32_t length_towers_0 = 0;
+ uint32_t cntr_towers_0;
+ TALLOC_CTX *_mem_save_object_0;
+ TALLOC_CTX *_mem_save_map_tower_0;
+@@ -2309,16 +2323,18 @@ _PUBLIC_ enum ndr_err_code ndr_pull_epm_
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_num_towers_0, LIBNDR_FLAG_REF_ALLOC);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.towers));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.towers));
+- if (ndr_get_array_length(ndr, &r->out.towers) > ndr_get_array_size(ndr, &r->out.towers)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.towers), ndr_get_array_length(ndr, &r->out.towers));
++ size_towers_0 = ndr_get_array_size(ndr, &r->out.towers);
++ length_towers_0 = ndr_get_array_length(ndr, &r->out.towers);
++ if (length_towers_0 > size_towers_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_towers_0, length_towers_0);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->out.towers, ndr_get_array_size(ndr, &r->out.towers));
++ NDR_PULL_ALLOC_N(ndr, r->out.towers, size_towers_0);
+ _mem_save_towers_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->out.towers, 0);
+- for (cntr_towers_0 = 0; cntr_towers_0 < ndr_get_array_length(ndr, &r->out.towers); cntr_towers_0++) {
++ for (cntr_towers_0 = 0; cntr_towers_0 < length_towers_0; cntr_towers_0++) {
+ NDR_CHECK(ndr_pull_epm_twr_p_t(ndr, NDR_SCALARS, &r->out.towers[cntr_towers_0]));
+ }
+- for (cntr_towers_0 = 0; cntr_towers_0 < ndr_get_array_length(ndr, &r->out.towers); cntr_towers_0++) {
++ for (cntr_towers_0 = 0; cntr_towers_0 < length_towers_0; cntr_towers_0++) {
+ NDR_CHECK(ndr_pull_epm_twr_p_t(ndr, NDR_BUFFERS, &r->out.towers[cntr_towers_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_towers_0, 0);
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_ntlmssp.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_ntlmssp.c
+@@ -170,12 +170,14 @@ static enum ndr_err_code ndr_push_VERSIO
+
+ static enum ndr_err_code ndr_pull_VERSION(struct ndr_pull *ndr, int ndr_flags, struct VERSION *r)
+ {
++ uint32_t size_Reserved_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 2));
+ NDR_CHECK(ndr_pull_ntlmssp_WindowsMajorVersion(ndr, NDR_SCALARS, &r->ProductMajorVersion));
+ NDR_CHECK(ndr_pull_ntlmssp_WindowsMinorVersion(ndr, NDR_SCALARS, &r->ProductMinorVersion));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->ProductBuild));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Reserved, 3));
++ size_Reserved_0 = 3;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Reserved, size_Reserved_0));
+ NDR_CHECK(ndr_pull_ntlmssp_NTLMRevisionCurrent(ndr, NDR_SCALARS, &r->NTLMRevisionCurrent));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 2));
+ }
+@@ -319,13 +321,15 @@ _PUBLIC_ enum ndr_err_code ndr_push_NEGO
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_NEGOTIATE_MESSAGE(struct ndr_pull *ndr, int ndr_flags, struct NEGOTIATE_MESSAGE *r)
+ {
++ uint32_t size_Signature_0 = 0;
+ uint32_t _ptr_DomainName;
+ TALLOC_CTX *_mem_save_DomainName_0;
+ uint32_t _ptr_Workstation;
+ TALLOC_CTX *_mem_save_Workstation_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->Signature, 8, sizeof(uint8_t), CH_DOS));
++ size_Signature_0 = 8;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->Signature, size_Signature_0, sizeof(uint8_t), CH_DOS));
+ NDR_CHECK(ndr_pull_ntlmssp_MessageType(ndr, NDR_SCALARS, &r->MessageType));
+ NDR_CHECK(ndr_pull_NEGOTIATE(ndr, NDR_SCALARS, &r->NegotiateFlags));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->DomainNameLen));
+@@ -486,13 +490,15 @@ static enum ndr_err_code ndr_push_Restri
+
+ static enum ndr_err_code ndr_pull_Restriction_Encoding(struct ndr_pull *ndr, int ndr_flags, struct Restriction_Encoding *r)
+ {
++ uint32_t size_MachineId_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->Size));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->Z4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->IntegrityLevel));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->SubjectIntegrityLevel));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->MachineId, 32));
++ size_MachineId_0 = 32;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->MachineId, size_MachineId_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -677,6 +683,7 @@ static enum ndr_err_code ndr_push_ntlmss
+ static enum ndr_err_code ndr_pull_ntlmssp_AvValue(struct ndr_pull *ndr, int ndr_flags, union ntlmssp_AvValue *r)
+ {
+ int level;
++ uint32_t size_ChannelBindings_0 = 0;
+ {
+ uint32_t _flags_save_UNION = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_FLAG_NOALIGN);
+@@ -754,7 +761,8 @@ static enum ndr_err_code ndr_pull_ntlmss
+ break; }
+
+ case MsvChannelBindings: {
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ChannelBindings, 16));
++ size_ChannelBindings_0 = 16;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ChannelBindings, size_ChannelBindings_0));
+ break; }
+
+ default: {
+@@ -1038,8 +1046,11 @@ _PUBLIC_ enum ndr_err_code ndr_push_CHAL
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_CHALLENGE_MESSAGE(struct ndr_pull *ndr, int ndr_flags, struct CHALLENGE_MESSAGE *r)
+ {
++ uint32_t size_Signature_0 = 0;
+ uint32_t _ptr_TargetName;
+ TALLOC_CTX *_mem_save_TargetName_0;
++ uint32_t size_ServerChallenge_0 = 0;
++ uint32_t size_Reserved_0 = 0;
+ uint32_t _ptr_TargetInfo;
+ TALLOC_CTX *_mem_save_TargetInfo_0;
+ {
+@@ -1047,7 +1058,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_CHAL
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->Signature, 8, sizeof(uint8_t), CH_DOS));
++ size_Signature_0 = 8;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->Signature, size_Signature_0, sizeof(uint8_t), CH_DOS));
+ NDR_CHECK(ndr_pull_ntlmssp_MessageType(ndr, NDR_SCALARS, &r->MessageType));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->TargetNameLen));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->TargetNameMaxLen));
+@@ -1064,8 +1076,10 @@ _PUBLIC_ enum ndr_err_code ndr_pull_CHAL
+ ndr->flags = _flags_save_string;
+ }
+ NDR_CHECK(ndr_pull_NEGOTIATE(ndr, NDR_SCALARS, &r->NegotiateFlags));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ServerChallenge, 8));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Reserved, 8));
++ size_ServerChallenge_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ServerChallenge, size_ServerChallenge_0));
++ size_Reserved_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Reserved, size_Reserved_0));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->TargetInfoLen));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->TargetNameInfoMaxLen));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_TargetInfo));
+@@ -1176,12 +1190,14 @@ _PUBLIC_ enum ndr_err_code ndr_push_LM_R
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_LM_RESPONSE(struct ndr_pull *ndr, int ndr_flags, struct LM_RESPONSE *r)
+ {
++ uint32_t size_Response_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, 24));
++ size_Response_0 = 24;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, size_Response_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 1));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -1224,13 +1240,17 @@ _PUBLIC_ enum ndr_err_code ndr_push_LMv2
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_LMv2_RESPONSE(struct ndr_pull *ndr, int ndr_flags, struct LMv2_RESPONSE *r)
+ {
++ uint32_t size_Response_0 = 0;
++ uint32_t size_ChallengeFromClient_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, 16));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ChallengeFromClient, 8));
++ size_Response_0 = 16;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, size_Response_0));
++ size_ChallengeFromClient_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ChallengeFromClient, size_ChallengeFromClient_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 1));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -1347,12 +1367,14 @@ _PUBLIC_ enum ndr_err_code ndr_push_NTLM
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_NTLM_RESPONSE(struct ndr_pull *ndr, int ndr_flags, struct NTLM_RESPONSE *r)
+ {
++ uint32_t size_Response_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, 24));
++ size_Response_0 = 24;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, size_Response_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 1));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -1416,6 +1438,7 @@ static enum ndr_err_code ndr_push_NTLMv2
+
+ static enum ndr_err_code ndr_pull_NTLMv2_CLIENT_CHALLENGE(struct ndr_pull *ndr, int ndr_flags, struct NTLMv2_CLIENT_CHALLENGE *r)
+ {
++ uint32_t size_ChallengeFromClient_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+@@ -1426,7 +1449,8 @@ static enum ndr_err_code ndr_pull_NTLMv2
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->Reserved1));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->Reserved2));
+ NDR_CHECK(ndr_pull_NTTIME(ndr, NDR_SCALARS, &r->TimeStamp));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ChallengeFromClient, 8));
++ size_ChallengeFromClient_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->ChallengeFromClient, size_ChallengeFromClient_0));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->Reserved3));
+ {
+ uint32_t _flags_save_AV_PAIR_LIST = ndr->flags;
+@@ -1494,12 +1518,14 @@ _PUBLIC_ enum ndr_err_code ndr_push_NTLM
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_NTLMv2_RESPONSE(struct ndr_pull *ndr, int ndr_flags, struct NTLMv2_RESPONSE *r)
+ {
++ uint32_t size_Response_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, 16));
++ size_Response_0 = 16;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Response, size_Response_0));
+ NDR_CHECK(ndr_pull_NTLMv2_CLIENT_CHALLENGE(ndr, NDR_SCALARS, &r->Challenge));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
+ }
+@@ -1753,6 +1779,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_AUTH
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_AUTHENTICATE_MESSAGE(struct ndr_pull *ndr, int ndr_flags, struct AUTHENTICATE_MESSAGE *r)
+ {
++ uint32_t size_Signature_0 = 0;
+ uint32_t _ptr_LmChallengeResponse;
+ TALLOC_CTX *_mem_save_LmChallengeResponse_0;
+ uint32_t _ptr_NtChallengeResponse;
+@@ -1770,7 +1797,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_AUTH
+ ndr_set_flags(&ndr->flags, LIBNDR_FLAG_REMAINING);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->Signature, 8, sizeof(uint8_t), CH_DOS));
++ size_Signature_0 = 8;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->Signature, size_Signature_0, sizeof(uint8_t), CH_DOS));
+ NDR_CHECK(ndr_pull_ntlmssp_MessageType(ndr, NDR_SCALARS, &r->MessageType));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->LmChallengeResponseLen));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->LmChallengeResponseMaxLen));
+@@ -2090,13 +2118,15 @@ _PUBLIC_ enum ndr_err_code ndr_push_NTLM
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_NTLMSSP_MESSAGE_SIGNATURE_NTLMv2(struct ndr_pull *ndr, int ndr_flags, struct NTLMSSP_MESSAGE_SIGNATURE_NTLMv2 *r)
+ {
++ uint32_t size_Checksum_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->Version));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Checksum, 8));
++ size_Checksum_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Checksum, size_Checksum_0));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->SeqNum));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
+ }
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_drsuapi.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_drsuapi.c
+@@ -468,6 +468,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_drsu
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_drsuapi_DsReplicaObjectIdentifier(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaObjectIdentifier *r)
+ {
++ uint32_t size_dn_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dn));
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+@@ -476,7 +477,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_drsu
+ NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->guid));
+ NDR_CHECK(ndr_pull_dom_sid28(ndr, NDR_SCALARS, &r->sid));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__ndr_size_dn));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dn, ndr_get_array_size(ndr, &r->dn), sizeof(uint16_t), CH_UTF16));
++ size_dn_0 = ndr_get_array_size(ndr, &r->dn);
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dn, size_dn_0, sizeof(uint16_t), CH_UTF16));
+ if (r->dn) {
+ NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->dn, r->__ndr_size_dn + 1));
+ }
+@@ -826,6 +828,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaCursorCtrEx(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaCursorCtrEx *r)
+ {
++ uint32_t size_cursors_0 = 0;
+ uint32_t cntr_cursors_0;
+ TALLOC_CTX *_mem_save_cursors_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -838,10 +841,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved2));
+- NDR_PULL_ALLOC_N(ndr, r->cursors, ndr_get_array_size(ndr, &r->cursors));
++ size_cursors_0 = ndr_get_array_size(ndr, &r->cursors);
++ NDR_PULL_ALLOC_N(ndr, r->cursors, size_cursors_0);
+ _mem_save_cursors_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->cursors, 0);
+- for (cntr_cursors_0 = 0; cntr_cursors_0 < r->count; cntr_cursors_0++) {
++ for (cntr_cursors_0 = 0; cntr_cursors_0 < size_cursors_0; cntr_cursors_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaCursor(ndr, NDR_SCALARS, &r->cursors[cntr_cursors_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cursors_0, 0);
+@@ -1193,6 +1197,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_drsu
+ _PUBLIC_ enum ndr_err_code ndr_pull_drsuapi_DsReplicaOIDMapping_Ctr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaOIDMapping_Ctr *r)
+ {
+ uint32_t _ptr_mappings;
++ uint32_t size_mappings_1 = 0;
+ uint32_t cntr_mappings_1;
+ TALLOC_CTX *_mem_save_mappings_0;
+ TALLOC_CTX *_mem_save_mappings_1;
+@@ -1215,13 +1220,14 @@ _PUBLIC_ enum ndr_err_code ndr_pull_drsu
+ _mem_save_mappings_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->mappings, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->mappings));
+- NDR_PULL_ALLOC_N(ndr, r->mappings, ndr_get_array_size(ndr, &r->mappings));
++ size_mappings_1 = ndr_get_array_size(ndr, &r->mappings);
++ NDR_PULL_ALLOC_N(ndr, r->mappings, size_mappings_1);
+ _mem_save_mappings_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->mappings, 0);
+- for (cntr_mappings_1 = 0; cntr_mappings_1 < r->num_mappings; cntr_mappings_1++) {
++ for (cntr_mappings_1 = 0; cntr_mappings_1 < size_mappings_1; cntr_mappings_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaOIDMapping(ndr, NDR_SCALARS, &r->mappings[cntr_mappings_1]));
+ }
+- for (cntr_mappings_1 = 0; cntr_mappings_1 < r->num_mappings; cntr_mappings_1++) {
++ for (cntr_mappings_1 = 0; cntr_mappings_1 < size_mappings_1; cntr_mappings_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaOIDMapping(ndr, NDR_BUFFERS, &r->mappings[cntr_mappings_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_mappings_1, 0);
+@@ -1386,6 +1392,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsPartialAttributeSet(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsPartialAttributeSet *r)
+ {
++ uint32_t size_attids_0 = 0;
+ uint32_t cntr_attids_0;
+ TALLOC_CTX *_mem_save_attids_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -1397,10 +1404,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ if (r->num_attids < 1 || r->num_attids > 0x100000) {
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+- NDR_PULL_ALLOC_N(ndr, r->attids, ndr_get_array_size(ndr, &r->attids));
++ size_attids_0 = ndr_get_array_size(ndr, &r->attids);
++ NDR_PULL_ALLOC_N(ndr, r->attids, size_attids_0);
+ _mem_save_attids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->attids, 0);
+- for (cntr_attids_0 = 0; cntr_attids_0 < r->num_attids; cntr_attids_0++) {
++ for (cntr_attids_0 = 0; cntr_attids_0 < size_attids_0; cntr_attids_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsAttributeId(ndr, NDR_SCALARS, &r->attids[cntr_attids_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_attids_0, 0);
+@@ -1917,6 +1925,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaCursor2CtrEx(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaCursor2CtrEx *r)
+ {
++ uint32_t size_cursors_0 = 0;
+ uint32_t cntr_cursors_0;
+ TALLOC_CTX *_mem_save_cursors_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -1929,10 +1938,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved2));
+- NDR_PULL_ALLOC_N(ndr, r->cursors, ndr_get_array_size(ndr, &r->cursors));
++ size_cursors_0 = ndr_get_array_size(ndr, &r->cursors);
++ NDR_PULL_ALLOC_N(ndr, r->cursors, size_cursors_0);
+ _mem_save_cursors_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->cursors, 0);
+- for (cntr_cursors_0 = 0; cntr_cursors_0 < r->count; cntr_cursors_0++) {
++ for (cntr_cursors_0 = 0; cntr_cursors_0 < size_cursors_0; cntr_cursors_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaCursor2(ndr, NDR_SCALARS, &r->cursors[cntr_cursors_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cursors_0, 0);
+@@ -2053,6 +2063,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsAttributeValueCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsAttributeValueCtr *r)
+ {
+ uint32_t _ptr_values;
++ uint32_t size_values_1 = 0;
+ uint32_t cntr_values_1;
+ TALLOC_CTX *_mem_save_values_0;
+ TALLOC_CTX *_mem_save_values_1;
+@@ -2075,13 +2086,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_values_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->values, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->values));
+- NDR_PULL_ALLOC_N(ndr, r->values, ndr_get_array_size(ndr, &r->values));
++ size_values_1 = ndr_get_array_size(ndr, &r->values);
++ NDR_PULL_ALLOC_N(ndr, r->values, size_values_1);
+ _mem_save_values_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->values, 0);
+- for (cntr_values_1 = 0; cntr_values_1 < r->num_values; cntr_values_1++) {
++ for (cntr_values_1 = 0; cntr_values_1 < size_values_1; cntr_values_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsAttributeValue(ndr, NDR_SCALARS, &r->values[cntr_values_1]));
+ }
+- for (cntr_values_1 = 0; cntr_values_1 < r->num_values; cntr_values_1++) {
++ for (cntr_values_1 = 0; cntr_values_1 < size_values_1; cntr_values_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsAttributeValue(ndr, NDR_BUFFERS, &r->values[cntr_values_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_values_1, 0);
+@@ -2138,6 +2150,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_drsu
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_drsuapi_DsReplicaObjectIdentifier3(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaObjectIdentifier3 *r)
+ {
++ uint32_t size_dn_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__ndr_size));
+@@ -2145,7 +2158,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_drsu
+ NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->guid));
+ NDR_CHECK(ndr_pull_dom_sid28(ndr, NDR_SCALARS, &r->sid));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__ndr_size_dn));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dn, r->__ndr_size_dn + 1, sizeof(uint16_t), CH_UTF16));
++ size_dn_0 = r->__ndr_size_dn + 1;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dn, size_dn_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -2199,6 +2213,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_drsu
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_drsuapi_DsReplicaObjectIdentifier3Binary(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaObjectIdentifier3Binary *r)
+ {
++ uint32_t size_dn_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__ndr_size));
+@@ -2206,7 +2221,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_drsu
+ NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->guid));
+ NDR_CHECK(ndr_pull_dom_sid28(ndr, NDR_SCALARS, &r->sid));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__ndr_size_dn));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dn, r->__ndr_size_dn + 1, sizeof(uint16_t), CH_UTF16));
++ size_dn_0 = r->__ndr_size_dn + 1;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dn, size_dn_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__ndr_size_binary));
+ {
+ uint32_t _flags_save_DATA_BLOB = ndr->flags;
+@@ -2300,6 +2316,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaAttributeCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaAttributeCtr *r)
+ {
+ uint32_t _ptr_attributes;
++ uint32_t size_attributes_1 = 0;
+ uint32_t cntr_attributes_1;
+ TALLOC_CTX *_mem_save_attributes_0;
+ TALLOC_CTX *_mem_save_attributes_1;
+@@ -2322,13 +2339,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_attributes_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->attributes, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->attributes));
+- NDR_PULL_ALLOC_N(ndr, r->attributes, ndr_get_array_size(ndr, &r->attributes));
++ size_attributes_1 = ndr_get_array_size(ndr, &r->attributes);
++ NDR_PULL_ALLOC_N(ndr, r->attributes, size_attributes_1);
+ _mem_save_attributes_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->attributes, 0);
+- for (cntr_attributes_1 = 0; cntr_attributes_1 < r->num_attributes; cntr_attributes_1++) {
++ for (cntr_attributes_1 = 0; cntr_attributes_1 < size_attributes_1; cntr_attributes_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAttribute(ndr, NDR_SCALARS, &r->attributes[cntr_attributes_1]));
+ }
+- for (cntr_attributes_1 = 0; cntr_attributes_1 < r->num_attributes; cntr_attributes_1++) {
++ for (cntr_attributes_1 = 0; cntr_attributes_1 < size_attributes_1; cntr_attributes_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAttribute(ndr, NDR_BUFFERS, &r->attributes[cntr_attributes_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_attributes_1, 0);
+@@ -2510,6 +2528,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_drsu
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_drsuapi_DsReplicaMetaDataCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaMetaDataCtr *r)
+ {
++ uint32_t size_meta_data_0 = 0;
+ uint32_t cntr_meta_data_0;
+ TALLOC_CTX *_mem_save_meta_data_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -2519,10 +2538,11 @@ _PUBLIC_ enum ndr_err_code ndr_pull_drsu
+ if (r->count > 1048576) {
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+- NDR_PULL_ALLOC_N(ndr, r->meta_data, ndr_get_array_size(ndr, &r->meta_data));
++ size_meta_data_0 = ndr_get_array_size(ndr, &r->meta_data);
++ NDR_PULL_ALLOC_N(ndr, r->meta_data, size_meta_data_0);
+ _mem_save_meta_data_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->meta_data, 0);
+- for (cntr_meta_data_0 = 0; cntr_meta_data_0 < r->count; cntr_meta_data_0++) {
++ for (cntr_meta_data_0 = 0; cntr_meta_data_0 < size_meta_data_0; cntr_meta_data_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaMetaData(ndr, NDR_SCALARS, &r->meta_data[cntr_meta_data_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_meta_data_0, 0);
+@@ -2921,6 +2941,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_drsu
+ uint32_t _ptr_first_object;
+ TALLOC_CTX *_mem_save_first_object_0;
+ uint32_t _ptr_linked_attributes;
++ uint32_t size_linked_attributes_1 = 0;
+ uint32_t cntr_linked_attributes_1;
+ TALLOC_CTX *_mem_save_linked_attributes_0;
+ TALLOC_CTX *_mem_save_linked_attributes_1;
+@@ -2992,13 +3013,14 @@ _PUBLIC_ enum ndr_err_code ndr_pull_drsu
+ _mem_save_linked_attributes_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->linked_attributes, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->linked_attributes));
+- NDR_PULL_ALLOC_N(ndr, r->linked_attributes, ndr_get_array_size(ndr, &r->linked_attributes));
++ size_linked_attributes_1 = ndr_get_array_size(ndr, &r->linked_attributes);
++ NDR_PULL_ALLOC_N(ndr, r->linked_attributes, size_linked_attributes_1);
+ _mem_save_linked_attributes_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->linked_attributes, 0);
+- for (cntr_linked_attributes_1 = 0; cntr_linked_attributes_1 < r->linked_attributes_count; cntr_linked_attributes_1++) {
++ for (cntr_linked_attributes_1 = 0; cntr_linked_attributes_1 < size_linked_attributes_1; cntr_linked_attributes_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaLinkedAttribute(ndr, NDR_SCALARS, &r->linked_attributes[cntr_linked_attributes_1]));
+ }
+- for (cntr_linked_attributes_1 = 0; cntr_linked_attributes_1 < r->linked_attributes_count; cntr_linked_attributes_1++) {
++ for (cntr_linked_attributes_1 = 0; cntr_linked_attributes_1 < size_linked_attributes_1; cntr_linked_attributes_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaLinkedAttribute(ndr, NDR_BUFFERS, &r->linked_attributes[cntr_linked_attributes_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_linked_attributes_1, 0);
+@@ -3810,6 +3832,8 @@ static enum ndr_err_code ndr_pull_drsuap
+ uint32_t _ptr_naming_context;
+ TALLOC_CTX *_mem_save_naming_context_0;
+ uint32_t _ptr_dest_dsa_dns_name;
++ uint32_t size_dest_dsa_dns_name_1 = 0;
++ uint32_t length_dest_dsa_dns_name_1 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_naming_context));
+@@ -3835,11 +3859,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_naming_context_0, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dest_dsa_dns_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dest_dsa_dns_name));
+- if (ndr_get_array_length(ndr, &r->dest_dsa_dns_name) > ndr_get_array_size(ndr, &r->dest_dsa_dns_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dest_dsa_dns_name), ndr_get_array_length(ndr, &r->dest_dsa_dns_name));
++ size_dest_dsa_dns_name_1 = ndr_get_array_size(ndr, &r->dest_dsa_dns_name);
++ length_dest_dsa_dns_name_1 = ndr_get_array_length(ndr, &r->dest_dsa_dns_name);
++ if (length_dest_dsa_dns_name_1 > size_dest_dsa_dns_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dest_dsa_dns_name_1, length_dest_dsa_dns_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dest_dsa_dns_name), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dest_dsa_dns_name, ndr_get_array_length(ndr, &r->dest_dsa_dns_name), sizeof(uint8_t), CH_DOS));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dest_dsa_dns_name_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dest_dsa_dns_name, length_dest_dsa_dns_name_1, sizeof(uint8_t), CH_DOS));
+ }
+ return NDR_ERR_SUCCESS;
+ }
+@@ -3991,7 +4017,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ uint32_t _ptr_naming_context;
+ TALLOC_CTX *_mem_save_naming_context_0;
+ uint32_t _ptr_source_dsa_address;
++ uint32_t size_source_dsa_address_1 = 0;
++ uint32_t length_source_dsa_address_1 = 0;
+ TALLOC_CTX *_mem_save_source_dsa_address_0;
++ uint32_t size_schedule_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_naming_context));
+@@ -4006,7 +4035,8 @@ static enum ndr_err_code ndr_pull_drsuap
+ } else {
+ r->source_dsa_address = NULL;
+ }
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->schedule, 84));
++ size_schedule_0 = 84;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->schedule, size_schedule_0));
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAddOptions(ndr, NDR_SCALARS, &r->options));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+@@ -4020,11 +4050,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->source_dsa_address, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->source_dsa_address));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->source_dsa_address));
+- if (ndr_get_array_length(ndr, &r->source_dsa_address) > ndr_get_array_size(ndr, &r->source_dsa_address)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->source_dsa_address), ndr_get_array_length(ndr, &r->source_dsa_address));
++ size_source_dsa_address_1 = ndr_get_array_size(ndr, &r->source_dsa_address);
++ length_source_dsa_address_1 = ndr_get_array_length(ndr, &r->source_dsa_address);
++ if (length_source_dsa_address_1 > size_source_dsa_address_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_source_dsa_address_1, length_source_dsa_address_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_source_dsa_address_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, length_source_dsa_address_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_source_dsa_address_0, 0);
+ }
+ }
+@@ -4092,7 +4124,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ uint32_t _ptr_transport_dn;
+ TALLOC_CTX *_mem_save_transport_dn_0;
+ uint32_t _ptr_source_dsa_address;
++ uint32_t size_source_dsa_address_1 = 0;
++ uint32_t length_source_dsa_address_1 = 0;
+ TALLOC_CTX *_mem_save_source_dsa_address_0;
++ uint32_t size_schedule_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_naming_context));
+@@ -4119,7 +4154,8 @@ static enum ndr_err_code ndr_pull_drsuap
+ } else {
+ r->source_dsa_address = NULL;
+ }
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->schedule, 84));
++ size_schedule_0 = 84;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->schedule, size_schedule_0));
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAddOptions(ndr, NDR_SCALARS, &r->options));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+@@ -4145,11 +4181,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->source_dsa_address, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->source_dsa_address));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->source_dsa_address));
+- if (ndr_get_array_length(ndr, &r->source_dsa_address) > ndr_get_array_size(ndr, &r->source_dsa_address)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->source_dsa_address), ndr_get_array_length(ndr, &r->source_dsa_address));
++ size_source_dsa_address_1 = ndr_get_array_size(ndr, &r->source_dsa_address);
++ length_source_dsa_address_1 = ndr_get_array_length(ndr, &r->source_dsa_address);
++ if (length_source_dsa_address_1 > size_source_dsa_address_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_source_dsa_address_1, length_source_dsa_address_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_source_dsa_address_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, length_source_dsa_address_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_source_dsa_address_0, 0);
+ }
+ }
+@@ -4336,6 +4374,8 @@ static enum ndr_err_code ndr_pull_drsuap
+ uint32_t _ptr_naming_context;
+ TALLOC_CTX *_mem_save_naming_context_0;
+ uint32_t _ptr_source_dsa_address;
++ uint32_t size_source_dsa_address_1 = 0;
++ uint32_t length_source_dsa_address_1 = 0;
+ TALLOC_CTX *_mem_save_source_dsa_address_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4364,11 +4404,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->source_dsa_address, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->source_dsa_address));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->source_dsa_address));
+- if (ndr_get_array_length(ndr, &r->source_dsa_address) > ndr_get_array_size(ndr, &r->source_dsa_address)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->source_dsa_address), ndr_get_array_length(ndr, &r->source_dsa_address));
++ size_source_dsa_address_1 = ndr_get_array_size(ndr, &r->source_dsa_address);
++ length_source_dsa_address_1 = ndr_get_array_length(ndr, &r->source_dsa_address);
++ if (length_source_dsa_address_1 > size_source_dsa_address_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_source_dsa_address_1, length_source_dsa_address_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_source_dsa_address_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, length_source_dsa_address_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_source_dsa_address_0, 0);
+ }
+ }
+@@ -4526,7 +4568,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ uint32_t _ptr_naming_context;
+ TALLOC_CTX *_mem_save_naming_context_0;
+ uint32_t _ptr_source_dra_address;
++ uint32_t size_source_dra_address_1 = 0;
++ uint32_t length_source_dra_address_1 = 0;
+ TALLOC_CTX *_mem_save_source_dra_address_0;
++ uint32_t size_schedule_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_naming_context));
+@@ -4542,7 +4587,8 @@ static enum ndr_err_code ndr_pull_drsuap
+ } else {
+ r->source_dra_address = NULL;
+ }
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->schedule, 84));
++ size_schedule_0 = 84;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->schedule, size_schedule_0));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->replica_flags));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->modify_fields));
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaModifyOptions(ndr, NDR_SCALARS, &r->options));
+@@ -4558,11 +4604,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->source_dra_address, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->source_dra_address));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->source_dra_address));
+- if (ndr_get_array_length(ndr, &r->source_dra_address) > ndr_get_array_size(ndr, &r->source_dra_address)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->source_dra_address), ndr_get_array_length(ndr, &r->source_dra_address));
++ size_source_dra_address_1 = ndr_get_array_size(ndr, &r->source_dra_address);
++ length_source_dra_address_1 = ndr_get_array_length(ndr, &r->source_dra_address);
++ if (length_source_dra_address_1 > size_source_dra_address_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_source_dra_address_1, length_source_dra_address_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->source_dra_address), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dra_address, ndr_get_array_length(ndr, &r->source_dra_address), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_source_dra_address_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dra_address, length_source_dra_address_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_source_dra_address_0, 0);
+ }
+ }
+@@ -4749,15 +4797,18 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetMembershipsCtr1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetMembershipsCtr1 *r)
+ {
+ uint32_t _ptr_info_array;
++ uint32_t size_info_array_1 = 0;
+ uint32_t cntr_info_array_1;
+ TALLOC_CTX *_mem_save_info_array_0;
+ TALLOC_CTX *_mem_save_info_array_1;
+ TALLOC_CTX *_mem_save_info_array_2;
+ uint32_t _ptr_group_attrs;
++ uint32_t size_group_attrs_1 = 0;
+ uint32_t cntr_group_attrs_1;
+ TALLOC_CTX *_mem_save_group_attrs_0;
+ TALLOC_CTX *_mem_save_group_attrs_1;
+ uint32_t _ptr_sids;
++ uint32_t size_sids_1 = 0;
+ uint32_t cntr_sids_1;
+ TALLOC_CTX *_mem_save_sids_0;
+ TALLOC_CTX *_mem_save_sids_1;
+@@ -4798,10 +4849,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_info_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info_array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->info_array));
+- NDR_PULL_ALLOC_N(ndr, r->info_array, ndr_get_array_size(ndr, &r->info_array));
++ size_info_array_1 = ndr_get_array_size(ndr, &r->info_array);
++ NDR_PULL_ALLOC_N(ndr, r->info_array, size_info_array_1);
+ _mem_save_info_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info_array, 0);
+- for (cntr_info_array_1 = 0; cntr_info_array_1 < r->num_memberships; cntr_info_array_1++) {
++ for (cntr_info_array_1 = 0; cntr_info_array_1 < size_info_array_1; cntr_info_array_1++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info_array));
+ if (_ptr_info_array) {
+ NDR_PULL_ALLOC(ndr, r->info_array[cntr_info_array_1]);
+@@ -4809,7 +4861,7 @@ static enum ndr_err_code ndr_pull_drsuap
+ r->info_array[cntr_info_array_1] = NULL;
+ }
+ }
+- for (cntr_info_array_1 = 0; cntr_info_array_1 < r->num_memberships; cntr_info_array_1++) {
++ for (cntr_info_array_1 = 0; cntr_info_array_1 < size_info_array_1; cntr_info_array_1++) {
+ if (r->info_array[cntr_info_array_1]) {
+ _mem_save_info_array_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info_array[cntr_info_array_1], 0);
+@@ -4824,10 +4876,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_group_attrs_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->group_attrs, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->group_attrs));
+- NDR_PULL_ALLOC_N(ndr, r->group_attrs, ndr_get_array_size(ndr, &r->group_attrs));
++ size_group_attrs_1 = ndr_get_array_size(ndr, &r->group_attrs);
++ NDR_PULL_ALLOC_N(ndr, r->group_attrs, size_group_attrs_1);
+ _mem_save_group_attrs_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->group_attrs, 0);
+- for (cntr_group_attrs_1 = 0; cntr_group_attrs_1 < r->num_memberships; cntr_group_attrs_1++) {
++ for (cntr_group_attrs_1 = 0; cntr_group_attrs_1 < size_group_attrs_1; cntr_group_attrs_1++) {
+ NDR_CHECK(ndr_pull_samr_GroupAttrs(ndr, NDR_SCALARS, &r->group_attrs[cntr_group_attrs_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_group_attrs_1, 0);
+@@ -4837,10 +4890,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_sids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->sids));
+- NDR_PULL_ALLOC_N(ndr, r->sids, ndr_get_array_size(ndr, &r->sids));
++ size_sids_1 = ndr_get_array_size(ndr, &r->sids);
++ NDR_PULL_ALLOC_N(ndr, r->sids, size_sids_1);
+ _mem_save_sids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->num_sids; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sids));
+ if (_ptr_sids) {
+ NDR_PULL_ALLOC(ndr, r->sids[cntr_sids_1]);
+@@ -4848,7 +4902,7 @@ static enum ndr_err_code ndr_pull_drsuap
+ r->sids[cntr_sids_1] = NULL;
+ }
+ }
+- for (cntr_sids_1 = 0; cntr_sids_1 < r->num_sids; cntr_sids_1++) {
++ for (cntr_sids_1 = 0; cntr_sids_1 < size_sids_1; cntr_sids_1++) {
+ if (r->sids[cntr_sids_1]) {
+ _mem_save_sids_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids[cntr_sids_1], 0);
+@@ -5051,6 +5105,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetMembershipsRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetMembershipsRequest1 *r)
+ {
+ uint32_t _ptr_info_array;
++ uint32_t size_info_array_1 = 0;
+ uint32_t cntr_info_array_1;
+ TALLOC_CTX *_mem_save_info_array_0;
+ TALLOC_CTX *_mem_save_info_array_1;
+@@ -5084,10 +5139,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_info_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info_array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->info_array));
+- NDR_PULL_ALLOC_N(ndr, r->info_array, ndr_get_array_size(ndr, &r->info_array));
++ size_info_array_1 = ndr_get_array_size(ndr, &r->info_array);
++ NDR_PULL_ALLOC_N(ndr, r->info_array, size_info_array_1);
+ _mem_save_info_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info_array, 0);
+- for (cntr_info_array_1 = 0; cntr_info_array_1 < r->count; cntr_info_array_1++) {
++ for (cntr_info_array_1 = 0; cntr_info_array_1 < size_info_array_1; cntr_info_array_1++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info_array));
+ if (_ptr_info_array) {
+ NDR_PULL_ALLOC(ndr, r->info_array[cntr_info_array_1]);
+@@ -5095,7 +5151,7 @@ static enum ndr_err_code ndr_pull_drsuap
+ r->info_array[cntr_info_array_1] = NULL;
+ }
+ }
+- for (cntr_info_array_1 = 0; cntr_info_array_1 < r->count; cntr_info_array_1++) {
++ for (cntr_info_array_1 = 0; cntr_info_array_1 < size_info_array_1; cntr_info_array_1++) {
+ if (r->info_array[cntr_info_array_1]) {
+ _mem_save_info_array_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info_array[cntr_info_array_1], 0);
+@@ -5255,6 +5311,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetNT4ChangeLogRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNT4ChangeLogRequest1 *r)
+ {
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
+ TALLOC_CTX *_mem_save_data_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -5277,8 +5334,9 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_data_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
+- NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_size(ndr, &r->data)));
++ size_data_1 = ndr_get_array_size(ndr, &r->data);
++ NDR_PULL_ALLOC_N(ndr, r->data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ if (r->data) {
+@@ -5414,8 +5472,10 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetNT4ChangeLogInfo1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNT4ChangeLogInfo1 *r)
+ {
+ uint32_t _ptr_data1;
++ uint32_t size_data1_1 = 0;
+ TALLOC_CTX *_mem_save_data1_0;
+ uint32_t _ptr_data2;
++ uint32_t size_data2_1 = 0;
+ TALLOC_CTX *_mem_save_data2_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+@@ -5453,16 +5513,18 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_data1_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->data1, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data1));
+- NDR_PULL_ALLOC_N(ndr, r->data1, ndr_get_array_size(ndr, &r->data1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data1, ndr_get_array_size(ndr, &r->data1)));
++ size_data1_1 = ndr_get_array_size(ndr, &r->data1);
++ NDR_PULL_ALLOC_N(ndr, r->data1, size_data1_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data1, size_data1_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data1_0, 0);
+ }
+ if (r->data2) {
+ _mem_save_data2_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->data2, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data2));
+- NDR_PULL_ALLOC_N(ndr, r->data2, ndr_get_array_size(ndr, &r->data2));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data2, ndr_get_array_size(ndr, &r->data2)));
++ size_data2_1 = ndr_get_array_size(ndr, &r->data2);
++ NDR_PULL_ALLOC_N(ndr, r->data2, size_data2_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data2, size_data2_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data2_0, 0);
+ }
+ if (r->data1) {
+@@ -5694,6 +5756,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsNameString(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsNameString *r)
+ {
+ uint32_t _ptr_str;
++ uint32_t size_str_1 = 0;
++ uint32_t length_str_1 = 0;
+ TALLOC_CTX *_mem_save_str_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -5711,11 +5775,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->str, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->str));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->str));
+- if (ndr_get_array_length(ndr, &r->str) > ndr_get_array_size(ndr, &r->str)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->str), ndr_get_array_length(ndr, &r->str));
++ size_str_1 = ndr_get_array_size(ndr, &r->str);
++ length_str_1 = ndr_get_array_length(ndr, &r->str);
++ if (length_str_1 > size_str_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_str_1, length_str_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->str), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->str, ndr_get_array_length(ndr, &r->str), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_str_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->str, length_str_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_str_0, 0);
+ }
+ }
+@@ -5766,6 +5832,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsNameRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsNameRequest1 *r)
+ {
+ uint32_t _ptr_names;
++ uint32_t size_names_1 = 0;
+ uint32_t cntr_names_1;
+ TALLOC_CTX *_mem_save_names_0;
+ TALLOC_CTX *_mem_save_names_1;
+@@ -5793,13 +5860,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->names));
+- NDR_PULL_ALLOC_N(ndr, r->names, ndr_get_array_size(ndr, &r->names));
++ size_names_1 = ndr_get_array_size(ndr, &r->names);
++ NDR_PULL_ALLOC_N(ndr, r->names, size_names_1);
+ _mem_save_names_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->names, 0);
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsNameString(ndr, NDR_SCALARS, &r->names[cntr_names_1]));
+ }
+- for (cntr_names_1 = 0; cntr_names_1 < r->count; cntr_names_1++) {
++ for (cntr_names_1 = 0; cntr_names_1 < size_names_1; cntr_names_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsNameString(ndr, NDR_BUFFERS, &r->names[cntr_names_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_1, 0);
+@@ -5947,8 +6015,12 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsNameInfo1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsNameInfo1 *r)
+ {
+ uint32_t _ptr_dns_domain_name;
++ uint32_t size_dns_domain_name_1 = 0;
++ uint32_t length_dns_domain_name_1 = 0;
+ TALLOC_CTX *_mem_save_dns_domain_name_0;
+ uint32_t _ptr_result_name;
++ uint32_t size_result_name_1 = 0;
++ uint32_t length_result_name_1 = 0;
+ TALLOC_CTX *_mem_save_result_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -5973,11 +6045,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->dns_domain_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dns_domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dns_domain_name));
+- if (ndr_get_array_length(ndr, &r->dns_domain_name) > ndr_get_array_size(ndr, &r->dns_domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dns_domain_name), ndr_get_array_length(ndr, &r->dns_domain_name));
++ size_dns_domain_name_1 = ndr_get_array_size(ndr, &r->dns_domain_name);
++ length_dns_domain_name_1 = ndr_get_array_length(ndr, &r->dns_domain_name);
++ if (length_dns_domain_name_1 > size_dns_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dns_domain_name_1, length_dns_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dns_domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_domain_name, ndr_get_array_length(ndr, &r->dns_domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dns_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_domain_name, length_dns_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dns_domain_name_0, 0);
+ }
+ if (r->result_name) {
+@@ -5985,11 +6059,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->result_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->result_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->result_name));
+- if (ndr_get_array_length(ndr, &r->result_name) > ndr_get_array_size(ndr, &r->result_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->result_name), ndr_get_array_length(ndr, &r->result_name));
++ size_result_name_1 = ndr_get_array_size(ndr, &r->result_name);
++ length_result_name_1 = ndr_get_array_length(ndr, &r->result_name);
++ if (length_result_name_1 > size_result_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_result_name_1, length_result_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->result_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->result_name, ndr_get_array_length(ndr, &r->result_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_result_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->result_name, length_result_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_result_name_0, 0);
+ }
+ }
+@@ -6042,6 +6118,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsNameCtr1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsNameCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -6061,13 +6138,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsNameInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsNameInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -6140,6 +6218,7 @@ static enum ndr_err_code ndr_pull_drsuap
+ int level;
+ int32_t _level;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_int32(ndr, NDR_SCALARS, &_level));
+@@ -6149,7 +6228,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -6261,8 +6339,11 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsWriteAccountSpnRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsWriteAccountSpnRequest1 *r)
+ {
+ uint32_t _ptr_object_dn;
++ uint32_t size_object_dn_1 = 0;
++ uint32_t length_object_dn_1 = 0;
+ TALLOC_CTX *_mem_save_object_dn_0;
+ uint32_t _ptr_spn_names;
++ uint32_t size_spn_names_1 = 0;
+ uint32_t cntr_spn_names_1;
+ TALLOC_CTX *_mem_save_spn_names_0;
+ TALLOC_CTX *_mem_save_spn_names_1;
+@@ -6294,24 +6375,27 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->object_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->object_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->object_dn));
+- if (ndr_get_array_length(ndr, &r->object_dn) > ndr_get_array_size(ndr, &r->object_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->object_dn), ndr_get_array_length(ndr, &r->object_dn));
++ size_object_dn_1 = ndr_get_array_size(ndr, &r->object_dn);
++ length_object_dn_1 = ndr_get_array_length(ndr, &r->object_dn);
++ if (length_object_dn_1 > size_object_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_object_dn_1, length_object_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_object_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, length_object_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_object_dn_0, 0);
+ }
+ if (r->spn_names) {
+ _mem_save_spn_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->spn_names, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->spn_names));
+- NDR_PULL_ALLOC_N(ndr, r->spn_names, ndr_get_array_size(ndr, &r->spn_names));
++ size_spn_names_1 = ndr_get_array_size(ndr, &r->spn_names);
++ NDR_PULL_ALLOC_N(ndr, r->spn_names, size_spn_names_1);
+ _mem_save_spn_names_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->spn_names, 0);
+- for (cntr_spn_names_1 = 0; cntr_spn_names_1 < r->count; cntr_spn_names_1++) {
++ for (cntr_spn_names_1 = 0; cntr_spn_names_1 < size_spn_names_1; cntr_spn_names_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsNameString(ndr, NDR_SCALARS, &r->spn_names[cntr_spn_names_1]));
+ }
+- for (cntr_spn_names_1 = 0; cntr_spn_names_1 < r->count; cntr_spn_names_1++) {
++ for (cntr_spn_names_1 = 0; cntr_spn_names_1 < size_spn_names_1; cntr_spn_names_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsNameString(ndr, NDR_BUFFERS, &r->spn_names[cntr_spn_names_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_spn_names_1, 0);
+@@ -6569,8 +6653,12 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsRemoveDSServerRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsRemoveDSServerRequest1 *r)
+ {
+ uint32_t _ptr_server_dn;
++ uint32_t size_server_dn_1 = 0;
++ uint32_t length_server_dn_1 = 0;
+ TALLOC_CTX *_mem_save_server_dn_0;
+ uint32_t _ptr_domain_dn;
++ uint32_t size_domain_dn_1 = 0;
++ uint32_t length_domain_dn_1 = 0;
+ TALLOC_CTX *_mem_save_domain_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -6595,11 +6683,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_dn));
+- if (ndr_get_array_length(ndr, &r->server_dn) > ndr_get_array_size(ndr, &r->server_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_dn), ndr_get_array_length(ndr, &r->server_dn));
++ size_server_dn_1 = ndr_get_array_size(ndr, &r->server_dn);
++ length_server_dn_1 = ndr_get_array_length(ndr, &r->server_dn);
++ if (length_server_dn_1 > size_server_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_dn_1, length_server_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, length_server_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_dn_0, 0);
+ }
+ if (r->domain_dn) {
+@@ -6607,11 +6697,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain_dn));
+- if (ndr_get_array_length(ndr, &r->domain_dn) > ndr_get_array_size(ndr, &r->domain_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain_dn), ndr_get_array_length(ndr, &r->domain_dn));
++ size_domain_dn_1 = ndr_get_array_size(ndr, &r->domain_dn);
++ length_domain_dn_1 = ndr_get_array_length(ndr, &r->domain_dn);
++ if (length_domain_dn_1 > size_domain_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_dn_1, length_domain_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_dn, ndr_get_array_length(ndr, &r->domain_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_dn, length_domain_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_dn_0, 0);
+ }
+ }
+@@ -6844,6 +6936,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCInfoRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCInfoRequest1 *r)
+ {
+ uint32_t _ptr_domain_name;
++ uint32_t size_domain_name_1 = 0;
++ uint32_t length_domain_name_1 = 0;
+ TALLOC_CTX *_mem_save_domain_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -6862,11 +6956,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain_name));
+- if (ndr_get_array_length(ndr, &r->domain_name) > ndr_get_array_size(ndr, &r->domain_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain_name), ndr_get_array_length(ndr, &r->domain_name));
++ size_domain_name_1 = ndr_get_array_size(ndr, &r->domain_name);
++ length_domain_name_1 = ndr_get_array_length(ndr, &r->domain_name);
++ if (length_domain_name_1 > size_domain_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_name_1, length_domain_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, ndr_get_array_length(ndr, &r->domain_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain_name, length_domain_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_name_0, 0);
+ }
+ }
+@@ -7015,14 +7111,24 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCInfo1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCInfo1 *r)
+ {
+ uint32_t _ptr_netbios_name;
++ uint32_t size_netbios_name_1 = 0;
++ uint32_t length_netbios_name_1 = 0;
+ TALLOC_CTX *_mem_save_netbios_name_0;
+ uint32_t _ptr_dns_name;
++ uint32_t size_dns_name_1 = 0;
++ uint32_t length_dns_name_1 = 0;
+ TALLOC_CTX *_mem_save_dns_name_0;
+ uint32_t _ptr_site_name;
++ uint32_t size_site_name_1 = 0;
++ uint32_t length_site_name_1 = 0;
+ TALLOC_CTX *_mem_save_site_name_0;
+ uint32_t _ptr_computer_dn;
++ uint32_t size_computer_dn_1 = 0;
++ uint32_t length_computer_dn_1 = 0;
+ TALLOC_CTX *_mem_save_computer_dn_0;
+ uint32_t _ptr_server_dn;
++ uint32_t size_server_dn_1 = 0;
++ uint32_t length_server_dn_1 = 0;
+ TALLOC_CTX *_mem_save_server_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -7066,11 +7172,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->netbios_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->netbios_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->netbios_name));
+- if (ndr_get_array_length(ndr, &r->netbios_name) > ndr_get_array_size(ndr, &r->netbios_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->netbios_name), ndr_get_array_length(ndr, &r->netbios_name));
++ size_netbios_name_1 = ndr_get_array_size(ndr, &r->netbios_name);
++ length_netbios_name_1 = ndr_get_array_length(ndr, &r->netbios_name);
++ if (length_netbios_name_1 > size_netbios_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_netbios_name_1, length_netbios_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->netbios_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->netbios_name, ndr_get_array_length(ndr, &r->netbios_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_netbios_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->netbios_name, length_netbios_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_netbios_name_0, 0);
+ }
+ if (r->dns_name) {
+@@ -7078,11 +7186,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->dns_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dns_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dns_name));
+- if (ndr_get_array_length(ndr, &r->dns_name) > ndr_get_array_size(ndr, &r->dns_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dns_name), ndr_get_array_length(ndr, &r->dns_name));
++ size_dns_name_1 = ndr_get_array_size(ndr, &r->dns_name);
++ length_dns_name_1 = ndr_get_array_length(ndr, &r->dns_name);
++ if (length_dns_name_1 > size_dns_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dns_name_1, length_dns_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dns_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_name, ndr_get_array_length(ndr, &r->dns_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dns_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_name, length_dns_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dns_name_0, 0);
+ }
+ if (r->site_name) {
+@@ -7090,11 +7200,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->site_name));
+- if (ndr_get_array_length(ndr, &r->site_name) > ndr_get_array_size(ndr, &r->site_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->site_name), ndr_get_array_length(ndr, &r->site_name));
++ size_site_name_1 = ndr_get_array_size(ndr, &r->site_name);
++ length_site_name_1 = ndr_get_array_length(ndr, &r->site_name);
++ if (length_site_name_1 > size_site_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_site_name_1, length_site_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->site_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_name, ndr_get_array_length(ndr, &r->site_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_site_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_name, length_site_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_site_name_0, 0);
+ }
+ if (r->computer_dn) {
+@@ -7102,11 +7214,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->computer_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->computer_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->computer_dn));
+- if (ndr_get_array_length(ndr, &r->computer_dn) > ndr_get_array_size(ndr, &r->computer_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->computer_dn), ndr_get_array_length(ndr, &r->computer_dn));
++ size_computer_dn_1 = ndr_get_array_size(ndr, &r->computer_dn);
++ length_computer_dn_1 = ndr_get_array_length(ndr, &r->computer_dn);
++ if (length_computer_dn_1 > size_computer_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_computer_dn_1, length_computer_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->computer_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_dn, ndr_get_array_length(ndr, &r->computer_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_computer_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_dn, length_computer_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_computer_dn_0, 0);
+ }
+ if (r->server_dn) {
+@@ -7114,11 +7228,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_dn));
+- if (ndr_get_array_length(ndr, &r->server_dn) > ndr_get_array_size(ndr, &r->server_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_dn), ndr_get_array_length(ndr, &r->server_dn));
++ size_server_dn_1 = ndr_get_array_size(ndr, &r->server_dn);
++ length_server_dn_1 = ndr_get_array_length(ndr, &r->server_dn);
++ if (length_server_dn_1 > size_server_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_dn_1, length_server_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, length_server_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_dn_0, 0);
+ }
+ }
+@@ -7190,6 +7306,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCInfoCtr1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCInfoCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -7212,13 +7329,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -7325,18 +7443,32 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCInfo2(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCInfo2 *r)
+ {
+ uint32_t _ptr_netbios_name;
++ uint32_t size_netbios_name_1 = 0;
++ uint32_t length_netbios_name_1 = 0;
+ TALLOC_CTX *_mem_save_netbios_name_0;
+ uint32_t _ptr_dns_name;
++ uint32_t size_dns_name_1 = 0;
++ uint32_t length_dns_name_1 = 0;
+ TALLOC_CTX *_mem_save_dns_name_0;
+ uint32_t _ptr_site_name;
++ uint32_t size_site_name_1 = 0;
++ uint32_t length_site_name_1 = 0;
+ TALLOC_CTX *_mem_save_site_name_0;
+ uint32_t _ptr_site_dn;
++ uint32_t size_site_dn_1 = 0;
++ uint32_t length_site_dn_1 = 0;
+ TALLOC_CTX *_mem_save_site_dn_0;
+ uint32_t _ptr_computer_dn;
++ uint32_t size_computer_dn_1 = 0;
++ uint32_t length_computer_dn_1 = 0;
+ TALLOC_CTX *_mem_save_computer_dn_0;
+ uint32_t _ptr_server_dn;
++ uint32_t size_server_dn_1 = 0;
++ uint32_t length_server_dn_1 = 0;
+ TALLOC_CTX *_mem_save_server_dn_0;
+ uint32_t _ptr_ntds_dn;
++ uint32_t size_ntds_dn_1 = 0;
++ uint32_t length_ntds_dn_1 = 0;
+ TALLOC_CTX *_mem_save_ntds_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -7397,11 +7529,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->netbios_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->netbios_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->netbios_name));
+- if (ndr_get_array_length(ndr, &r->netbios_name) > ndr_get_array_size(ndr, &r->netbios_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->netbios_name), ndr_get_array_length(ndr, &r->netbios_name));
++ size_netbios_name_1 = ndr_get_array_size(ndr, &r->netbios_name);
++ length_netbios_name_1 = ndr_get_array_length(ndr, &r->netbios_name);
++ if (length_netbios_name_1 > size_netbios_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_netbios_name_1, length_netbios_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->netbios_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->netbios_name, ndr_get_array_length(ndr, &r->netbios_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_netbios_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->netbios_name, length_netbios_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_netbios_name_0, 0);
+ }
+ if (r->dns_name) {
+@@ -7409,11 +7543,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->dns_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dns_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dns_name));
+- if (ndr_get_array_length(ndr, &r->dns_name) > ndr_get_array_size(ndr, &r->dns_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dns_name), ndr_get_array_length(ndr, &r->dns_name));
++ size_dns_name_1 = ndr_get_array_size(ndr, &r->dns_name);
++ length_dns_name_1 = ndr_get_array_length(ndr, &r->dns_name);
++ if (length_dns_name_1 > size_dns_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dns_name_1, length_dns_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dns_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_name, ndr_get_array_length(ndr, &r->dns_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dns_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_name, length_dns_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dns_name_0, 0);
+ }
+ if (r->site_name) {
+@@ -7421,11 +7557,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->site_name));
+- if (ndr_get_array_length(ndr, &r->site_name) > ndr_get_array_size(ndr, &r->site_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->site_name), ndr_get_array_length(ndr, &r->site_name));
++ size_site_name_1 = ndr_get_array_size(ndr, &r->site_name);
++ length_site_name_1 = ndr_get_array_length(ndr, &r->site_name);
++ if (length_site_name_1 > size_site_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_site_name_1, length_site_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->site_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_name, ndr_get_array_length(ndr, &r->site_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_site_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_name, length_site_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_site_name_0, 0);
+ }
+ if (r->site_dn) {
+@@ -7433,11 +7571,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->site_dn));
+- if (ndr_get_array_length(ndr, &r->site_dn) > ndr_get_array_size(ndr, &r->site_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->site_dn), ndr_get_array_length(ndr, &r->site_dn));
++ size_site_dn_1 = ndr_get_array_size(ndr, &r->site_dn);
++ length_site_dn_1 = ndr_get_array_length(ndr, &r->site_dn);
++ if (length_site_dn_1 > size_site_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_site_dn_1, length_site_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->site_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_dn, ndr_get_array_length(ndr, &r->site_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_site_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_dn, length_site_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_site_dn_0, 0);
+ }
+ if (r->computer_dn) {
+@@ -7445,11 +7585,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->computer_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->computer_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->computer_dn));
+- if (ndr_get_array_length(ndr, &r->computer_dn) > ndr_get_array_size(ndr, &r->computer_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->computer_dn), ndr_get_array_length(ndr, &r->computer_dn));
++ size_computer_dn_1 = ndr_get_array_size(ndr, &r->computer_dn);
++ length_computer_dn_1 = ndr_get_array_length(ndr, &r->computer_dn);
++ if (length_computer_dn_1 > size_computer_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_computer_dn_1, length_computer_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->computer_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_dn, ndr_get_array_length(ndr, &r->computer_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_computer_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_dn, length_computer_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_computer_dn_0, 0);
+ }
+ if (r->server_dn) {
+@@ -7457,11 +7599,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_dn));
+- if (ndr_get_array_length(ndr, &r->server_dn) > ndr_get_array_size(ndr, &r->server_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_dn), ndr_get_array_length(ndr, &r->server_dn));
++ size_server_dn_1 = ndr_get_array_size(ndr, &r->server_dn);
++ length_server_dn_1 = ndr_get_array_length(ndr, &r->server_dn);
++ if (length_server_dn_1 > size_server_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_dn_1, length_server_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, length_server_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_dn_0, 0);
+ }
+ if (r->ntds_dn) {
+@@ -7469,11 +7613,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->ntds_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->ntds_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->ntds_dn));
+- if (ndr_get_array_length(ndr, &r->ntds_dn) > ndr_get_array_size(ndr, &r->ntds_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->ntds_dn), ndr_get_array_length(ndr, &r->ntds_dn));
++ size_ntds_dn_1 = ndr_get_array_size(ndr, &r->ntds_dn);
++ length_ntds_dn_1 = ndr_get_array_length(ndr, &r->ntds_dn);
++ if (length_ntds_dn_1 > size_ntds_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_ntds_dn_1, length_ntds_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->ntds_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->ntds_dn, ndr_get_array_length(ndr, &r->ntds_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_ntds_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->ntds_dn, length_ntds_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ntds_dn_0, 0);
+ }
+ }
+@@ -7562,6 +7708,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCInfoCtr2(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCInfoCtr2 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -7584,13 +7731,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCInfo2(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCInfo2(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -7698,18 +7846,32 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCInfo3(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCInfo3 *r)
+ {
+ uint32_t _ptr_netbios_name;
++ uint32_t size_netbios_name_1 = 0;
++ uint32_t length_netbios_name_1 = 0;
+ TALLOC_CTX *_mem_save_netbios_name_0;
+ uint32_t _ptr_dns_name;
++ uint32_t size_dns_name_1 = 0;
++ uint32_t length_dns_name_1 = 0;
+ TALLOC_CTX *_mem_save_dns_name_0;
+ uint32_t _ptr_site_name;
++ uint32_t size_site_name_1 = 0;
++ uint32_t length_site_name_1 = 0;
+ TALLOC_CTX *_mem_save_site_name_0;
+ uint32_t _ptr_site_dn;
++ uint32_t size_site_dn_1 = 0;
++ uint32_t length_site_dn_1 = 0;
+ TALLOC_CTX *_mem_save_site_dn_0;
+ uint32_t _ptr_computer_dn;
++ uint32_t size_computer_dn_1 = 0;
++ uint32_t length_computer_dn_1 = 0;
+ TALLOC_CTX *_mem_save_computer_dn_0;
+ uint32_t _ptr_server_dn;
++ uint32_t size_server_dn_1 = 0;
++ uint32_t length_server_dn_1 = 0;
+ TALLOC_CTX *_mem_save_server_dn_0;
+ uint32_t _ptr_ntds_dn;
++ uint32_t size_ntds_dn_1 = 0;
++ uint32_t length_ntds_dn_1 = 0;
+ TALLOC_CTX *_mem_save_ntds_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -7771,11 +7933,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->netbios_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->netbios_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->netbios_name));
+- if (ndr_get_array_length(ndr, &r->netbios_name) > ndr_get_array_size(ndr, &r->netbios_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->netbios_name), ndr_get_array_length(ndr, &r->netbios_name));
++ size_netbios_name_1 = ndr_get_array_size(ndr, &r->netbios_name);
++ length_netbios_name_1 = ndr_get_array_length(ndr, &r->netbios_name);
++ if (length_netbios_name_1 > size_netbios_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_netbios_name_1, length_netbios_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->netbios_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->netbios_name, ndr_get_array_length(ndr, &r->netbios_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_netbios_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->netbios_name, length_netbios_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_netbios_name_0, 0);
+ }
+ if (r->dns_name) {
+@@ -7783,11 +7947,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->dns_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dns_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dns_name));
+- if (ndr_get_array_length(ndr, &r->dns_name) > ndr_get_array_size(ndr, &r->dns_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dns_name), ndr_get_array_length(ndr, &r->dns_name));
++ size_dns_name_1 = ndr_get_array_size(ndr, &r->dns_name);
++ length_dns_name_1 = ndr_get_array_length(ndr, &r->dns_name);
++ if (length_dns_name_1 > size_dns_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dns_name_1, length_dns_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dns_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_name, ndr_get_array_length(ndr, &r->dns_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dns_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dns_name, length_dns_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dns_name_0, 0);
+ }
+ if (r->site_name) {
+@@ -7795,11 +7961,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->site_name));
+- if (ndr_get_array_length(ndr, &r->site_name) > ndr_get_array_size(ndr, &r->site_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->site_name), ndr_get_array_length(ndr, &r->site_name));
++ size_site_name_1 = ndr_get_array_size(ndr, &r->site_name);
++ length_site_name_1 = ndr_get_array_length(ndr, &r->site_name);
++ if (length_site_name_1 > size_site_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_site_name_1, length_site_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->site_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_name, ndr_get_array_length(ndr, &r->site_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_site_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_name, length_site_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_site_name_0, 0);
+ }
+ if (r->site_dn) {
+@@ -7807,11 +7975,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->site_dn));
+- if (ndr_get_array_length(ndr, &r->site_dn) > ndr_get_array_size(ndr, &r->site_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->site_dn), ndr_get_array_length(ndr, &r->site_dn));
++ size_site_dn_1 = ndr_get_array_size(ndr, &r->site_dn);
++ length_site_dn_1 = ndr_get_array_length(ndr, &r->site_dn);
++ if (length_site_dn_1 > size_site_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_site_dn_1, length_site_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->site_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_dn, ndr_get_array_length(ndr, &r->site_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_site_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_dn, length_site_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_site_dn_0, 0);
+ }
+ if (r->computer_dn) {
+@@ -7819,11 +7989,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->computer_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->computer_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->computer_dn));
+- if (ndr_get_array_length(ndr, &r->computer_dn) > ndr_get_array_size(ndr, &r->computer_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->computer_dn), ndr_get_array_length(ndr, &r->computer_dn));
++ size_computer_dn_1 = ndr_get_array_size(ndr, &r->computer_dn);
++ length_computer_dn_1 = ndr_get_array_length(ndr, &r->computer_dn);
++ if (length_computer_dn_1 > size_computer_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_computer_dn_1, length_computer_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->computer_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_dn, ndr_get_array_length(ndr, &r->computer_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_computer_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_dn, length_computer_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_computer_dn_0, 0);
+ }
+ if (r->server_dn) {
+@@ -7831,11 +8003,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_dn));
+- if (ndr_get_array_length(ndr, &r->server_dn) > ndr_get_array_size(ndr, &r->server_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_dn), ndr_get_array_length(ndr, &r->server_dn));
++ size_server_dn_1 = ndr_get_array_size(ndr, &r->server_dn);
++ length_server_dn_1 = ndr_get_array_length(ndr, &r->server_dn);
++ if (length_server_dn_1 > size_server_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_dn_1, length_server_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, ndr_get_array_length(ndr, &r->server_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_dn, length_server_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_dn_0, 0);
+ }
+ if (r->ntds_dn) {
+@@ -7843,11 +8017,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->ntds_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->ntds_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->ntds_dn));
+- if (ndr_get_array_length(ndr, &r->ntds_dn) > ndr_get_array_size(ndr, &r->ntds_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->ntds_dn), ndr_get_array_length(ndr, &r->ntds_dn));
++ size_ntds_dn_1 = ndr_get_array_size(ndr, &r->ntds_dn);
++ length_ntds_dn_1 = ndr_get_array_length(ndr, &r->ntds_dn);
++ if (length_ntds_dn_1 > size_ntds_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_ntds_dn_1, length_ntds_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->ntds_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->ntds_dn, ndr_get_array_length(ndr, &r->ntds_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_ntds_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->ntds_dn, length_ntds_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ntds_dn_0, 0);
+ }
+ }
+@@ -7937,6 +8113,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCInfoCtr3(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCInfoCtr3 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -7959,13 +8136,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCInfo3(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCInfo3(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -8034,6 +8212,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCConnection01(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCConnection01 *r)
+ {
+ uint32_t _ptr_client_account;
++ uint32_t size_client_account_1 = 0;
++ uint32_t length_client_account_1 = 0;
+ TALLOC_CTX *_mem_save_client_account_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -8062,11 +8242,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->client_account, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client_account));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client_account));
+- if (ndr_get_array_length(ndr, &r->client_account) > ndr_get_array_size(ndr, &r->client_account)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client_account), ndr_get_array_length(ndr, &r->client_account));
++ size_client_account_1 = ndr_get_array_size(ndr, &r->client_account);
++ length_client_account_1 = ndr_get_array_length(ndr, &r->client_account);
++ if (length_client_account_1 > size_client_account_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_account_1, length_client_account_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client_account), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_account, ndr_get_array_length(ndr, &r->client_account), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_account_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_account, length_client_account_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_account_0, 0);
+ }
+ }
+@@ -8118,6 +8300,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetDCConnectionCtr01(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetDCConnectionCtr01 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -8140,13 +8323,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCConnection01(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsGetDCConnection01(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -8536,6 +8720,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsAddEntryExtraErrorBuffer(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsAddEntryExtraErrorBuffer *r)
+ {
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
+ TALLOC_CTX *_mem_save_data_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -8556,8 +8741,9 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_data_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
+- NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_size(ndr, &r->data)));
++ size_data_1 = ndr_get_array_size(ndr, &r->data);
++ NDR_PULL_ALLOC_N(ndr, r->data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ if (r->data) {
+@@ -9102,6 +9288,7 @@ static enum ndr_err_code ndr_pull_drsuap
+ uint32_t _ptr_id;
+ TALLOC_CTX *_mem_save_id_0;
+ uint32_t _ptr_objects;
++ uint32_t size_objects_1 = 0;
+ uint32_t cntr_objects_1;
+ TALLOC_CTX *_mem_save_objects_0;
+ TALLOC_CTX *_mem_save_objects_1;
+@@ -9138,13 +9325,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_objects_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->objects, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->objects));
+- NDR_PULL_ALLOC_N(ndr, r->objects, ndr_get_array_size(ndr, &r->objects));
++ size_objects_1 = ndr_get_array_size(ndr, &r->objects);
++ NDR_PULL_ALLOC_N(ndr, r->objects, size_objects_1);
+ _mem_save_objects_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->objects, 0);
+- for (cntr_objects_1 = 0; cntr_objects_1 < r->count; cntr_objects_1++) {
++ for (cntr_objects_1 = 0; cntr_objects_1 < size_objects_1; cntr_objects_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjectIdentifier2(ndr, NDR_SCALARS, &r->objects[cntr_objects_1]));
+ }
+- for (cntr_objects_1 = 0; cntr_objects_1 < r->count; cntr_objects_1++) {
++ for (cntr_objects_1 = 0; cntr_objects_1 < size_objects_1; cntr_objects_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjectIdentifier2(ndr, NDR_BUFFERS, &r->objects[cntr_objects_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_objects_1, 0);
+@@ -9229,6 +9417,7 @@ static enum ndr_err_code ndr_pull_drsuap
+ uint32_t _ptr_error;
+ TALLOC_CTX *_mem_save_error_0;
+ uint32_t _ptr_objects;
++ uint32_t size_objects_1 = 0;
+ uint32_t cntr_objects_1;
+ TALLOC_CTX *_mem_save_objects_0;
+ TALLOC_CTX *_mem_save_objects_1;
+@@ -9277,13 +9466,14 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_objects_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->objects, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->objects));
+- NDR_PULL_ALLOC_N(ndr, r->objects, ndr_get_array_size(ndr, &r->objects));
++ size_objects_1 = ndr_get_array_size(ndr, &r->objects);
++ NDR_PULL_ALLOC_N(ndr, r->objects, size_objects_1);
+ _mem_save_objects_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->objects, 0);
+- for (cntr_objects_1 = 0; cntr_objects_1 < r->count; cntr_objects_1++) {
++ for (cntr_objects_1 = 0; cntr_objects_1 < size_objects_1; cntr_objects_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjectIdentifier2(ndr, NDR_SCALARS, &r->objects[cntr_objects_1]));
+ }
+- for (cntr_objects_1 = 0; cntr_objects_1 < r->count; cntr_objects_1++) {
++ for (cntr_objects_1 = 0; cntr_objects_1 < size_objects_1; cntr_objects_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjectIdentifier2(ndr, NDR_BUFFERS, &r->objects[cntr_objects_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_objects_1, 0);
+@@ -9650,6 +9840,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaGetInfoRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaGetInfoRequest1 *r)
+ {
+ uint32_t _ptr_object_dn;
++ uint32_t size_object_dn_1 = 0;
++ uint32_t length_object_dn_1 = 0;
+ TALLOC_CTX *_mem_save_object_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -9669,11 +9861,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->object_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->object_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->object_dn));
+- if (ndr_get_array_length(ndr, &r->object_dn) > ndr_get_array_size(ndr, &r->object_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->object_dn), ndr_get_array_length(ndr, &r->object_dn));
++ size_object_dn_1 = ndr_get_array_size(ndr, &r->object_dn);
++ length_object_dn_1 = ndr_get_array_length(ndr, &r->object_dn);
++ if (length_object_dn_1 > size_object_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_object_dn_1, length_object_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_object_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, length_object_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_object_dn_0, 0);
+ }
+ }
+@@ -9734,10 +9928,16 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaGetInfoRequest2(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaGetInfoRequest2 *r)
+ {
+ uint32_t _ptr_object_dn;
++ uint32_t size_object_dn_1 = 0;
++ uint32_t length_object_dn_1 = 0;
+ TALLOC_CTX *_mem_save_object_dn_0;
+ uint32_t _ptr_string1;
++ uint32_t size_string1_1 = 0;
++ uint32_t length_string1_1 = 0;
+ TALLOC_CTX *_mem_save_string1_0;
+ uint32_t _ptr_string2;
++ uint32_t size_string2_1 = 0;
++ uint32_t length_string2_1 = 0;
+ TALLOC_CTX *_mem_save_string2_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -9771,11 +9971,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->object_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->object_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->object_dn));
+- if (ndr_get_array_length(ndr, &r->object_dn) > ndr_get_array_size(ndr, &r->object_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->object_dn), ndr_get_array_length(ndr, &r->object_dn));
++ size_object_dn_1 = ndr_get_array_size(ndr, &r->object_dn);
++ length_object_dn_1 = ndr_get_array_length(ndr, &r->object_dn);
++ if (length_object_dn_1 > size_object_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_object_dn_1, length_object_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_object_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, length_object_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_object_dn_0, 0);
+ }
+ if (r->string1) {
+@@ -9783,11 +9985,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->string1, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->string1));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->string1));
+- if (ndr_get_array_length(ndr, &r->string1) > ndr_get_array_size(ndr, &r->string1)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->string1), ndr_get_array_length(ndr, &r->string1));
++ size_string1_1 = ndr_get_array_size(ndr, &r->string1);
++ length_string1_1 = ndr_get_array_length(ndr, &r->string1);
++ if (length_string1_1 > size_string1_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_string1_1, length_string1_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->string1), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string1, ndr_get_array_length(ndr, &r->string1), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_string1_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string1, length_string1_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_string1_0, 0);
+ }
+ if (r->string2) {
+@@ -9795,11 +9999,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->string2, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->string2));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->string2));
+- if (ndr_get_array_length(ndr, &r->string2) > ndr_get_array_size(ndr, &r->string2)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->string2), ndr_get_array_length(ndr, &r->string2));
++ size_string2_1 = ndr_get_array_size(ndr, &r->string2);
++ length_string2_1 = ndr_get_array_length(ndr, &r->string2);
++ if (length_string2_1 > size_string2_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_string2_1, length_string2_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->string2), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string2, ndr_get_array_length(ndr, &r->string2), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_string2_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->string2, length_string2_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_string2_0, 0);
+ }
+ }
+@@ -9986,12 +10192,20 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaNeighbour(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaNeighbour *r)
+ {
+ uint32_t _ptr_naming_context_dn;
++ uint32_t size_naming_context_dn_1 = 0;
++ uint32_t length_naming_context_dn_1 = 0;
+ TALLOC_CTX *_mem_save_naming_context_dn_0;
+ uint32_t _ptr_source_dsa_obj_dn;
++ uint32_t size_source_dsa_obj_dn_1 = 0;
++ uint32_t length_source_dsa_obj_dn_1 = 0;
+ TALLOC_CTX *_mem_save_source_dsa_obj_dn_0;
+ uint32_t _ptr_source_dsa_address;
++ uint32_t size_source_dsa_address_1 = 0;
++ uint32_t length_source_dsa_address_1 = 0;
+ TALLOC_CTX *_mem_save_source_dsa_address_0;
+ uint32_t _ptr_transport_obj_dn;
++ uint32_t size_transport_obj_dn_1 = 0;
++ uint32_t length_transport_obj_dn_1 = 0;
+ TALLOC_CTX *_mem_save_transport_obj_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+@@ -10039,11 +10253,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->naming_context_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->naming_context_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->naming_context_dn));
+- if (ndr_get_array_length(ndr, &r->naming_context_dn) > ndr_get_array_size(ndr, &r->naming_context_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->naming_context_dn), ndr_get_array_length(ndr, &r->naming_context_dn));
++ size_naming_context_dn_1 = ndr_get_array_size(ndr, &r->naming_context_dn);
++ length_naming_context_dn_1 = ndr_get_array_length(ndr, &r->naming_context_dn);
++ if (length_naming_context_dn_1 > size_naming_context_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_naming_context_dn_1, length_naming_context_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->naming_context_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->naming_context_dn, ndr_get_array_length(ndr, &r->naming_context_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_naming_context_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->naming_context_dn, length_naming_context_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_naming_context_dn_0, 0);
+ }
+ if (r->source_dsa_obj_dn) {
+@@ -10051,11 +10267,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->source_dsa_obj_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->source_dsa_obj_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->source_dsa_obj_dn));
+- if (ndr_get_array_length(ndr, &r->source_dsa_obj_dn) > ndr_get_array_size(ndr, &r->source_dsa_obj_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->source_dsa_obj_dn), ndr_get_array_length(ndr, &r->source_dsa_obj_dn));
++ size_source_dsa_obj_dn_1 = ndr_get_array_size(ndr, &r->source_dsa_obj_dn);
++ length_source_dsa_obj_dn_1 = ndr_get_array_length(ndr, &r->source_dsa_obj_dn);
++ if (length_source_dsa_obj_dn_1 > size_source_dsa_obj_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_source_dsa_obj_dn_1, length_source_dsa_obj_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->source_dsa_obj_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_obj_dn, ndr_get_array_length(ndr, &r->source_dsa_obj_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_source_dsa_obj_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_obj_dn, length_source_dsa_obj_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_source_dsa_obj_dn_0, 0);
+ }
+ if (r->source_dsa_address) {
+@@ -10063,11 +10281,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->source_dsa_address, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->source_dsa_address));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->source_dsa_address));
+- if (ndr_get_array_length(ndr, &r->source_dsa_address) > ndr_get_array_size(ndr, &r->source_dsa_address)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->source_dsa_address), ndr_get_array_length(ndr, &r->source_dsa_address));
++ size_source_dsa_address_1 = ndr_get_array_size(ndr, &r->source_dsa_address);
++ length_source_dsa_address_1 = ndr_get_array_length(ndr, &r->source_dsa_address);
++ if (length_source_dsa_address_1 > size_source_dsa_address_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_source_dsa_address_1, length_source_dsa_address_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, ndr_get_array_length(ndr, &r->source_dsa_address), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_source_dsa_address_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_address, length_source_dsa_address_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_source_dsa_address_0, 0);
+ }
+ if (r->transport_obj_dn) {
+@@ -10075,11 +10295,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->transport_obj_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->transport_obj_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->transport_obj_dn));
+- if (ndr_get_array_length(ndr, &r->transport_obj_dn) > ndr_get_array_size(ndr, &r->transport_obj_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->transport_obj_dn), ndr_get_array_length(ndr, &r->transport_obj_dn));
++ size_transport_obj_dn_1 = ndr_get_array_size(ndr, &r->transport_obj_dn);
++ length_transport_obj_dn_1 = ndr_get_array_length(ndr, &r->transport_obj_dn);
++ if (length_transport_obj_dn_1 > size_transport_obj_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_transport_obj_dn_1, length_transport_obj_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->transport_obj_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->transport_obj_dn, ndr_get_array_length(ndr, &r->transport_obj_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_transport_obj_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->transport_obj_dn, length_transport_obj_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_transport_obj_dn_0, 0);
+ }
+ }
+@@ -10152,6 +10374,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaNeighbourCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaNeighbourCtr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -10159,10 +10382,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaNeighbour(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10172,9 +10396,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaNeighbour(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10222,6 +10447,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaCursorCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaCursorCtr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -10229,10 +10455,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaCursor(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10292,6 +10519,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaObjMetaData(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaObjMetaData *r)
+ {
+ uint32_t _ptr_attribute_name;
++ uint32_t size_attribute_name_1 = 0;
++ uint32_t length_attribute_name_1 = 0;
+ TALLOC_CTX *_mem_save_attribute_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+@@ -10314,11 +10543,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->attribute_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->attribute_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->attribute_name));
+- if (ndr_get_array_length(ndr, &r->attribute_name) > ndr_get_array_size(ndr, &r->attribute_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->attribute_name), ndr_get_array_length(ndr, &r->attribute_name));
++ size_attribute_name_1 = ndr_get_array_size(ndr, &r->attribute_name);
++ length_attribute_name_1 = ndr_get_array_length(ndr, &r->attribute_name);
++ if (length_attribute_name_1 > size_attribute_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_attribute_name_1, length_attribute_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_attribute_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, length_attribute_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_attribute_name_0, 0);
+ }
+ }
+@@ -10366,6 +10597,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaObjMetaDataCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaObjMetaDataCtr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -10373,10 +10605,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjMetaData(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10386,9 +10619,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjMetaData(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10441,6 +10675,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaKccDsaFailure(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaKccDsaFailure *r)
+ {
+ uint32_t _ptr_dsa_obj_dn;
++ uint32_t size_dsa_obj_dn_1 = 0;
++ uint32_t length_dsa_obj_dn_1 = 0;
+ TALLOC_CTX *_mem_save_dsa_obj_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -10462,11 +10698,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->dsa_obj_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dsa_obj_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dsa_obj_dn));
+- if (ndr_get_array_length(ndr, &r->dsa_obj_dn) > ndr_get_array_size(ndr, &r->dsa_obj_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dsa_obj_dn), ndr_get_array_length(ndr, &r->dsa_obj_dn));
++ size_dsa_obj_dn_1 = ndr_get_array_size(ndr, &r->dsa_obj_dn);
++ length_dsa_obj_dn_1 = ndr_get_array_length(ndr, &r->dsa_obj_dn);
++ if (length_dsa_obj_dn_1 > size_dsa_obj_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dsa_obj_dn_1, length_dsa_obj_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dsa_obj_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dsa_obj_dn, ndr_get_array_length(ndr, &r->dsa_obj_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dsa_obj_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dsa_obj_dn, length_dsa_obj_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dsa_obj_dn_0, 0);
+ }
+ }
+@@ -10513,6 +10751,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaKccDsaFailuresCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaKccDsaFailuresCtr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -10520,10 +10759,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaKccDsaFailure(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10533,9 +10773,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaKccDsaFailure(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10789,10 +11030,16 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaOp(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaOp *r)
+ {
+ uint32_t _ptr_nc_dn;
++ uint32_t size_nc_dn_1 = 0;
++ uint32_t length_nc_dn_1 = 0;
+ TALLOC_CTX *_mem_save_nc_dn_0;
+ uint32_t _ptr_remote_dsa_obj_dn;
++ uint32_t size_remote_dsa_obj_dn_1 = 0;
++ uint32_t length_remote_dsa_obj_dn_1 = 0;
+ TALLOC_CTX *_mem_save_remote_dsa_obj_dn_0;
+ uint32_t _ptr_remote_dsa_address;
++ uint32_t size_remote_dsa_address_1 = 0;
++ uint32_t length_remote_dsa_address_1 = 0;
+ TALLOC_CTX *_mem_save_remote_dsa_address_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -10830,11 +11077,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->nc_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->nc_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->nc_dn));
+- if (ndr_get_array_length(ndr, &r->nc_dn) > ndr_get_array_size(ndr, &r->nc_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->nc_dn), ndr_get_array_length(ndr, &r->nc_dn));
++ size_nc_dn_1 = ndr_get_array_size(ndr, &r->nc_dn);
++ length_nc_dn_1 = ndr_get_array_length(ndr, &r->nc_dn);
++ if (length_nc_dn_1 > size_nc_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_nc_dn_1, length_nc_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->nc_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->nc_dn, ndr_get_array_length(ndr, &r->nc_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_nc_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->nc_dn, length_nc_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_nc_dn_0, 0);
+ }
+ if (r->remote_dsa_obj_dn) {
+@@ -10842,11 +11091,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->remote_dsa_obj_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->remote_dsa_obj_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->remote_dsa_obj_dn));
+- if (ndr_get_array_length(ndr, &r->remote_dsa_obj_dn) > ndr_get_array_size(ndr, &r->remote_dsa_obj_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->remote_dsa_obj_dn), ndr_get_array_length(ndr, &r->remote_dsa_obj_dn));
++ size_remote_dsa_obj_dn_1 = ndr_get_array_size(ndr, &r->remote_dsa_obj_dn);
++ length_remote_dsa_obj_dn_1 = ndr_get_array_length(ndr, &r->remote_dsa_obj_dn);
++ if (length_remote_dsa_obj_dn_1 > size_remote_dsa_obj_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_remote_dsa_obj_dn_1, length_remote_dsa_obj_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->remote_dsa_obj_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote_dsa_obj_dn, ndr_get_array_length(ndr, &r->remote_dsa_obj_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_remote_dsa_obj_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote_dsa_obj_dn, length_remote_dsa_obj_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_remote_dsa_obj_dn_0, 0);
+ }
+ if (r->remote_dsa_address) {
+@@ -10854,11 +11105,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->remote_dsa_address, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->remote_dsa_address));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->remote_dsa_address));
+- if (ndr_get_array_length(ndr, &r->remote_dsa_address) > ndr_get_array_size(ndr, &r->remote_dsa_address)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->remote_dsa_address), ndr_get_array_length(ndr, &r->remote_dsa_address));
++ size_remote_dsa_address_1 = ndr_get_array_size(ndr, &r->remote_dsa_address);
++ length_remote_dsa_address_1 = ndr_get_array_length(ndr, &r->remote_dsa_address);
++ if (length_remote_dsa_address_1 > size_remote_dsa_address_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_remote_dsa_address_1, length_remote_dsa_address_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->remote_dsa_address), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote_dsa_address, ndr_get_array_length(ndr, &r->remote_dsa_address), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_remote_dsa_address_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->remote_dsa_address, length_remote_dsa_address_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_remote_dsa_address_0, 0);
+ }
+ }
+@@ -10921,6 +11174,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaOpCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaOpCtr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -10928,10 +11182,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_NTTIME(ndr, NDR_SCALARS, &r->time));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaOp(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -10941,9 +11196,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaOp(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11011,8 +11267,12 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaAttrValMetaData(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaAttrValMetaData *r)
+ {
+ uint32_t _ptr_attribute_name;
++ uint32_t size_attribute_name_1 = 0;
++ uint32_t length_attribute_name_1 = 0;
+ TALLOC_CTX *_mem_save_attribute_name_0;
+ uint32_t _ptr_object_dn;
++ uint32_t size_object_dn_1 = 0;
++ uint32_t length_object_dn_1 = 0;
+ TALLOC_CTX *_mem_save_object_dn_0;
+ uint32_t _ptr_binary;
+ TALLOC_CTX *_mem_save_binary_0;
+@@ -11052,11 +11312,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->attribute_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->attribute_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->attribute_name));
+- if (ndr_get_array_length(ndr, &r->attribute_name) > ndr_get_array_size(ndr, &r->attribute_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->attribute_name), ndr_get_array_length(ndr, &r->attribute_name));
++ size_attribute_name_1 = ndr_get_array_size(ndr, &r->attribute_name);
++ length_attribute_name_1 = ndr_get_array_length(ndr, &r->attribute_name);
++ if (length_attribute_name_1 > size_attribute_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_attribute_name_1, length_attribute_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_attribute_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, length_attribute_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_attribute_name_0, 0);
+ }
+ if (r->object_dn) {
+@@ -11064,11 +11326,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->object_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->object_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->object_dn));
+- if (ndr_get_array_length(ndr, &r->object_dn) > ndr_get_array_size(ndr, &r->object_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->object_dn), ndr_get_array_length(ndr, &r->object_dn));
++ size_object_dn_1 = ndr_get_array_size(ndr, &r->object_dn);
++ length_object_dn_1 = ndr_get_array_length(ndr, &r->object_dn);
++ if (length_object_dn_1 > size_object_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_object_dn_1, length_object_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_object_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, length_object_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_object_dn_0, 0);
+ }
+ if (r->binary) {
+@@ -11137,6 +11401,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaAttrValMetaDataCtr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaAttrValMetaDataCtr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -11144,10 +11409,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_int32(ndr, NDR_SCALARS, &r->enumeration_context));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAttrValMetaData(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11157,9 +11423,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAttrValMetaData(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11207,6 +11474,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaCursor2Ctr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaCursor2Ctr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -11214,10 +11482,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_int32(ndr, NDR_SCALARS, &r->enumeration_context));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaCursor2(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11275,6 +11544,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaCursor3(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaCursor3 *r)
+ {
+ uint32_t _ptr_source_dsa_obj_dn;
++ uint32_t size_source_dsa_obj_dn_1 = 0;
++ uint32_t length_source_dsa_obj_dn_1 = 0;
+ TALLOC_CTX *_mem_save_source_dsa_obj_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+@@ -11295,11 +11566,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->source_dsa_obj_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->source_dsa_obj_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->source_dsa_obj_dn));
+- if (ndr_get_array_length(ndr, &r->source_dsa_obj_dn) > ndr_get_array_size(ndr, &r->source_dsa_obj_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->source_dsa_obj_dn), ndr_get_array_length(ndr, &r->source_dsa_obj_dn));
++ size_source_dsa_obj_dn_1 = ndr_get_array_size(ndr, &r->source_dsa_obj_dn);
++ length_source_dsa_obj_dn_1 = ndr_get_array_length(ndr, &r->source_dsa_obj_dn);
++ if (length_source_dsa_obj_dn_1 > size_source_dsa_obj_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_source_dsa_obj_dn_1, length_source_dsa_obj_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->source_dsa_obj_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_obj_dn, ndr_get_array_length(ndr, &r->source_dsa_obj_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_source_dsa_obj_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->source_dsa_obj_dn, length_source_dsa_obj_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_source_dsa_obj_dn_0, 0);
+ }
+ }
+@@ -11345,6 +11618,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaCursor3Ctr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaCursor3Ctr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -11352,10 +11626,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_int32(ndr, NDR_SCALARS, &r->enumeration_context));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaCursor3(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11365,9 +11640,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaCursor3(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11428,8 +11704,12 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaObjMetaData2(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaObjMetaData2 *r)
+ {
+ uint32_t _ptr_attribute_name;
++ uint32_t size_attribute_name_1 = 0;
++ uint32_t length_attribute_name_1 = 0;
+ TALLOC_CTX *_mem_save_attribute_name_0;
+ uint32_t _ptr_originating_dsa_dn;
++ uint32_t size_originating_dsa_dn_1 = 0;
++ uint32_t length_originating_dsa_dn_1 = 0;
+ TALLOC_CTX *_mem_save_originating_dsa_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+@@ -11458,11 +11738,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->attribute_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->attribute_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->attribute_name));
+- if (ndr_get_array_length(ndr, &r->attribute_name) > ndr_get_array_size(ndr, &r->attribute_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->attribute_name), ndr_get_array_length(ndr, &r->attribute_name));
++ size_attribute_name_1 = ndr_get_array_size(ndr, &r->attribute_name);
++ length_attribute_name_1 = ndr_get_array_length(ndr, &r->attribute_name);
++ if (length_attribute_name_1 > size_attribute_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_attribute_name_1, length_attribute_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_attribute_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, length_attribute_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_attribute_name_0, 0);
+ }
+ if (r->originating_dsa_dn) {
+@@ -11470,11 +11752,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->originating_dsa_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->originating_dsa_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->originating_dsa_dn));
+- if (ndr_get_array_length(ndr, &r->originating_dsa_dn) > ndr_get_array_size(ndr, &r->originating_dsa_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->originating_dsa_dn), ndr_get_array_length(ndr, &r->originating_dsa_dn));
++ size_originating_dsa_dn_1 = ndr_get_array_size(ndr, &r->originating_dsa_dn);
++ length_originating_dsa_dn_1 = ndr_get_array_length(ndr, &r->originating_dsa_dn);
++ if (length_originating_dsa_dn_1 > size_originating_dsa_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_originating_dsa_dn_1, length_originating_dsa_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->originating_dsa_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->originating_dsa_dn, ndr_get_array_length(ndr, &r->originating_dsa_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_originating_dsa_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->originating_dsa_dn, length_originating_dsa_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_originating_dsa_dn_0, 0);
+ }
+ }
+@@ -11528,6 +11812,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaObjMetaData2Ctr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaObjMetaData2Ctr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -11535,10 +11820,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_int32(ndr, NDR_SCALARS, &r->enumeration_context));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjMetaData2(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11548,9 +11834,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaObjMetaData2(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11625,12 +11912,18 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaAttrValMetaData2(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaAttrValMetaData2 *r)
+ {
+ uint32_t _ptr_attribute_name;
++ uint32_t size_attribute_name_1 = 0;
++ uint32_t length_attribute_name_1 = 0;
+ TALLOC_CTX *_mem_save_attribute_name_0;
+ uint32_t _ptr_object_dn;
++ uint32_t size_object_dn_1 = 0;
++ uint32_t length_object_dn_1 = 0;
+ TALLOC_CTX *_mem_save_object_dn_0;
+ uint32_t _ptr_binary;
+ TALLOC_CTX *_mem_save_binary_0;
+ uint32_t _ptr_originating_dsa_dn;
++ uint32_t size_originating_dsa_dn_1 = 0;
++ uint32_t length_originating_dsa_dn_1 = 0;
+ TALLOC_CTX *_mem_save_originating_dsa_dn_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+@@ -11674,11 +11967,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->attribute_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->attribute_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->attribute_name));
+- if (ndr_get_array_length(ndr, &r->attribute_name) > ndr_get_array_size(ndr, &r->attribute_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->attribute_name), ndr_get_array_length(ndr, &r->attribute_name));
++ size_attribute_name_1 = ndr_get_array_size(ndr, &r->attribute_name);
++ length_attribute_name_1 = ndr_get_array_length(ndr, &r->attribute_name);
++ if (length_attribute_name_1 > size_attribute_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_attribute_name_1, length_attribute_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, ndr_get_array_length(ndr, &r->attribute_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_attribute_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->attribute_name, length_attribute_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_attribute_name_0, 0);
+ }
+ if (r->object_dn) {
+@@ -11686,11 +11981,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->object_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->object_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->object_dn));
+- if (ndr_get_array_length(ndr, &r->object_dn) > ndr_get_array_size(ndr, &r->object_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->object_dn), ndr_get_array_length(ndr, &r->object_dn));
++ size_object_dn_1 = ndr_get_array_size(ndr, &r->object_dn);
++ length_object_dn_1 = ndr_get_array_length(ndr, &r->object_dn);
++ if (length_object_dn_1 > size_object_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_object_dn_1, length_object_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, ndr_get_array_length(ndr, &r->object_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_object_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->object_dn, length_object_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_object_dn_0, 0);
+ }
+ if (r->binary) {
+@@ -11704,11 +12001,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->originating_dsa_dn, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->originating_dsa_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->originating_dsa_dn));
+- if (ndr_get_array_length(ndr, &r->originating_dsa_dn) > ndr_get_array_size(ndr, &r->originating_dsa_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->originating_dsa_dn), ndr_get_array_length(ndr, &r->originating_dsa_dn));
++ size_originating_dsa_dn_1 = ndr_get_array_size(ndr, &r->originating_dsa_dn);
++ length_originating_dsa_dn_1 = ndr_get_array_length(ndr, &r->originating_dsa_dn);
++ if (length_originating_dsa_dn_1 > size_originating_dsa_dn_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_originating_dsa_dn_1, length_originating_dsa_dn_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->originating_dsa_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->originating_dsa_dn, ndr_get_array_length(ndr, &r->originating_dsa_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_originating_dsa_dn_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->originating_dsa_dn, length_originating_dsa_dn_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_originating_dsa_dn_0, 0);
+ }
+ }
+@@ -11777,6 +12076,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaAttrValMetaData2Ctr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaAttrValMetaData2Ctr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -11784,10 +12084,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->count));
+ NDR_CHECK(ndr_pull_int32(ndr, NDR_SCALARS, &r->enumeration_context));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAttrValMetaData2(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11797,9 +12098,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaAttrValMetaData2(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11907,6 +12209,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplicaConnection04Ctr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplicaConnection04Ctr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -11917,10 +12220,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplicaConnection04(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -11982,6 +12286,8 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplica06(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplica06 *r)
+ {
+ uint32_t _ptr_str1;
++ uint32_t size_str1_1 = 0;
++ uint32_t length_str1_1 = 0;
+ TALLOC_CTX *_mem_save_str1_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+@@ -12006,11 +12312,13 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->str1, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->str1));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->str1));
+- if (ndr_get_array_length(ndr, &r->str1) > ndr_get_array_size(ndr, &r->str1)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->str1), ndr_get_array_length(ndr, &r->str1));
++ size_str1_1 = ndr_get_array_size(ndr, &r->str1);
++ length_str1_1 = ndr_get_array_length(ndr, &r->str1);
++ if (length_str1_1 > size_str1_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_str1_1, length_str1_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->str1), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->str1, ndr_get_array_length(ndr, &r->str1), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_str1_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->str1, length_str1_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_str1_0, 0);
+ }
+ }
+@@ -12060,6 +12368,7 @@ static enum ndr_err_code ndr_push_drsuap
+
+ static enum ndr_err_code ndr_pull_drsuapi_DsReplica06Ctr(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsReplica06Ctr *r)
+ {
++ uint32_t size_array_0 = 0;
+ uint32_t cntr_array_0;
+ TALLOC_CTX *_mem_save_array_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -12070,10 +12379,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->reserved));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_0);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplica06(ndr, NDR_SCALARS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -12083,9 +12393,10 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 8));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_array_0 = ndr_get_array_size(ndr, &r->array);
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_0 = 0; cntr_array_0 < r->count; cntr_array_0++) {
++ for (cntr_array_0 = 0; cntr_array_0 < size_array_0; cntr_array_0++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsReplica06(ndr, NDR_BUFFERS, &r->array[cntr_array_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_0, 0);
+@@ -12289,20 +12600,35 @@ static enum ndr_err_code ndr_pull_drsuap
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_neighbours_0;
++ uint32_t _ptr_neighbours;
+ TALLOC_CTX *_mem_save_cursors_0;
++ uint32_t _ptr_cursors;
+ TALLOC_CTX *_mem_save_objmetadata_0;
++ uint32_t _ptr_objmetadata;
+ TALLOC_CTX *_mem_save_connectfailures_0;
++ uint32_t _ptr_connectfailures;
+ TALLOC_CTX *_mem_save_linkfailures_0;
++ uint32_t _ptr_linkfailures;
+ TALLOC_CTX *_mem_save_pendingops_0;
++ uint32_t _ptr_pendingops;
+ TALLOC_CTX *_mem_save_attrvalmetadata_0;
++ uint32_t _ptr_attrvalmetadata;
+ TALLOC_CTX *_mem_save_cursors2_0;
++ uint32_t _ptr_cursors2;
+ TALLOC_CTX *_mem_save_cursors3_0;
++ uint32_t _ptr_cursors3;
+ TALLOC_CTX *_mem_save_objmetadata2_0;
++ uint32_t _ptr_objmetadata2;
+ TALLOC_CTX *_mem_save_attrvalmetadata2_0;
++ uint32_t _ptr_attrvalmetadata2;
+ TALLOC_CTX *_mem_save_neighbours02_0;
++ uint32_t _ptr_neighbours02;
+ TALLOC_CTX *_mem_save_connections04_0;
++ uint32_t _ptr_connections04;
+ TALLOC_CTX *_mem_save_cursors05_0;
++ uint32_t _ptr_cursors05;
+ TALLOC_CTX *_mem_save_i06_0;
++ uint32_t _ptr_i06;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -12312,7 +12638,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case DRSUAPI_DS_REPLICA_INFO_NEIGHBORS: {
+- uint32_t _ptr_neighbours;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_neighbours));
+ if (_ptr_neighbours) {
+ NDR_PULL_ALLOC(ndr, r->neighbours);
+@@ -12322,7 +12647,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_CURSORS: {
+- uint32_t _ptr_cursors;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_cursors));
+ if (_ptr_cursors) {
+ NDR_PULL_ALLOC(ndr, r->cursors);
+@@ -12332,7 +12656,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA: {
+- uint32_t _ptr_objmetadata;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_objmetadata));
+ if (_ptr_objmetadata) {
+ NDR_PULL_ALLOC(ndr, r->objmetadata);
+@@ -12342,7 +12665,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES: {
+- uint32_t _ptr_connectfailures;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_connectfailures));
+ if (_ptr_connectfailures) {
+ NDR_PULL_ALLOC(ndr, r->connectfailures);
+@@ -12352,7 +12674,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_KCC_DSA_LINK_FAILURES: {
+- uint32_t _ptr_linkfailures;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_linkfailures));
+ if (_ptr_linkfailures) {
+ NDR_PULL_ALLOC(ndr, r->linkfailures);
+@@ -12362,7 +12683,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_PENDING_OPS: {
+- uint32_t _ptr_pendingops;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_pendingops));
+ if (_ptr_pendingops) {
+ NDR_PULL_ALLOC(ndr, r->pendingops);
+@@ -12372,7 +12692,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA: {
+- uint32_t _ptr_attrvalmetadata;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_attrvalmetadata));
+ if (_ptr_attrvalmetadata) {
+ NDR_PULL_ALLOC(ndr, r->attrvalmetadata);
+@@ -12382,7 +12701,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_CURSORS2: {
+- uint32_t _ptr_cursors2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_cursors2));
+ if (_ptr_cursors2) {
+ NDR_PULL_ALLOC(ndr, r->cursors2);
+@@ -12392,7 +12710,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_CURSORS3: {
+- uint32_t _ptr_cursors3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_cursors3));
+ if (_ptr_cursors3) {
+ NDR_PULL_ALLOC(ndr, r->cursors3);
+@@ -12402,7 +12719,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_OBJ_METADATA2: {
+- uint32_t _ptr_objmetadata2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_objmetadata2));
+ if (_ptr_objmetadata2) {
+ NDR_PULL_ALLOC(ndr, r->objmetadata2);
+@@ -12412,7 +12728,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_ATTRIBUTE_VALUE_METADATA2: {
+- uint32_t _ptr_attrvalmetadata2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_attrvalmetadata2));
+ if (_ptr_attrvalmetadata2) {
+ NDR_PULL_ALLOC(ndr, r->attrvalmetadata2);
+@@ -12422,7 +12737,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_NEIGHBORS02: {
+- uint32_t _ptr_neighbours02;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_neighbours02));
+ if (_ptr_neighbours02) {
+ NDR_PULL_ALLOC(ndr, r->neighbours02);
+@@ -12432,7 +12746,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_CONNECTIONS04: {
+- uint32_t _ptr_connections04;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_connections04));
+ if (_ptr_connections04) {
+ NDR_PULL_ALLOC(ndr, r->connections04);
+@@ -12442,7 +12755,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_CURSORS05: {
+- uint32_t _ptr_cursors05;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_cursors05));
+ if (_ptr_cursors05) {
+ NDR_PULL_ALLOC(ndr, r->cursors05);
+@@ -12452,7 +12764,6 @@ static enum ndr_err_code ndr_pull_drsuap
+ break; }
+
+ case DRSUAPI_DS_REPLICA_INFO_06: {
+- uint32_t _ptr_i06;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_i06));
+ if (_ptr_i06) {
+ NDR_PULL_ALLOC(ndr, r->i06);
+@@ -12860,6 +13171,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_DsGetMemberships2Request1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetMemberships2Request1 *r)
+ {
+ uint32_t _ptr_req_array;
++ uint32_t size_req_array_1 = 0;
+ uint32_t cntr_req_array_1;
+ TALLOC_CTX *_mem_save_req_array_0;
+ TALLOC_CTX *_mem_save_req_array_1;
+@@ -12883,10 +13195,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_req_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->req_array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->req_array));
+- NDR_PULL_ALLOC_N(ndr, r->req_array, ndr_get_array_size(ndr, &r->req_array));
++ size_req_array_1 = ndr_get_array_size(ndr, &r->req_array);
++ NDR_PULL_ALLOC_N(ndr, r->req_array, size_req_array_1);
+ _mem_save_req_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->req_array, 0);
+- for (cntr_req_array_1 = 0; cntr_req_array_1 < r->num_req; cntr_req_array_1++) {
++ for (cntr_req_array_1 = 0; cntr_req_array_1 < size_req_array_1; cntr_req_array_1++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_req_array));
+ if (_ptr_req_array) {
+ NDR_PULL_ALLOC(ndr, r->req_array[cntr_req_array_1]);
+@@ -12894,7 +13207,7 @@ static enum ndr_err_code ndr_pull_drsuap
+ r->req_array[cntr_req_array_1] = NULL;
+ }
+ }
+- for (cntr_req_array_1 = 0; cntr_req_array_1 < r->num_req; cntr_req_array_1++) {
++ for (cntr_req_array_1 = 0; cntr_req_array_1 < size_req_array_1; cntr_req_array_1++) {
+ if (r->req_array[cntr_req_array_1]) {
+ _mem_save_req_array_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->req_array[cntr_req_array_1], 0);
+@@ -13077,6 +13390,7 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_QuerySitesByCostCtr1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_QuerySitesByCostCtr1 *r)
+ {
+ uint32_t _ptr_info;
++ uint32_t size_info_1 = 0;
+ uint32_t cntr_info_1;
+ TALLOC_CTX *_mem_save_info_0;
+ TALLOC_CTX *_mem_save_info_1;
+@@ -13100,10 +13414,11 @@ static enum ndr_err_code ndr_pull_drsuap
+ _mem_save_info_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->info));
+- NDR_PULL_ALLOC_N(ndr, r->info, ndr_get_array_size(ndr, &r->info));
++ size_info_1 = ndr_get_array_size(ndr, &r->info);
++ NDR_PULL_ALLOC_N(ndr, r->info, size_info_1);
+ _mem_save_info_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->info, 0);
+- for (cntr_info_1 = 0; cntr_info_1 < r->num_info; cntr_info_1++) {
++ for (cntr_info_1 = 0; cntr_info_1 < size_info_1; cntr_info_1++) {
+ NDR_CHECK(ndr_pull_drsuapi_DsSiteCostInfo(ndr, NDR_SCALARS, &r->info[cntr_info_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_info_1, 0);
+@@ -13257,9 +13572,14 @@ static enum ndr_err_code ndr_push_drsuap
+ static enum ndr_err_code ndr_pull_drsuapi_QuerySitesByCostRequest1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_QuerySitesByCostRequest1 *r)
+ {
+ uint32_t _ptr_site_from;
++ uint32_t size_site_from_1 = 0;
++ uint32_t length_site_from_1 = 0;
+ TALLOC_CTX *_mem_save_site_from_0;
+ uint32_t _ptr_site_to;
++ uint32_t size_site_to_1 = 0;
+ uint32_t cntr_site_to_1;
++ uint32_t size_site_to_3 = 0;
++ uint32_t length_site_to_3 = 0;
+ TALLOC_CTX *_mem_save_site_to_0;
+ TALLOC_CTX *_mem_save_site_to_1;
+ TALLOC_CTX *_mem_save_site_to_2;
+@@ -13290,21 +13610,24 @@ static enum ndr_err_code ndr_pull_drsuap
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_from, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_from));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->site_from));
+- if (ndr_get_array_length(ndr, &r->site_from) > ndr_get_array_size(ndr, &r->site_from)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->site_from), ndr_get_array_length(ndr, &r->site_from));
++ size_site_from_1 = ndr_get_array_size(ndr, &r->site_from);
++ length_site_from_1 = ndr_get_array_length(ndr, &r->site_from);
++ if (length_site_from_1 > size_site_from_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_site_from_1, length_site_from_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->site_from), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_from, ndr_get_array_length(ndr, &r->site_from), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_site_from_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_from, length_site_from_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_site_from_0, 0);
+ }
+ if (r->site_to) {
+ _mem_save_site_to_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_to, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_to));
+- NDR_PULL_ALLOC_N(ndr, r->site_to, ndr_get_array_size(ndr, &r->site_to));
++ size_site_to_1 = ndr_get_array_size(ndr, &r->site_to);
++ NDR_PULL_ALLOC_N(ndr, r->site_to, size_site_to_1);
+ _mem_save_site_to_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_to, 0);
+- for (cntr_site_to_1 = 0; cntr_site_to_1 < r->num_req; cntr_site_to_1++) {
++ for (cntr_site_to_1 = 0; cntr_site_to_1 < size_site_to_1; cntr_site_to_1++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_site_to));
+ if (_ptr_site_to) {
+ NDR_PULL_ALLOC(ndr, r->site_to[cntr_site_to_1]);
+@@ -13312,17 +13635,19 @@ static enum ndr_err_code ndr_pull_drsuap
+ r->site_to[cntr_site_to_1] = NULL;
+ }
+ }
+- for (cntr_site_to_1 = 0; cntr_site_to_1 < r->num_req; cntr_site_to_1++) {
++ for (cntr_site_to_1 = 0; cntr_site_to_1 < size_site_to_1; cntr_site_to_1++) {
+ if (r->site_to[cntr_site_to_1]) {
+ _mem_save_site_to_2 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->site_to[cntr_site_to_1], 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->site_to[cntr_site_to_1]));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->site_to[cntr_site_to_1]));
+- if (ndr_get_array_length(ndr, &r->site_to[cntr_site_to_1]) > ndr_get_array_size(ndr, &r->site_to[cntr_site_to_1])) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->site_to[cntr_site_to_1]), ndr_get_array_length(ndr, &r->site_to[cntr_site_to_1]));
++ size_site_to_3 = ndr_get_array_size(ndr, &r->site_to[cntr_site_to_1]);
++ length_site_to_3 = ndr_get_array_length(ndr, &r->site_to[cntr_site_to_1]);
++ if (length_site_to_3 > size_site_to_3) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_site_to_3, length_site_to_3);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->site_to[cntr_site_to_1]), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_to[cntr_site_to_1], ndr_get_array_length(ndr, &r->site_to[cntr_site_to_1]), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_site_to_3, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->site_to[cntr_site_to_1], length_site_to_3, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_site_to_2, 0);
+ }
+ }
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_dfs.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_dfs.c
+@@ -81,6 +81,8 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info1(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info1 *r)
+ {
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -98,11 +100,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ }
+@@ -179,8 +183,12 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info2(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info2 *r)
+ {
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -206,11 +214,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (r->comment) {
+@@ -218,11 +228,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -303,8 +315,12 @@ static enum ndr_err_code ndr_push_dfs_St
+ static enum ndr_err_code ndr_pull_dfs_StorageInfo(struct ndr_pull *ndr, int ndr_flags, struct dfs_StorageInfo *r)
+ {
+ uint32_t _ptr_server;
++ uint32_t size_server_1 = 0;
++ uint32_t length_server_1 = 0;
+ TALLOC_CTX *_mem_save_server_0;
+ uint32_t _ptr_share;
++ uint32_t size_share_1 = 0;
++ uint32_t length_share_1 = 0;
+ TALLOC_CTX *_mem_save_share_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -329,11 +345,13 @@ static enum ndr_err_code ndr_pull_dfs_St
+ NDR_PULL_SET_MEM_CTX(ndr, r->server, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server));
+- if (ndr_get_array_length(ndr, &r->server) > ndr_get_array_size(ndr, &r->server)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server), ndr_get_array_length(ndr, &r->server));
++ size_server_1 = ndr_get_array_size(ndr, &r->server);
++ length_server_1 = ndr_get_array_length(ndr, &r->server);
++ if (length_server_1 > size_server_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_1, length_server_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server, ndr_get_array_length(ndr, &r->server), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server, length_server_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_0, 0);
+ }
+ if (r->share) {
+@@ -341,11 +359,13 @@ static enum ndr_err_code ndr_pull_dfs_St
+ NDR_PULL_SET_MEM_CTX(ndr, r->share, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->share));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->share));
+- if (ndr_get_array_length(ndr, &r->share) > ndr_get_array_size(ndr, &r->share)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->share), ndr_get_array_length(ndr, &r->share));
++ size_share_1 = ndr_get_array_size(ndr, &r->share);
++ length_share_1 = ndr_get_array_length(ndr, &r->share);
++ if (length_share_1 > size_share_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_1, length_share_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->share), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->share, ndr_get_array_length(ndr, &r->share), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->share, length_share_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_share_0, 0);
+ }
+ }
+@@ -413,10 +433,15 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info3(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info3 *r)
+ {
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ uint32_t _ptr_stores;
++ uint32_t size_stores_1 = 0;
+ uint32_t cntr_stores_1;
+ TALLOC_CTX *_mem_save_stores_0;
+ TALLOC_CTX *_mem_save_stores_1;
+@@ -450,11 +475,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (r->comment) {
+@@ -462,24 +489,27 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ if (r->stores) {
+ _mem_save_stores_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->stores, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->stores));
+- NDR_PULL_ALLOC_N(ndr, r->stores, ndr_get_array_size(ndr, &r->stores));
++ size_stores_1 = ndr_get_array_size(ndr, &r->stores);
++ NDR_PULL_ALLOC_N(ndr, r->stores, size_stores_1);
+ _mem_save_stores_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->stores, 0);
+- for (cntr_stores_1 = 0; cntr_stores_1 < r->num_stores; cntr_stores_1++) {
++ for (cntr_stores_1 = 0; cntr_stores_1 < size_stores_1; cntr_stores_1++) {
+ NDR_CHECK(ndr_pull_dfs_StorageInfo(ndr, NDR_SCALARS, &r->stores[cntr_stores_1]));
+ }
+- for (cntr_stores_1 = 0; cntr_stores_1 < r->num_stores; cntr_stores_1++) {
++ for (cntr_stores_1 = 0; cntr_stores_1 < size_stores_1; cntr_stores_1++) {
+ NDR_CHECK(ndr_pull_dfs_StorageInfo(ndr, NDR_BUFFERS, &r->stores[cntr_stores_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_stores_1, 0);
+@@ -572,10 +602,15 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info4(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info4 *r)
+ {
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ uint32_t _ptr_stores;
++ uint32_t size_stores_1 = 0;
+ uint32_t cntr_stores_1;
+ TALLOC_CTX *_mem_save_stores_0;
+ TALLOC_CTX *_mem_save_stores_1;
+@@ -611,11 +646,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (r->comment) {
+@@ -623,24 +660,27 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ if (r->stores) {
+ _mem_save_stores_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->stores, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->stores));
+- NDR_PULL_ALLOC_N(ndr, r->stores, ndr_get_array_size(ndr, &r->stores));
++ size_stores_1 = ndr_get_array_size(ndr, &r->stores);
++ NDR_PULL_ALLOC_N(ndr, r->stores, size_stores_1);
+ _mem_save_stores_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->stores, 0);
+- for (cntr_stores_1 = 0; cntr_stores_1 < r->num_stores; cntr_stores_1++) {
++ for (cntr_stores_1 = 0; cntr_stores_1 < size_stores_1; cntr_stores_1++) {
+ NDR_CHECK(ndr_pull_dfs_StorageInfo(ndr, NDR_SCALARS, &r->stores[cntr_stores_1]));
+ }
+- for (cntr_stores_1 = 0; cntr_stores_1 < r->num_stores; cntr_stores_1++) {
++ for (cntr_stores_1 = 0; cntr_stores_1 < size_stores_1; cntr_stores_1++) {
+ NDR_CHECK(ndr_pull_dfs_StorageInfo(ndr, NDR_BUFFERS, &r->stores[cntr_stores_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_stores_1, 0);
+@@ -752,8 +792,12 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info5(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info5 *r)
+ {
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -783,11 +827,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (r->comment) {
+@@ -795,11 +841,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -980,10 +1028,15 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info6(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info6 *r)
+ {
+ uint32_t _ptr_entry_path;
++ uint32_t size_entry_path_1 = 0;
++ uint32_t length_entry_path_1 = 0;
+ TALLOC_CTX *_mem_save_entry_path_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ uint32_t _ptr_stores;
++ uint32_t size_stores_1 = 0;
+ uint32_t cntr_stores_1;
+ TALLOC_CTX *_mem_save_stores_0;
+ TALLOC_CTX *_mem_save_stores_1;
+@@ -1021,11 +1074,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->entry_path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->entry_path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->entry_path));
+- if (ndr_get_array_length(ndr, &r->entry_path) > ndr_get_array_size(ndr, &r->entry_path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->entry_path), ndr_get_array_length(ndr, &r->entry_path));
++ size_entry_path_1 = ndr_get_array_size(ndr, &r->entry_path);
++ length_entry_path_1 = ndr_get_array_length(ndr, &r->entry_path);
++ if (length_entry_path_1 > size_entry_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_entry_path_1, length_entry_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->entry_path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->entry_path, ndr_get_array_length(ndr, &r->entry_path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_entry_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->entry_path, length_entry_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entry_path_0, 0);
+ }
+ if (r->comment) {
+@@ -1033,24 +1088,27 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ if (r->stores) {
+ _mem_save_stores_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->stores, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->stores));
+- NDR_PULL_ALLOC_N(ndr, r->stores, ndr_get_array_size(ndr, &r->stores));
++ size_stores_1 = ndr_get_array_size(ndr, &r->stores);
++ NDR_PULL_ALLOC_N(ndr, r->stores, size_stores_1);
+ _mem_save_stores_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->stores, 0);
+- for (cntr_stores_1 = 0; cntr_stores_1 < r->num_stores; cntr_stores_1++) {
++ for (cntr_stores_1 = 0; cntr_stores_1 < size_stores_1; cntr_stores_1++) {
+ NDR_CHECK(ndr_pull_dfs_StorageInfo2(ndr, NDR_SCALARS, &r->stores[cntr_stores_1]));
+ }
+- for (cntr_stores_1 = 0; cntr_stores_1 < r->num_stores; cntr_stores_1++) {
++ for (cntr_stores_1 = 0; cntr_stores_1 < size_stores_1; cntr_stores_1++) {
+ NDR_CHECK(ndr_pull_dfs_StorageInfo2(ndr, NDR_BUFFERS, &r->stores[cntr_stores_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_stores_1, 0);
+@@ -1157,6 +1215,8 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info100(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info100 *r)
+ {
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -1174,11 +1234,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -1351,6 +1413,8 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info105(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info105 *r)
+ {
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -1372,11 +1436,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -1456,6 +1522,8 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info200(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info200 *r)
+ {
+ uint32_t _ptr_dom_root;
++ uint32_t size_dom_root_1 = 0;
++ uint32_t length_dom_root_1 = 0;
+ TALLOC_CTX *_mem_save_dom_root_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -1473,11 +1541,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->dom_root, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dom_root));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dom_root));
+- if (ndr_get_array_length(ndr, &r->dom_root) > ndr_get_array_size(ndr, &r->dom_root)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dom_root), ndr_get_array_length(ndr, &r->dom_root));
++ size_dom_root_1 = ndr_get_array_size(ndr, &r->dom_root);
++ length_dom_root_1 = ndr_get_array_length(ndr, &r->dom_root);
++ if (length_dom_root_1 > size_dom_root_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dom_root_1, length_dom_root_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dom_root), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dom_root, ndr_get_array_length(ndr, &r->dom_root), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dom_root_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dom_root, length_dom_root_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dom_root_0, 0);
+ }
+ }
+@@ -1544,6 +1614,8 @@ static enum ndr_err_code ndr_push_dfs_In
+ static enum ndr_err_code ndr_pull_dfs_Info300(struct ndr_pull *ndr, int ndr_flags, struct dfs_Info300 *r)
+ {
+ uint32_t _ptr_dom_root;
++ uint32_t size_dom_root_1 = 0;
++ uint32_t length_dom_root_1 = 0;
+ TALLOC_CTX *_mem_save_dom_root_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -1562,11 +1634,13 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_PULL_SET_MEM_CTX(ndr, r->dom_root, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->dom_root));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->dom_root));
+- if (ndr_get_array_length(ndr, &r->dom_root) > ndr_get_array_size(ndr, &r->dom_root)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dom_root), ndr_get_array_length(ndr, &r->dom_root));
++ size_dom_root_1 = ndr_get_array_size(ndr, &r->dom_root);
++ length_dom_root_1 = ndr_get_array_length(ndr, &r->dom_root);
++ if (length_dom_root_1 > size_dom_root_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dom_root_1, length_dom_root_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dom_root), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dom_root, ndr_get_array_length(ndr, &r->dom_root), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dom_root_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dom_root, length_dom_root_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dom_root_0, 0);
+ }
+ }
+@@ -1763,20 +1837,35 @@ static enum ndr_err_code ndr_pull_dfs_In
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info0_0;
++ uint32_t _ptr_info0;
+ TALLOC_CTX *_mem_save_info1_0;
++ uint32_t _ptr_info1;
+ TALLOC_CTX *_mem_save_info2_0;
++ uint32_t _ptr_info2;
+ TALLOC_CTX *_mem_save_info3_0;
++ uint32_t _ptr_info3;
+ TALLOC_CTX *_mem_save_info4_0;
++ uint32_t _ptr_info4;
+ TALLOC_CTX *_mem_save_info5_0;
++ uint32_t _ptr_info5;
+ TALLOC_CTX *_mem_save_info6_0;
++ uint32_t _ptr_info6;
+ TALLOC_CTX *_mem_save_info7_0;
++ uint32_t _ptr_info7;
+ TALLOC_CTX *_mem_save_info100_0;
++ uint32_t _ptr_info100;
+ TALLOC_CTX *_mem_save_info101_0;
++ uint32_t _ptr_info101;
+ TALLOC_CTX *_mem_save_info102_0;
++ uint32_t _ptr_info102;
+ TALLOC_CTX *_mem_save_info103_0;
++ uint32_t _ptr_info103;
+ TALLOC_CTX *_mem_save_info104_0;
++ uint32_t _ptr_info104;
+ TALLOC_CTX *_mem_save_info105_0;
++ uint32_t _ptr_info105;
+ TALLOC_CTX *_mem_save_info106_0;
++ uint32_t _ptr_info106;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -1786,7 +1875,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_info0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info0));
+ if (_ptr_info0) {
+ NDR_PULL_ALLOC(ndr, r->info0);
+@@ -1796,7 +1884,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 1: {
+- uint32_t _ptr_info1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1));
+ if (_ptr_info1) {
+ NDR_PULL_ALLOC(ndr, r->info1);
+@@ -1806,7 +1893,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 2: {
+- uint32_t _ptr_info2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info2));
+ if (_ptr_info2) {
+ NDR_PULL_ALLOC(ndr, r->info2);
+@@ -1816,7 +1902,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 3: {
+- uint32_t _ptr_info3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info3));
+ if (_ptr_info3) {
+ NDR_PULL_ALLOC(ndr, r->info3);
+@@ -1826,7 +1911,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 4: {
+- uint32_t _ptr_info4;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info4));
+ if (_ptr_info4) {
+ NDR_PULL_ALLOC(ndr, r->info4);
+@@ -1836,7 +1920,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 5: {
+- uint32_t _ptr_info5;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info5));
+ if (_ptr_info5) {
+ NDR_PULL_ALLOC(ndr, r->info5);
+@@ -1846,7 +1929,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 6: {
+- uint32_t _ptr_info6;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info6));
+ if (_ptr_info6) {
+ NDR_PULL_ALLOC(ndr, r->info6);
+@@ -1856,7 +1938,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 7: {
+- uint32_t _ptr_info7;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info7));
+ if (_ptr_info7) {
+ NDR_PULL_ALLOC(ndr, r->info7);
+@@ -1866,7 +1947,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 100: {
+- uint32_t _ptr_info100;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info100));
+ if (_ptr_info100) {
+ NDR_PULL_ALLOC(ndr, r->info100);
+@@ -1876,7 +1956,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 101: {
+- uint32_t _ptr_info101;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info101));
+ if (_ptr_info101) {
+ NDR_PULL_ALLOC(ndr, r->info101);
+@@ -1886,7 +1965,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 102: {
+- uint32_t _ptr_info102;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info102));
+ if (_ptr_info102) {
+ NDR_PULL_ALLOC(ndr, r->info102);
+@@ -1896,7 +1974,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 103: {
+- uint32_t _ptr_info103;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info103));
+ if (_ptr_info103) {
+ NDR_PULL_ALLOC(ndr, r->info103);
+@@ -1906,7 +1983,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 104: {
+- uint32_t _ptr_info104;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info104));
+ if (_ptr_info104) {
+ NDR_PULL_ALLOC(ndr, r->info104);
+@@ -1916,7 +1992,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 105: {
+- uint32_t _ptr_info105;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info105));
+ if (_ptr_info105) {
+ NDR_PULL_ALLOC(ndr, r->info105);
+@@ -1926,7 +2001,6 @@ static enum ndr_err_code ndr_pull_dfs_In
+ break; }
+
+ case 106: {
+- uint32_t _ptr_info106;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info106));
+ if (_ptr_info106) {
+ NDR_PULL_ALLOC(ndr, r->info106);
+@@ -2255,6 +2329,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray1(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray1 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2274,13 +2349,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info1(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info1(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -2343,6 +2419,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray2(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray2 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2362,13 +2439,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info2(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info2(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -2431,6 +2509,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray3(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray3 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2450,13 +2529,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info3(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info3(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -2519,6 +2599,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray4(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray4 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2538,13 +2619,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info4(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info4(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -2607,6 +2689,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray5(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray5 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2626,13 +2709,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info5(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info5(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -2695,6 +2779,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray6(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray6 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2714,13 +2799,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info6(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info6(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -2783,6 +2869,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray200(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray200 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2802,13 +2889,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info200(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info200(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -2871,6 +2959,7 @@ static enum ndr_err_code ndr_push_dfs_En
+ static enum ndr_err_code ndr_pull_dfs_EnumArray300(struct ndr_pull *ndr, int ndr_flags, struct dfs_EnumArray300 *r)
+ {
+ uint32_t _ptr_s;
++ uint32_t size_s_1 = 0;
+ uint32_t cntr_s_1;
+ TALLOC_CTX *_mem_save_s_0;
+ TALLOC_CTX *_mem_save_s_1;
+@@ -2890,13 +2979,14 @@ static enum ndr_err_code ndr_pull_dfs_En
+ _mem_save_s_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->s));
+- NDR_PULL_ALLOC_N(ndr, r->s, ndr_get_array_size(ndr, &r->s));
++ size_s_1 = ndr_get_array_size(ndr, &r->s);
++ NDR_PULL_ALLOC_N(ndr, r->s, size_s_1);
+ _mem_save_s_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->s, 0);
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info300(ndr, NDR_SCALARS, &r->s[cntr_s_1]));
+ }
+- for (cntr_s_1 = 0; cntr_s_1 < r->count; cntr_s_1++) {
++ for (cntr_s_1 = 0; cntr_s_1 < size_s_1; cntr_s_1++) {
+ NDR_CHECK(ndr_pull_dfs_Info300(ndr, NDR_BUFFERS, &r->s[cntr_s_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_s_1, 0);
+@@ -3039,13 +3129,21 @@ static enum ndr_err_code ndr_pull_dfs_En
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info1_0;
++ uint32_t _ptr_info1;
+ TALLOC_CTX *_mem_save_info2_0;
++ uint32_t _ptr_info2;
+ TALLOC_CTX *_mem_save_info3_0;
++ uint32_t _ptr_info3;
+ TALLOC_CTX *_mem_save_info4_0;
++ uint32_t _ptr_info4;
+ TALLOC_CTX *_mem_save_info5_0;
++ uint32_t _ptr_info5;
+ TALLOC_CTX *_mem_save_info6_0;
++ uint32_t _ptr_info6;
+ TALLOC_CTX *_mem_save_info200_0;
++ uint32_t _ptr_info200;
+ TALLOC_CTX *_mem_save_info300_0;
++ uint32_t _ptr_info300;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -3055,7 +3153,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 1: {
+- uint32_t _ptr_info1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1));
+ if (_ptr_info1) {
+ NDR_PULL_ALLOC(ndr, r->info1);
+@@ -3065,7 +3162,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ break; }
+
+ case 2: {
+- uint32_t _ptr_info2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info2));
+ if (_ptr_info2) {
+ NDR_PULL_ALLOC(ndr, r->info2);
+@@ -3075,7 +3171,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ break; }
+
+ case 3: {
+- uint32_t _ptr_info3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info3));
+ if (_ptr_info3) {
+ NDR_PULL_ALLOC(ndr, r->info3);
+@@ -3085,7 +3180,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ break; }
+
+ case 4: {
+- uint32_t _ptr_info4;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info4));
+ if (_ptr_info4) {
+ NDR_PULL_ALLOC(ndr, r->info4);
+@@ -3095,7 +3189,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ break; }
+
+ case 5: {
+- uint32_t _ptr_info5;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info5));
+ if (_ptr_info5) {
+ NDR_PULL_ALLOC(ndr, r->info5);
+@@ -3105,7 +3198,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ break; }
+
+ case 6: {
+- uint32_t _ptr_info6;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info6));
+ if (_ptr_info6) {
+ NDR_PULL_ALLOC(ndr, r->info6);
+@@ -3115,7 +3207,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ break; }
+
+ case 200: {
+- uint32_t _ptr_info200;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info200));
+ if (_ptr_info200) {
+ NDR_PULL_ALLOC(ndr, r->info200);
+@@ -3125,7 +3216,6 @@ static enum ndr_err_code ndr_pull_dfs_En
+ break; }
+
+ case 300: {
+- uint32_t _ptr_info300;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info300));
+ if (_ptr_info300) {
+ NDR_PULL_ALLOC(ndr, r->info300);
+@@ -3364,6 +3454,8 @@ static enum ndr_err_code ndr_push_dfs_Un
+ static enum ndr_err_code ndr_pull_dfs_UnknownStruct(struct ndr_pull *ndr, int ndr_flags, struct dfs_UnknownStruct *r)
+ {
+ uint32_t _ptr_unknown2;
++ uint32_t size_unknown2_1 = 0;
++ uint32_t length_unknown2_1 = 0;
+ TALLOC_CTX *_mem_save_unknown2_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3382,11 +3474,13 @@ static enum ndr_err_code ndr_pull_dfs_Un
+ NDR_PULL_SET_MEM_CTX(ndr, r->unknown2, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->unknown2));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->unknown2));
+- if (ndr_get_array_length(ndr, &r->unknown2) > ndr_get_array_size(ndr, &r->unknown2)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->unknown2), ndr_get_array_length(ndr, &r->unknown2));
++ size_unknown2_1 = ndr_get_array_size(ndr, &r->unknown2);
++ length_unknown2_1 = ndr_get_array_length(ndr, &r->unknown2);
++ if (length_unknown2_1 > size_unknown2_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown2_1, length_unknown2_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->unknown2), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->unknown2, ndr_get_array_length(ndr, &r->unknown2), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown2_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->unknown2, length_unknown2_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown2_0, 0);
+ }
+ }
+@@ -3506,25 +3600,37 @@ static enum ndr_err_code ndr_push_dfs_Ad
+
+ static enum ndr_err_code ndr_pull_dfs_Add(struct ndr_pull *ndr, int flags, struct dfs_Add *r)
+ {
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
++ uint32_t size_server_1 = 0;
++ uint32_t length_server_1 = 0;
+ uint32_t _ptr_share;
++ uint32_t size_share_1 = 0;
++ uint32_t length_share_1 = 0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_share_0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.path));
+- if (ndr_get_array_length(ndr, &r->in.path) > ndr_get_array_size(ndr, &r->in.path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.path), ndr_get_array_length(ndr, &r->in.path));
++ size_path_1 = ndr_get_array_size(ndr, &r->in.path);
++ length_path_1 = ndr_get_array_length(ndr, &r->in.path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server));
+- if (ndr_get_array_length(ndr, &r->in.server) > ndr_get_array_size(ndr, &r->in.server)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server), ndr_get_array_length(ndr, &r->in.server));
++ size_server_1 = ndr_get_array_size(ndr, &r->in.server);
++ length_server_1 = ndr_get_array_length(ndr, &r->in.server);
++ if (length_server_1 > size_server_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_1, length_server_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server, ndr_get_array_length(ndr, &r->in.server), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server, length_server_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_share));
+ if (_ptr_share) {
+ NDR_PULL_ALLOC(ndr, r->in.share);
+@@ -3536,11 +3642,13 @@ static enum ndr_err_code ndr_pull_dfs_Ad
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.share, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share));
+- if (ndr_get_array_length(ndr, &r->in.share) > ndr_get_array_size(ndr, &r->in.share)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share), ndr_get_array_length(ndr, &r->in.share));
++ size_share_1 = ndr_get_array_size(ndr, &r->in.share);
++ length_share_1 = ndr_get_array_length(ndr, &r->in.share);
++ if (length_share_1 > size_share_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_1, length_share_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, length_share_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_share_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_comment));
+@@ -3554,11 +3662,13 @@ static enum ndr_err_code ndr_pull_dfs_Ad
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.comment));
+- if (ndr_get_array_length(ndr, &r->in.comment) > ndr_get_array_size(ndr, &r->in.comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.comment), ndr_get_array_length(ndr, &r->in.comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->in.comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->in.comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+@@ -3644,18 +3754,26 @@ static enum ndr_err_code ndr_push_dfs_Re
+
+ static enum ndr_err_code ndr_pull_dfs_Remove(struct ndr_pull *ndr, int flags, struct dfs_Remove *r)
+ {
++ uint32_t size_dfs_entry_path_1 = 0;
++ uint32_t length_dfs_entry_path_1 = 0;
+ uint32_t _ptr_servername;
++ uint32_t size_servername_1 = 0;
++ uint32_t length_servername_1 = 0;
+ uint32_t _ptr_sharename;
++ uint32_t size_sharename_1 = 0;
++ uint32_t length_sharename_1 = 0;
+ TALLOC_CTX *_mem_save_servername_0;
+ TALLOC_CTX *_mem_save_sharename_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dfs_entry_path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dfs_entry_path));
+- if (ndr_get_array_length(ndr, &r->in.dfs_entry_path) > ndr_get_array_size(ndr, &r->in.dfs_entry_path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dfs_entry_path), ndr_get_array_length(ndr, &r->in.dfs_entry_path));
++ size_dfs_entry_path_1 = ndr_get_array_size(ndr, &r->in.dfs_entry_path);
++ length_dfs_entry_path_1 = ndr_get_array_length(ndr, &r->in.dfs_entry_path);
++ if (length_dfs_entry_path_1 > size_dfs_entry_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dfs_entry_path_1, length_dfs_entry_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dfs_entry_path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_entry_path, ndr_get_array_length(ndr, &r->in.dfs_entry_path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dfs_entry_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_entry_path, length_dfs_entry_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_servername));
+ if (_ptr_servername) {
+ NDR_PULL_ALLOC(ndr, r->in.servername);
+@@ -3667,11 +3785,13 @@ static enum ndr_err_code ndr_pull_dfs_Re
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.servername, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_1 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_1 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_1 > size_servername_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_1, length_servername_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_servername_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sharename));
+@@ -3685,11 +3805,13 @@ static enum ndr_err_code ndr_pull_dfs_Re
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.sharename, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.sharename));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.sharename));
+- if (ndr_get_array_length(ndr, &r->in.sharename) > ndr_get_array_size(ndr, &r->in.sharename)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.sharename), ndr_get_array_length(ndr, &r->in.sharename));
++ size_sharename_1 = ndr_get_array_size(ndr, &r->in.sharename);
++ length_sharename_1 = ndr_get_array_length(ndr, &r->in.sharename);
++ if (length_sharename_1 > size_sharename_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_sharename_1, length_sharename_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.sharename), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.sharename, ndr_get_array_length(ndr, &r->in.sharename), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_sharename_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.sharename, length_sharename_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sharename_0, 0);
+ }
+ }
+@@ -3772,19 +3894,27 @@ static enum ndr_err_code ndr_push_dfs_Se
+
+ static enum ndr_err_code ndr_pull_dfs_SetInfo(struct ndr_pull *ndr, int flags, struct dfs_SetInfo *r)
+ {
++ uint32_t size_dfs_entry_path_0 = 0;
++ uint32_t length_dfs_entry_path_0 = 0;
+ uint32_t _ptr_servername;
++ uint32_t size_servername_1 = 0;
++ uint32_t length_servername_1 = 0;
+ uint32_t _ptr_sharename;
++ uint32_t size_sharename_1 = 0;
++ uint32_t length_sharename_1 = 0;
+ TALLOC_CTX *_mem_save_servername_0;
+ TALLOC_CTX *_mem_save_sharename_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dfs_entry_path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dfs_entry_path));
+- if (ndr_get_array_length(ndr, &r->in.dfs_entry_path) > ndr_get_array_size(ndr, &r->in.dfs_entry_path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dfs_entry_path), ndr_get_array_length(ndr, &r->in.dfs_entry_path));
++ size_dfs_entry_path_0 = ndr_get_array_size(ndr, &r->in.dfs_entry_path);
++ length_dfs_entry_path_0 = ndr_get_array_length(ndr, &r->in.dfs_entry_path);
++ if (length_dfs_entry_path_0 > size_dfs_entry_path_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dfs_entry_path_0, length_dfs_entry_path_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dfs_entry_path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_entry_path, ndr_get_array_length(ndr, &r->in.dfs_entry_path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dfs_entry_path_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_entry_path, length_dfs_entry_path_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_servername));
+ if (_ptr_servername) {
+ NDR_PULL_ALLOC(ndr, r->in.servername);
+@@ -3796,11 +3926,13 @@ static enum ndr_err_code ndr_pull_dfs_Se
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.servername, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_1 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_1 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_1 > size_servername_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_1, length_servername_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_servername_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sharename));
+@@ -3814,11 +3946,13 @@ static enum ndr_err_code ndr_pull_dfs_Se
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.sharename, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.sharename));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.sharename));
+- if (ndr_get_array_length(ndr, &r->in.sharename) > ndr_get_array_size(ndr, &r->in.sharename)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.sharename), ndr_get_array_length(ndr, &r->in.sharename));
++ size_sharename_1 = ndr_get_array_size(ndr, &r->in.sharename);
++ length_sharename_1 = ndr_get_array_length(ndr, &r->in.sharename);
++ if (length_sharename_1 > size_sharename_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_sharename_1, length_sharename_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.sharename), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.sharename, ndr_get_array_length(ndr, &r->in.sharename), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_sharename_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.sharename, length_sharename_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sharename_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -3913,8 +4047,14 @@ static enum ndr_err_code ndr_push_dfs_Ge
+
+ static enum ndr_err_code ndr_pull_dfs_GetInfo(struct ndr_pull *ndr, int flags, struct dfs_GetInfo *r)
+ {
++ uint32_t size_dfs_entry_path_0 = 0;
++ uint32_t length_dfs_entry_path_0 = 0;
+ uint32_t _ptr_servername;
++ uint32_t size_servername_1 = 0;
++ uint32_t length_servername_1 = 0;
+ uint32_t _ptr_sharename;
++ uint32_t size_sharename_1 = 0;
++ uint32_t length_sharename_1 = 0;
+ TALLOC_CTX *_mem_save_servername_0;
+ TALLOC_CTX *_mem_save_sharename_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -3923,11 +4063,13 @@ static enum ndr_err_code ndr_pull_dfs_Ge
+
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dfs_entry_path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dfs_entry_path));
+- if (ndr_get_array_length(ndr, &r->in.dfs_entry_path) > ndr_get_array_size(ndr, &r->in.dfs_entry_path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dfs_entry_path), ndr_get_array_length(ndr, &r->in.dfs_entry_path));
++ size_dfs_entry_path_0 = ndr_get_array_size(ndr, &r->in.dfs_entry_path);
++ length_dfs_entry_path_0 = ndr_get_array_length(ndr, &r->in.dfs_entry_path);
++ if (length_dfs_entry_path_0 > size_dfs_entry_path_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dfs_entry_path_0, length_dfs_entry_path_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dfs_entry_path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_entry_path, ndr_get_array_length(ndr, &r->in.dfs_entry_path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dfs_entry_path_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_entry_path, length_dfs_entry_path_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_servername));
+ if (_ptr_servername) {
+ NDR_PULL_ALLOC(ndr, r->in.servername);
+@@ -3939,11 +4081,13 @@ static enum ndr_err_code ndr_pull_dfs_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.servername, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_1 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_1 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_1 > size_servername_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_1, length_servername_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_servername_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sharename));
+@@ -3957,11 +4101,13 @@ static enum ndr_err_code ndr_pull_dfs_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.sharename, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.sharename));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.sharename));
+- if (ndr_get_array_length(ndr, &r->in.sharename) > ndr_get_array_size(ndr, &r->in.sharename)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.sharename), ndr_get_array_length(ndr, &r->in.sharename));
++ size_sharename_1 = ndr_get_array_size(ndr, &r->in.sharename);
++ length_sharename_1 = ndr_get_array_length(ndr, &r->in.sharename);
++ if (length_sharename_1 > size_sharename_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_sharename_1, length_sharename_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.sharename), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.sharename, ndr_get_array_length(ndr, &r->in.sharename), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_sharename_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.sharename, length_sharename_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sharename_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -4379,6 +4525,18 @@ static enum ndr_err_code ndr_push_dfs_Ad
+
+ static enum ndr_err_code ndr_pull_dfs_AddFtRoot(struct ndr_pull *ndr, int flags, struct dfs_AddFtRoot *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
++ uint32_t size_dns_servername_0 = 0;
++ uint32_t length_dns_servername_0 = 0;
++ uint32_t size_dfsname_0 = 0;
++ uint32_t length_dfsname_0 = 0;
++ uint32_t size_rootshare_0 = 0;
++ uint32_t length_rootshare_0 = 0;
++ uint32_t size_comment_0 = 0;
++ uint32_t length_comment_0 = 0;
++ uint32_t size_dfs_config_dn_0 = 0;
++ uint32_t length_dfs_config_dn_0 = 0;
+ uint32_t _ptr_unknown2;
+ TALLOC_CTX *_mem_save_unknown2_0;
+ TALLOC_CTX *_mem_save_unknown2_1;
+@@ -4387,46 +4545,58 @@ static enum ndr_err_code ndr_pull_dfs_Ad
+
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dns_servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dns_servername));
+- if (ndr_get_array_length(ndr, &r->in.dns_servername) > ndr_get_array_size(ndr, &r->in.dns_servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dns_servername), ndr_get_array_length(ndr, &r->in.dns_servername));
++ size_dns_servername_0 = ndr_get_array_size(ndr, &r->in.dns_servername);
++ length_dns_servername_0 = ndr_get_array_length(ndr, &r->in.dns_servername);
++ if (length_dns_servername_0 > size_dns_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dns_servername_0, length_dns_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dns_servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dns_servername, ndr_get_array_length(ndr, &r->in.dns_servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dns_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dns_servername, length_dns_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dfsname));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dfsname));
+- if (ndr_get_array_length(ndr, &r->in.dfsname) > ndr_get_array_size(ndr, &r->in.dfsname)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dfsname), ndr_get_array_length(ndr, &r->in.dfsname));
++ size_dfsname_0 = ndr_get_array_size(ndr, &r->in.dfsname);
++ length_dfsname_0 = ndr_get_array_length(ndr, &r->in.dfsname);
++ if (length_dfsname_0 > size_dfsname_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dfsname_0, length_dfsname_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dfsname), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfsname, ndr_get_array_length(ndr, &r->in.dfsname), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dfsname_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfsname, length_dfsname_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.rootshare));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.rootshare));
+- if (ndr_get_array_length(ndr, &r->in.rootshare) > ndr_get_array_size(ndr, &r->in.rootshare)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.rootshare), ndr_get_array_length(ndr, &r->in.rootshare));
++ size_rootshare_0 = ndr_get_array_size(ndr, &r->in.rootshare);
++ length_rootshare_0 = ndr_get_array_length(ndr, &r->in.rootshare);
++ if (length_rootshare_0 > size_rootshare_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_rootshare_0, length_rootshare_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_rootshare_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, length_rootshare_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.comment));
+- if (ndr_get_array_length(ndr, &r->in.comment) > ndr_get_array_size(ndr, &r->in.comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.comment), ndr_get_array_length(ndr, &r->in.comment));
++ size_comment_0 = ndr_get_array_size(ndr, &r->in.comment);
++ length_comment_0 = ndr_get_array_length(ndr, &r->in.comment);
++ if (length_comment_0 > size_comment_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_0, length_comment_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, length_comment_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dfs_config_dn));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dfs_config_dn));
+- if (ndr_get_array_length(ndr, &r->in.dfs_config_dn) > ndr_get_array_size(ndr, &r->in.dfs_config_dn)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dfs_config_dn), ndr_get_array_length(ndr, &r->in.dfs_config_dn));
++ size_dfs_config_dn_0 = ndr_get_array_size(ndr, &r->in.dfs_config_dn);
++ length_dfs_config_dn_0 = ndr_get_array_length(ndr, &r->in.dfs_config_dn);
++ if (length_dfs_config_dn_0 > size_dfs_config_dn_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dfs_config_dn_0, length_dfs_config_dn_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dfs_config_dn), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_config_dn, ndr_get_array_length(ndr, &r->in.dfs_config_dn), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dfs_config_dn_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_config_dn, length_dfs_config_dn_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->in.unknown1));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_unknown2));
+@@ -4576,6 +4746,14 @@ static enum ndr_err_code ndr_push_dfs_Re
+
+ static enum ndr_err_code ndr_pull_dfs_RemoveFtRoot(struct ndr_pull *ndr, int flags, struct dfs_RemoveFtRoot *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
++ uint32_t size_dns_servername_0 = 0;
++ uint32_t length_dns_servername_0 = 0;
++ uint32_t size_dfsname_0 = 0;
++ uint32_t length_dfsname_0 = 0;
++ uint32_t size_rootshare_0 = 0;
++ uint32_t length_rootshare_0 = 0;
+ uint32_t _ptr_unknown;
+ TALLOC_CTX *_mem_save_unknown_0;
+ TALLOC_CTX *_mem_save_unknown_1;
+@@ -4584,32 +4762,40 @@ static enum ndr_err_code ndr_pull_dfs_Re
+
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dns_servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dns_servername));
+- if (ndr_get_array_length(ndr, &r->in.dns_servername) > ndr_get_array_size(ndr, &r->in.dns_servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dns_servername), ndr_get_array_length(ndr, &r->in.dns_servername));
++ size_dns_servername_0 = ndr_get_array_size(ndr, &r->in.dns_servername);
++ length_dns_servername_0 = ndr_get_array_length(ndr, &r->in.dns_servername);
++ if (length_dns_servername_0 > size_dns_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dns_servername_0, length_dns_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dns_servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dns_servername, ndr_get_array_length(ndr, &r->in.dns_servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dns_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dns_servername, length_dns_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dfsname));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dfsname));
+- if (ndr_get_array_length(ndr, &r->in.dfsname) > ndr_get_array_size(ndr, &r->in.dfsname)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dfsname), ndr_get_array_length(ndr, &r->in.dfsname));
++ size_dfsname_0 = ndr_get_array_size(ndr, &r->in.dfsname);
++ length_dfsname_0 = ndr_get_array_length(ndr, &r->in.dfsname);
++ if (length_dfsname_0 > size_dfsname_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dfsname_0, length_dfsname_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dfsname), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfsname, ndr_get_array_length(ndr, &r->in.dfsname), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dfsname_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfsname, length_dfsname_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.rootshare));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.rootshare));
+- if (ndr_get_array_length(ndr, &r->in.rootshare) > ndr_get_array_size(ndr, &r->in.rootshare)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.rootshare), ndr_get_array_length(ndr, &r->in.rootshare));
++ size_rootshare_0 = ndr_get_array_size(ndr, &r->in.rootshare);
++ length_rootshare_0 = ndr_get_array_length(ndr, &r->in.rootshare);
++ if (length_rootshare_0 > size_rootshare_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_rootshare_0, length_rootshare_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_rootshare_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, length_rootshare_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_unknown));
+ if (_ptr_unknown) {
+@@ -4737,28 +4923,40 @@ static enum ndr_err_code ndr_push_dfs_Ad
+
+ static enum ndr_err_code ndr_pull_dfs_AddStdRoot(struct ndr_pull *ndr, int flags, struct dfs_AddStdRoot *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
++ uint32_t size_rootshare_0 = 0;
++ uint32_t length_rootshare_0 = 0;
++ uint32_t size_comment_0 = 0;
++ uint32_t length_comment_0 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.rootshare));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.rootshare));
+- if (ndr_get_array_length(ndr, &r->in.rootshare) > ndr_get_array_size(ndr, &r->in.rootshare)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.rootshare), ndr_get_array_length(ndr, &r->in.rootshare));
++ size_rootshare_0 = ndr_get_array_size(ndr, &r->in.rootshare);
++ length_rootshare_0 = ndr_get_array_length(ndr, &r->in.rootshare);
++ if (length_rootshare_0 > size_rootshare_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_rootshare_0, length_rootshare_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_rootshare_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, length_rootshare_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.comment));
+- if (ndr_get_array_length(ndr, &r->in.comment) > ndr_get_array_size(ndr, &r->in.comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.comment), ndr_get_array_length(ndr, &r->in.comment));
++ size_comment_0 = ndr_get_array_size(ndr, &r->in.comment);
++ length_comment_0 = ndr_get_array_length(ndr, &r->in.comment);
++ if (length_comment_0 > size_comment_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_0, length_comment_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, length_comment_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ }
+ if (flags & NDR_OUT) {
+@@ -4813,21 +5011,29 @@ static enum ndr_err_code ndr_push_dfs_Re
+
+ static enum ndr_err_code ndr_pull_dfs_RemoveStdRoot(struct ndr_pull *ndr, int flags, struct dfs_RemoveStdRoot *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
++ uint32_t size_rootshare_0 = 0;
++ uint32_t length_rootshare_0 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.rootshare));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.rootshare));
+- if (ndr_get_array_length(ndr, &r->in.rootshare) > ndr_get_array_size(ndr, &r->in.rootshare)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.rootshare), ndr_get_array_length(ndr, &r->in.rootshare));
++ size_rootshare_0 = ndr_get_array_size(ndr, &r->in.rootshare);
++ length_rootshare_0 = ndr_get_array_length(ndr, &r->in.rootshare);
++ if (length_rootshare_0 > size_rootshare_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_rootshare_0, length_rootshare_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_rootshare_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, length_rootshare_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ }
+ if (flags & NDR_OUT) {
+@@ -4880,14 +5086,18 @@ static enum ndr_err_code ndr_push_dfs_Ma
+
+ static enum ndr_err_code ndr_pull_dfs_ManagerInitialize(struct ndr_pull *ndr, int flags, struct dfs_ManagerInitialize *r)
+ {
++ uint32_t size_servername_1 = 0;
++ uint32_t length_servername_1 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_1 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_1 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_1 > size_servername_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_1, length_servername_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ }
+ if (flags & NDR_OUT) {
+@@ -4950,35 +5160,51 @@ static enum ndr_err_code ndr_push_dfs_Ad
+
+ static enum ndr_err_code ndr_pull_dfs_AddStdRootForced(struct ndr_pull *ndr, int flags, struct dfs_AddStdRootForced *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
++ uint32_t size_rootshare_0 = 0;
++ uint32_t length_rootshare_0 = 0;
++ uint32_t size_comment_0 = 0;
++ uint32_t length_comment_0 = 0;
++ uint32_t size_store_0 = 0;
++ uint32_t length_store_0 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.rootshare));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.rootshare));
+- if (ndr_get_array_length(ndr, &r->in.rootshare) > ndr_get_array_size(ndr, &r->in.rootshare)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.rootshare), ndr_get_array_length(ndr, &r->in.rootshare));
++ size_rootshare_0 = ndr_get_array_size(ndr, &r->in.rootshare);
++ length_rootshare_0 = ndr_get_array_length(ndr, &r->in.rootshare);
++ if (length_rootshare_0 > size_rootshare_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_rootshare_0, length_rootshare_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_rootshare_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, length_rootshare_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.comment));
+- if (ndr_get_array_length(ndr, &r->in.comment) > ndr_get_array_size(ndr, &r->in.comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.comment), ndr_get_array_length(ndr, &r->in.comment));
++ size_comment_0 = ndr_get_array_size(ndr, &r->in.comment);
++ length_comment_0 = ndr_get_array_length(ndr, &r->in.comment);
++ if (length_comment_0 > size_comment_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_0, length_comment_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, ndr_get_array_length(ndr, &r->in.comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.comment, length_comment_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.store));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.store));
+- if (ndr_get_array_length(ndr, &r->in.store) > ndr_get_array_size(ndr, &r->in.store)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.store), ndr_get_array_length(ndr, &r->in.store));
++ size_store_0 = ndr_get_array_size(ndr, &r->in.store);
++ length_store_0 = ndr_get_array_length(ndr, &r->in.store);
++ if (length_store_0 > size_store_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_store_0, length_store_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.store), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.store, ndr_get_array_length(ndr, &r->in.store), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_store_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.store, length_store_0, sizeof(uint16_t), CH_UTF16));
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->out.result));
+@@ -5063,7 +5289,11 @@ static enum ndr_err_code ndr_push_dfs_Ge
+
+ static enum ndr_err_code ndr_pull_dfs_GetDcAddress(struct ndr_pull *ndr, int flags, struct dfs_GetDcAddress *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
+ uint32_t _ptr_server_fullname;
++ uint32_t size_server_fullname_2 = 0;
++ uint32_t length_server_fullname_2 = 0;
+ TALLOC_CTX *_mem_save_server_fullname_0;
+ TALLOC_CTX *_mem_save_server_fullname_1;
+ TALLOC_CTX *_mem_save_is_root_0;
+@@ -5073,11 +5303,13 @@ static enum ndr_err_code ndr_pull_dfs_Ge
+
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->in.server_fullname);
+ }
+@@ -5094,11 +5326,13 @@ static enum ndr_err_code ndr_pull_dfs_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, *r->in.server_fullname, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->in.server_fullname));
+ NDR_CHECK(ndr_pull_array_length(ndr, r->in.server_fullname));
+- if (ndr_get_array_length(ndr, r->in.server_fullname) > ndr_get_array_size(ndr, r->in.server_fullname)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, r->in.server_fullname), ndr_get_array_length(ndr, r->in.server_fullname));
++ size_server_fullname_2 = ndr_get_array_size(ndr, r->in.server_fullname);
++ length_server_fullname_2 = ndr_get_array_length(ndr, r->in.server_fullname);
++ if (length_server_fullname_2 > size_server_fullname_2) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_fullname_2, length_server_fullname_2);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, r->in.server_fullname), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->in.server_fullname, ndr_get_array_length(ndr, r->in.server_fullname), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_fullname_2, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->in.server_fullname, length_server_fullname_2, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_fullname_1, 0);
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_fullname_0, LIBNDR_FLAG_REF_ALLOC);
+@@ -5140,11 +5374,13 @@ static enum ndr_err_code ndr_pull_dfs_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.server_fullname, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->out.server_fullname));
+ NDR_CHECK(ndr_pull_array_length(ndr, r->out.server_fullname));
+- if (ndr_get_array_length(ndr, r->out.server_fullname) > ndr_get_array_size(ndr, r->out.server_fullname)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, r->out.server_fullname), ndr_get_array_length(ndr, r->out.server_fullname));
++ size_server_fullname_2 = ndr_get_array_size(ndr, r->out.server_fullname);
++ length_server_fullname_2 = ndr_get_array_length(ndr, r->out.server_fullname);
++ if (length_server_fullname_2 > size_server_fullname_2) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_fullname_2, length_server_fullname_2);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, r->out.server_fullname), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.server_fullname, ndr_get_array_length(ndr, r->out.server_fullname), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_fullname_2, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.server_fullname, length_server_fullname_2, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_fullname_1, 0);
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_fullname_0, LIBNDR_FLAG_REF_ALLOC);
+@@ -5245,21 +5481,29 @@ static enum ndr_err_code ndr_push_dfs_Se
+
+ static enum ndr_err_code ndr_pull_dfs_SetDcAddress(struct ndr_pull *ndr, int flags, struct dfs_SetDcAddress *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
++ uint32_t size_server_fullname_0 = 0;
++ uint32_t length_server_fullname_0 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_fullname));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_fullname));
+- if (ndr_get_array_length(ndr, &r->in.server_fullname) > ndr_get_array_size(ndr, &r->in.server_fullname)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_fullname), ndr_get_array_length(ndr, &r->in.server_fullname));
++ size_server_fullname_0 = ndr_get_array_size(ndr, &r->in.server_fullname);
++ length_server_fullname_0 = ndr_get_array_length(ndr, &r->in.server_fullname);
++ if (length_server_fullname_0 > size_server_fullname_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_fullname_0, length_server_fullname_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_fullname), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_fullname, ndr_get_array_length(ndr, &r->in.server_fullname), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_fullname_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_fullname, length_server_fullname_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.ttl));
+ }
+@@ -5314,21 +5558,29 @@ static enum ndr_err_code ndr_push_dfs_Fl
+
+ static enum ndr_err_code ndr_pull_dfs_FlushFtTable(struct ndr_pull *ndr, int flags, struct dfs_FlushFtTable *r)
+ {
++ uint32_t size_servername_0 = 0;
++ uint32_t length_servername_0 = 0;
++ uint32_t size_rootshare_0 = 0;
++ uint32_t length_rootshare_0 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.servername));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.servername));
+- if (ndr_get_array_length(ndr, &r->in.servername) > ndr_get_array_size(ndr, &r->in.servername)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.servername), ndr_get_array_length(ndr, &r->in.servername));
++ size_servername_0 = ndr_get_array_size(ndr, &r->in.servername);
++ length_servername_0 = ndr_get_array_length(ndr, &r->in.servername);
++ if (length_servername_0 > size_servername_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_servername_0, length_servername_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, ndr_get_array_length(ndr, &r->in.servername), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_servername_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.servername, length_servername_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.rootshare));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.rootshare));
+- if (ndr_get_array_length(ndr, &r->in.rootshare) > ndr_get_array_size(ndr, &r->in.rootshare)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.rootshare), ndr_get_array_length(ndr, &r->in.rootshare));
++ size_rootshare_0 = ndr_get_array_size(ndr, &r->in.rootshare);
++ length_rootshare_0 = ndr_get_array_length(ndr, &r->in.rootshare);
++ if (length_rootshare_0 > size_rootshare_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_rootshare_0, length_rootshare_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, ndr_get_array_length(ndr, &r->in.rootshare), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_rootshare_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.rootshare, length_rootshare_0, sizeof(uint16_t), CH_UTF16));
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->out.result));
+@@ -5475,6 +5727,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_dfs_
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_dfs_EnumEx(struct ndr_pull *ndr, int flags, struct dfs_EnumEx *r)
+ {
++ uint32_t size_dfs_name_0 = 0;
++ uint32_t length_dfs_name_0 = 0;
+ uint32_t _ptr_info;
+ uint32_t _ptr_total;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -5484,11 +5738,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_dfs_
+
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.dfs_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.dfs_name));
+- if (ndr_get_array_length(ndr, &r->in.dfs_name) > ndr_get_array_size(ndr, &r->in.dfs_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.dfs_name), ndr_get_array_length(ndr, &r->in.dfs_name));
++ size_dfs_name_0 = ndr_get_array_size(ndr, &r->in.dfs_name);
++ length_dfs_name_0 = ndr_get_array_length(ndr, &r->in.dfs_name);
++ if (length_dfs_name_0 > size_dfs_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_dfs_name_0, length_dfs_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.dfs_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_name, ndr_get_array_length(ndr, &r->in.dfs_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_dfs_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.dfs_name, length_dfs_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.bufsize));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info));
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_ntsvcs.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_ntsvcs.c
+@@ -54,11 +54,13 @@ static enum ndr_err_code ndr_push_PNP_Hw
+
+ static enum ndr_err_code ndr_pull_PNP_HwProfInfo(struct ndr_pull *ndr, int ndr_flags, struct PNP_HwProfInfo *r)
+ {
++ uint32_t size_friendly_name_0 = 0;
+ uint32_t cntr_friendly_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->profile_handle));
+- for (cntr_friendly_name_0 = 0; cntr_friendly_name_0 < 80; cntr_friendly_name_0++) {
++ size_friendly_name_0 = 80;
++ for (cntr_friendly_name_0 = 0; cntr_friendly_name_0 < size_friendly_name_0; cntr_friendly_name_0++) {
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->friendly_name[cntr_friendly_name_0]));
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->flags));
+@@ -375,14 +377,18 @@ static enum ndr_err_code ndr_push_PNP_Va
+
+ static enum ndr_err_code ndr_pull_PNP_ValidateDeviceInstance(struct ndr_pull *ndr, int flags, struct PNP_ValidateDeviceInstance *r)
+ {
++ uint32_t size_devicepath_1 = 0;
++ uint32_t length_devicepath_1 = 0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.devicepath));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.devicepath));
+- if (ndr_get_array_length(ndr, &r->in.devicepath) > ndr_get_array_size(ndr, &r->in.devicepath)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.devicepath), ndr_get_array_length(ndr, &r->in.devicepath));
++ size_devicepath_1 = ndr_get_array_size(ndr, &r->in.devicepath);
++ length_devicepath_1 = ndr_get_array_length(ndr, &r->in.devicepath);
++ if (length_devicepath_1 > size_devicepath_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_devicepath_1, length_devicepath_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.devicepath), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicepath, ndr_get_array_length(ndr, &r->in.devicepath), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_devicepath_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicepath, length_devicepath_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ }
+ if (flags & NDR_OUT) {
+@@ -579,6 +585,10 @@ static enum ndr_err_code ndr_push_PNP_Ge
+ static enum ndr_err_code ndr_pull_PNP_GetDeviceList(struct ndr_pull *ndr, int flags, struct PNP_GetDeviceList *r)
+ {
+ uint32_t _ptr_filter;
++ uint32_t size_filter_1 = 0;
++ uint32_t length_filter_1 = 0;
++ uint32_t size_buffer_1 = 0;
++ uint32_t length_buffer_1 = 0;
+ uint32_t cntr_buffer_1;
+ TALLOC_CTX *_mem_save_filter_0;
+ TALLOC_CTX *_mem_save_buffer_1;
+@@ -597,11 +607,13 @@ static enum ndr_err_code ndr_pull_PNP_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.filter, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.filter));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.filter));
+- if (ndr_get_array_length(ndr, &r->in.filter) > ndr_get_array_size(ndr, &r->in.filter)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.filter), ndr_get_array_length(ndr, &r->in.filter));
++ size_filter_1 = ndr_get_array_size(ndr, &r->in.filter);
++ length_filter_1 = ndr_get_array_length(ndr, &r->in.filter);
++ if (length_filter_1 > size_filter_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_filter_1, length_filter_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.filter), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.filter, ndr_get_array_length(ndr, &r->in.filter), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_filter_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.filter, length_filter_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_filter_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -620,15 +632,17 @@ static enum ndr_err_code ndr_pull_PNP_Ge
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.buffer));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.buffer));
+- if (ndr_get_array_length(ndr, &r->out.buffer) > ndr_get_array_size(ndr, &r->out.buffer)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.buffer), ndr_get_array_length(ndr, &r->out.buffer));
++ size_buffer_1 = ndr_get_array_size(ndr, &r->out.buffer);
++ length_buffer_1 = ndr_get_array_length(ndr, &r->out.buffer);
++ if (length_buffer_1 > size_buffer_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_buffer_1, length_buffer_1);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+- NDR_PULL_ALLOC_N(ndr, r->out.buffer, ndr_get_array_size(ndr, &r->out.buffer));
++ NDR_PULL_ALLOC_N(ndr, r->out.buffer, size_buffer_1);
+ }
+ _mem_save_buffer_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->out.buffer, 0);
+- for (cntr_buffer_1 = 0; cntr_buffer_1 < ndr_get_array_length(ndr, &r->out.buffer); cntr_buffer_1++) {
++ for (cntr_buffer_1 = 0; cntr_buffer_1 < length_buffer_1; cntr_buffer_1++) {
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->out.buffer[cntr_buffer_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffer_1, 0);
+@@ -725,6 +739,8 @@ static enum ndr_err_code ndr_push_PNP_Ge
+ static enum ndr_err_code ndr_pull_PNP_GetDeviceListSize(struct ndr_pull *ndr, int flags, struct PNP_GetDeviceListSize *r)
+ {
+ uint32_t _ptr_devicename;
++ uint32_t size_devicename_1 = 0;
++ uint32_t length_devicename_1 = 0;
+ TALLOC_CTX *_mem_save_devicename_0;
+ TALLOC_CTX *_mem_save_size_0;
+ if (flags & NDR_IN) {
+@@ -741,11 +757,13 @@ static enum ndr_err_code ndr_pull_PNP_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.devicename, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.devicename));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.devicename));
+- if (ndr_get_array_length(ndr, &r->in.devicename) > ndr_get_array_size(ndr, &r->in.devicename)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.devicename), ndr_get_array_length(ndr, &r->in.devicename));
++ size_devicename_1 = ndr_get_array_size(ndr, &r->in.devicename);
++ length_devicename_1 = ndr_get_array_length(ndr, &r->in.devicename);
++ if (length_devicename_1 > size_devicename_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_devicename_1, length_devicename_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.devicename), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicename, ndr_get_array_length(ndr, &r->in.devicename), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_devicename_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicename, length_devicename_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_devicename_0, 0);
+ }
+ NDR_CHECK(ndr_pull_PNP_GetIdListFlags(ndr, NDR_SCALARS, &r->in.flags));
+@@ -890,6 +908,10 @@ static enum ndr_err_code ndr_push_PNP_Ge
+
+ static enum ndr_err_code ndr_pull_PNP_GetDeviceRegProp(struct ndr_pull *ndr, int flags, struct PNP_GetDeviceRegProp *r)
+ {
++ uint32_t size_devicepath_1 = 0;
++ uint32_t length_devicepath_1 = 0;
++ uint32_t size_buffer_1 = 0;
++ uint32_t length_buffer_1 = 0;
+ TALLOC_CTX *_mem_save_reg_data_type_0;
+ TALLOC_CTX *_mem_save_buffer_size_0;
+ TALLOC_CTX *_mem_save_needed_0;
+@@ -898,11 +920,13 @@ static enum ndr_err_code ndr_pull_PNP_Ge
+
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.devicepath));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.devicepath));
+- if (ndr_get_array_length(ndr, &r->in.devicepath) > ndr_get_array_size(ndr, &r->in.devicepath)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.devicepath), ndr_get_array_length(ndr, &r->in.devicepath));
++ size_devicepath_1 = ndr_get_array_size(ndr, &r->in.devicepath);
++ length_devicepath_1 = ndr_get_array_length(ndr, &r->in.devicepath);
++ if (length_devicepath_1 > size_devicepath_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_devicepath_1, length_devicepath_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.devicepath), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicepath, ndr_get_array_length(ndr, &r->in.devicepath), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_devicepath_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicepath, length_devicepath_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.property));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->in.reg_data_type);
+@@ -945,13 +969,15 @@ static enum ndr_err_code ndr_pull_PNP_Ge
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_reg_data_type_0, LIBNDR_FLAG_REF_ALLOC);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.buffer));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.buffer));
+- if (ndr_get_array_length(ndr, &r->out.buffer) > ndr_get_array_size(ndr, &r->out.buffer)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.buffer), ndr_get_array_length(ndr, &r->out.buffer));
++ size_buffer_1 = ndr_get_array_size(ndr, &r->out.buffer);
++ length_buffer_1 = ndr_get_array_length(ndr, &r->out.buffer);
++ if (length_buffer_1 > size_buffer_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_buffer_1, length_buffer_1);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+- NDR_PULL_ALLOC_N(ndr, r->out.buffer, ndr_get_array_size(ndr, &r->out.buffer));
++ NDR_PULL_ALLOC_N(ndr, r->out.buffer, size_buffer_1);
+ }
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.buffer, ndr_get_array_length(ndr, &r->out.buffer)));
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.buffer, length_buffer_1));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->out.buffer_size);
+ }
+@@ -2154,9 +2180,15 @@ static enum ndr_err_code ndr_push_PNP_Hw
+
+ static enum ndr_err_code ndr_pull_PNP_HwProfFlags(struct ndr_pull *ndr, int flags, struct PNP_HwProfFlags *r)
+ {
++ uint32_t size_devicepath_1 = 0;
++ uint32_t length_devicepath_1 = 0;
+ uint32_t _ptr_veto_type;
+ uint32_t _ptr_unknown5;
++ uint32_t size_unknown5_1 = 0;
++ uint32_t length_unknown5_1 = 0;
+ uint32_t _ptr_unknown5a;
++ uint32_t size_unknown5a_2 = 0;
++ uint32_t length_unknown5a_2 = 0;
+ TALLOC_CTX *_mem_save_profile_flags_0;
+ TALLOC_CTX *_mem_save_veto_type_0;
+ TALLOC_CTX *_mem_save_unknown5_0;
+@@ -2168,11 +2200,13 @@ static enum ndr_err_code ndr_pull_PNP_Hw
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.action));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.devicepath));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.devicepath));
+- if (ndr_get_array_length(ndr, &r->in.devicepath) > ndr_get_array_size(ndr, &r->in.devicepath)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.devicepath), ndr_get_array_length(ndr, &r->in.devicepath));
++ size_devicepath_1 = ndr_get_array_size(ndr, &r->in.devicepath);
++ length_devicepath_1 = ndr_get_array_length(ndr, &r->in.devicepath);
++ if (length_devicepath_1 > size_devicepath_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_devicepath_1, length_devicepath_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.devicepath), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicepath, ndr_get_array_length(ndr, &r->in.devicepath), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_devicepath_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.devicepath, length_devicepath_1, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.config));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->in.profile_flags);
+@@ -2204,11 +2238,13 @@ static enum ndr_err_code ndr_pull_PNP_Hw
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.unknown5, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.unknown5));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.unknown5));
+- if (ndr_get_array_length(ndr, &r->in.unknown5) > ndr_get_array_size(ndr, &r->in.unknown5)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.unknown5), ndr_get_array_length(ndr, &r->in.unknown5));
++ size_unknown5_1 = ndr_get_array_size(ndr, &r->in.unknown5);
++ length_unknown5_1 = ndr_get_array_length(ndr, &r->in.unknown5);
++ if (length_unknown5_1 > size_unknown5_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown5_1, length_unknown5_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.unknown5), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown5, ndr_get_array_length(ndr, &r->in.unknown5), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown5_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.unknown5, length_unknown5_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown5_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.name_length));
+@@ -2256,11 +2292,13 @@ static enum ndr_err_code ndr_pull_PNP_Hw
+ NDR_PULL_SET_MEM_CTX(ndr, *r->out.unknown5a, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, r->out.unknown5a));
+ NDR_CHECK(ndr_pull_array_length(ndr, r->out.unknown5a));
+- if (ndr_get_array_length(ndr, r->out.unknown5a) > ndr_get_array_size(ndr, r->out.unknown5a)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, r->out.unknown5a), ndr_get_array_length(ndr, r->out.unknown5a));
++ size_unknown5a_2 = ndr_get_array_size(ndr, r->out.unknown5a);
++ length_unknown5a_2 = ndr_get_array_length(ndr, r->out.unknown5a);
++ if (length_unknown5a_2 > size_unknown5a_2) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_unknown5a_2, length_unknown5a_2);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, r->out.unknown5a), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.unknown5a, ndr_get_array_length(ndr, r->out.unknown5a), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_unknown5a_2, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, r->out.unknown5a, length_unknown5a_2, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown5a_1, 0);
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown5a_0, 0);
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_xattr.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_xattr.c
+@@ -461,6 +461,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_xatt
+ _PUBLIC_ enum ndr_err_code ndr_pull_xattr_DosEAs(struct ndr_pull *ndr, int ndr_flags, struct xattr_DosEAs *r)
+ {
+ uint32_t _ptr_eas;
++ uint32_t size_eas_1 = 0;
+ uint32_t cntr_eas_1;
+ TALLOC_CTX *_mem_save_eas_0;
+ TALLOC_CTX *_mem_save_eas_1;
+@@ -480,10 +481,11 @@ _PUBLIC_ enum ndr_err_code ndr_pull_xatt
+ _mem_save_eas_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->eas, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->eas));
+- NDR_PULL_ALLOC_N(ndr, r->eas, ndr_get_array_size(ndr, &r->eas));
++ size_eas_1 = ndr_get_array_size(ndr, &r->eas);
++ NDR_PULL_ALLOC_N(ndr, r->eas, size_eas_1);
+ _mem_save_eas_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->eas, 0);
+- for (cntr_eas_1 = 0; cntr_eas_1 < r->num_eas; cntr_eas_1++) {
++ for (cntr_eas_1 = 0; cntr_eas_1 < size_eas_1; cntr_eas_1++) {
+ NDR_CHECK(ndr_pull_xattr_EA(ndr, NDR_SCALARS, &r->eas[cntr_eas_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_eas_1, 0);
+@@ -538,15 +540,17 @@ _PUBLIC_ enum ndr_err_code ndr_push_tdb_
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_tdb_xattrs(struct ndr_pull *ndr, int ndr_flags, struct tdb_xattrs *r)
+ {
++ uint32_t size_eas_0 = 0;
+ uint32_t cntr_eas_0;
+ TALLOC_CTX *_mem_save_eas_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_eas));
+- NDR_PULL_ALLOC_N(ndr, r->eas, r->num_eas);
++ size_eas_0 = r->num_eas;
++ NDR_PULL_ALLOC_N(ndr, r->eas, size_eas_0);
+ _mem_save_eas_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->eas, 0);
+- for (cntr_eas_0 = 0; cntr_eas_0 < r->num_eas; cntr_eas_0++) {
++ for (cntr_eas_0 = 0; cntr_eas_0 < size_eas_0; cntr_eas_0++) {
+ NDR_CHECK(ndr_pull_xattr_EA(ndr, NDR_SCALARS, &r->eas[cntr_eas_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_eas_0, 0);
+@@ -650,6 +654,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_xatt
+ _PUBLIC_ enum ndr_err_code ndr_pull_xattr_DosStreams(struct ndr_pull *ndr, int ndr_flags, struct xattr_DosStreams *r)
+ {
+ uint32_t _ptr_streams;
++ uint32_t size_streams_1 = 0;
+ uint32_t cntr_streams_1;
+ TALLOC_CTX *_mem_save_streams_0;
+ TALLOC_CTX *_mem_save_streams_1;
+@@ -669,10 +674,11 @@ _PUBLIC_ enum ndr_err_code ndr_pull_xatt
+ _mem_save_streams_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->streams, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->streams));
+- NDR_PULL_ALLOC_N(ndr, r->streams, ndr_get_array_size(ndr, &r->streams));
++ size_streams_1 = ndr_get_array_size(ndr, &r->streams);
++ NDR_PULL_ALLOC_N(ndr, r->streams, size_streams_1);
+ _mem_save_streams_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->streams, 0);
+- for (cntr_streams_1 = 0; cntr_streams_1 < r->num_streams; cntr_streams_1++) {
++ for (cntr_streams_1 = 0; cntr_streams_1 < size_streams_1; cntr_streams_1++) {
+ NDR_CHECK(ndr_pull_xattr_DosStream(ndr, NDR_SCALARS, &r->streams[cntr_streams_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_streams_1, 0);
+@@ -729,6 +735,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ {
+ uint32_t _ptr_sd;
+ TALLOC_CTX *_mem_save_sd_0;
++ uint32_t size_hash_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sd));
+@@ -737,7 +744,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ } else {
+ r->sd = NULL;
+ }
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->hash, 16));
++ size_hash_0 = 16;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->hash, size_hash_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -786,6 +794,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ {
+ uint32_t _ptr_sd;
+ TALLOC_CTX *_mem_save_sd_0;
++ uint32_t size_hash_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sd));
+@@ -795,7 +804,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ r->sd = NULL;
+ }
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->hash_type));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->hash, 64));
++ size_hash_0 = 64;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->hash, size_hash_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -880,8 +890,11 @@ static enum ndr_err_code ndr_pull_xattr_
+ int level;
+ uint16_t _level;
+ TALLOC_CTX *_mem_save_sd_0;
++ uint32_t _ptr_sd;
+ TALLOC_CTX *_mem_save_sd_hs2_0;
++ uint32_t _ptr_sd_hs2;
+ TALLOC_CTX *_mem_save_sd_hs3_0;
++ uint32_t _ptr_sd_hs3;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &_level));
+@@ -891,7 +904,6 @@ static enum ndr_err_code ndr_pull_xattr_
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 1: {
+- uint32_t _ptr_sd;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sd));
+ if (_ptr_sd) {
+ NDR_PULL_ALLOC(ndr, r->sd);
+@@ -901,7 +913,6 @@ static enum ndr_err_code ndr_pull_xattr_
+ break; }
+
+ case 2: {
+- uint32_t _ptr_sd_hs2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sd_hs2));
+ if (_ptr_sd_hs2) {
+ NDR_PULL_ALLOC(ndr, r->sd_hs2);
+@@ -911,7 +922,6 @@ static enum ndr_err_code ndr_pull_xattr_
+ break; }
+
+ case 3: {
+- uint32_t _ptr_sd_hs3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sd_hs3));
+ if (_ptr_sd_hs3) {
+ NDR_PULL_ALLOC(ndr, r->sd_hs3);
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_srvsvc.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_srvsvc.c
+@@ -26,6 +26,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevInfo0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevInfo0 *r)
+ {
+ uint32_t _ptr_device;
++ uint32_t size_device_1 = 0;
++ uint32_t length_device_1 = 0;
+ TALLOC_CTX *_mem_save_device_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -43,11 +45,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->device, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->device));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->device));
+- if (ndr_get_array_length(ndr, &r->device) > ndr_get_array_size(ndr, &r->device)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->device), ndr_get_array_length(ndr, &r->device));
++ size_device_1 = ndr_get_array_size(ndr, &r->device);
++ length_device_1 = ndr_get_array_length(ndr, &r->device);
++ if (length_device_1 > size_device_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_device_1, length_device_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_device_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, length_device_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_device_0, 0);
+ }
+ }
+@@ -93,6 +97,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevCtr0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -112,13 +117,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -185,8 +191,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevInfo1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevInfo1 *r)
+ {
+ uint32_t _ptr_device;
++ uint32_t size_device_1 = 0;
++ uint32_t length_device_1 = 0;
+ TALLOC_CTX *_mem_save_device_0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_user_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -212,11 +222,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->device, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->device));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->device));
+- if (ndr_get_array_length(ndr, &r->device) > ndr_get_array_size(ndr, &r->device)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->device), ndr_get_array_length(ndr, &r->device));
++ size_device_1 = ndr_get_array_size(ndr, &r->device);
++ length_device_1 = ndr_get_array_length(ndr, &r->device);
++ if (length_device_1 > size_device_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_device_1, length_device_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_device_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, length_device_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_device_0, 0);
+ }
+ if (r->user) {
+@@ -224,11 +236,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user));
+- if (ndr_get_array_length(ndr, &r->user) > ndr_get_array_size(ndr, &r->user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user), ndr_get_array_length(ndr, &r->user));
++ size_user_1 = ndr_get_array_size(ndr, &r->user);
++ length_user_1 = ndr_get_array_length(ndr, &r->user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ }
+@@ -282,6 +296,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevCtr1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -301,13 +316,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -392,7 +408,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info0_0;
++ uint32_t _ptr_info0;
+ TALLOC_CTX *_mem_save_info1_0;
++ uint32_t _ptr_info1;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -402,7 +420,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_info0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info0));
+ if (_ptr_info0) {
+ NDR_PULL_ALLOC(ndr, r->info0);
+@@ -412,7 +429,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_info1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1));
+ if (_ptr_info1) {
+ NDR_PULL_ALLOC(ndr, r->info1);
+@@ -532,7 +548,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -542,7 +560,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -552,7 +569,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -685,6 +701,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQInfo0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevQInfo0 *r)
+ {
+ uint32_t _ptr_device;
++ uint32_t size_device_1 = 0;
++ uint32_t length_device_1 = 0;
+ TALLOC_CTX *_mem_save_device_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -702,11 +720,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->device, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->device));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->device));
+- if (ndr_get_array_length(ndr, &r->device) > ndr_get_array_size(ndr, &r->device)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->device), ndr_get_array_length(ndr, &r->device));
++ size_device_1 = ndr_get_array_size(ndr, &r->device);
++ length_device_1 = ndr_get_array_length(ndr, &r->device);
++ if (length_device_1 > size_device_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_device_1, length_device_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_device_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, length_device_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_device_0, 0);
+ }
+ }
+@@ -752,6 +772,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQCtr0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevQCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -771,13 +792,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevQInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevQInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -845,8 +867,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQInfo1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevQInfo1 *r)
+ {
+ uint32_t _ptr_device;
++ uint32_t size_device_1 = 0;
++ uint32_t length_device_1 = 0;
+ TALLOC_CTX *_mem_save_device_0;
+ uint32_t _ptr_devices;
++ uint32_t size_devices_1 = 0;
++ uint32_t length_devices_1 = 0;
+ TALLOC_CTX *_mem_save_devices_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -873,11 +899,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->device, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->device));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->device));
+- if (ndr_get_array_length(ndr, &r->device) > ndr_get_array_size(ndr, &r->device)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->device), ndr_get_array_length(ndr, &r->device));
++ size_device_1 = ndr_get_array_size(ndr, &r->device);
++ length_device_1 = ndr_get_array_length(ndr, &r->device);
++ if (length_device_1 > size_device_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_device_1, length_device_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, ndr_get_array_length(ndr, &r->device), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_device_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->device, length_device_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_device_0, 0);
+ }
+ if (r->devices) {
+@@ -885,11 +913,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->devices, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->devices));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->devices));
+- if (ndr_get_array_length(ndr, &r->devices) > ndr_get_array_size(ndr, &r->devices)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->devices), ndr_get_array_length(ndr, &r->devices));
++ size_devices_1 = ndr_get_array_size(ndr, &r->devices);
++ length_devices_1 = ndr_get_array_length(ndr, &r->devices);
++ if (length_devices_1 > size_devices_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_devices_1, length_devices_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->devices), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->devices, ndr_get_array_length(ndr, &r->devices), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_devices_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->devices, length_devices_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_devices_0, 0);
+ }
+ }
+@@ -944,6 +974,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQCtr1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetCharDevQCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -963,13 +994,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevQInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevQInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -1054,7 +1086,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info0_0;
++ uint32_t _ptr_info0;
+ TALLOC_CTX *_mem_save_info1_0;
++ uint32_t _ptr_info1;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -1064,7 +1098,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_info0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info0));
+ if (_ptr_info0) {
+ NDR_PULL_ALLOC(ndr, r->info0);
+@@ -1074,7 +1107,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_info1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1));
+ if (_ptr_info1) {
+ NDR_PULL_ALLOC(ndr, r->info1);
+@@ -1194,7 +1226,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -1204,7 +1238,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -1214,7 +1247,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -1381,6 +1413,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetConnCtr0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetConnCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -1400,10 +1433,11 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetConnInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -1473,8 +1507,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetConnInfo1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetConnInfo1 *r)
+ {
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_user_0;
+ uint32_t _ptr_share;
++ uint32_t size_share_1 = 0;
++ uint32_t length_share_1 = 0;
+ TALLOC_CTX *_mem_save_share_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -1503,11 +1541,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user));
+- if (ndr_get_array_length(ndr, &r->user) > ndr_get_array_size(ndr, &r->user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user), ndr_get_array_length(ndr, &r->user));
++ size_user_1 = ndr_get_array_size(ndr, &r->user);
++ length_user_1 = ndr_get_array_length(ndr, &r->user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ if (r->share) {
+@@ -1515,11 +1555,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->share, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->share));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->share));
+- if (ndr_get_array_length(ndr, &r->share) > ndr_get_array_size(ndr, &r->share)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->share), ndr_get_array_length(ndr, &r->share));
++ size_share_1 = ndr_get_array_size(ndr, &r->share);
++ length_share_1 = ndr_get_array_length(ndr, &r->share);
++ if (length_share_1 > size_share_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_1, length_share_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->share), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->share, ndr_get_array_length(ndr, &r->share), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->share, length_share_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_share_0, 0);
+ }
+ }
+@@ -1576,6 +1618,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetConnCtr1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetConnCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -1595,13 +1638,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetConnInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetConnInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -1686,7 +1730,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -1696,7 +1742,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -1706,7 +1751,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -1873,6 +1917,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetFileCtr2(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetFileCtr2 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -1892,10 +1937,11 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetFileInfo2(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -1963,8 +2009,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetFileInfo3(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetFileInfo3 *r)
+ {
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_user_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -1991,11 +2041,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (r->user) {
+@@ -2003,11 +2055,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user));
+- if (ndr_get_array_length(ndr, &r->user) > ndr_get_array_size(ndr, &r->user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user), ndr_get_array_length(ndr, &r->user));
++ size_user_1 = ndr_get_array_size(ndr, &r->user);
++ length_user_1 = ndr_get_array_length(ndr, &r->user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ }
+@@ -2062,6 +2116,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetFileCtr3(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetFileCtr3 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -2081,13 +2136,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetFileInfo3(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetFileInfo3(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -2172,7 +2228,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info2_0;
++ uint32_t _ptr_info2;
+ TALLOC_CTX *_mem_save_info3_0;
++ uint32_t _ptr_info3;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -2182,7 +2240,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 2: {
+- uint32_t _ptr_info2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info2));
+ if (_ptr_info2) {
+ NDR_PULL_ALLOC(ndr, r->info2);
+@@ -2192,7 +2249,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 3: {
+- uint32_t _ptr_info3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info3));
+ if (_ptr_info3) {
+ NDR_PULL_ALLOC(ndr, r->info3);
+@@ -2312,7 +2368,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr2_0;
++ uint32_t _ptr_ctr2;
+ TALLOC_CTX *_mem_save_ctr3_0;
++ uint32_t _ptr_ctr3;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -2322,7 +2380,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 2: {
+- uint32_t _ptr_ctr2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr2));
+ if (_ptr_ctr2) {
+ NDR_PULL_ALLOC(ndr, r->ctr2);
+@@ -2332,7 +2389,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 3: {
+- uint32_t _ptr_ctr3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr3));
+ if (_ptr_ctr3) {
+ NDR_PULL_ALLOC(ndr, r->ctr3);
+@@ -2465,6 +2521,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessInfo0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessInfo0 *r)
+ {
+ uint32_t _ptr_client;
++ uint32_t size_client_1 = 0;
++ uint32_t length_client_1 = 0;
+ TALLOC_CTX *_mem_save_client_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -2482,11 +2540,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->client, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client));
+- if (ndr_get_array_length(ndr, &r->client) > ndr_get_array_size(ndr, &r->client)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client), ndr_get_array_length(ndr, &r->client));
++ size_client_1 = ndr_get_array_size(ndr, &r->client);
++ length_client_1 = ndr_get_array_length(ndr, &r->client);
++ if (length_client_1 > size_client_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_1, length_client_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, length_client_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_0, 0);
+ }
+ }
+@@ -2532,6 +2592,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessCtr0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -2551,13 +2612,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -2626,8 +2688,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessInfo1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessInfo1 *r)
+ {
+ uint32_t _ptr_client;
++ uint32_t size_client_1 = 0;
++ uint32_t length_client_1 = 0;
+ TALLOC_CTX *_mem_save_client_0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_user_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -2655,11 +2721,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->client, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client));
+- if (ndr_get_array_length(ndr, &r->client) > ndr_get_array_size(ndr, &r->client)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client), ndr_get_array_length(ndr, &r->client));
++ size_client_1 = ndr_get_array_size(ndr, &r->client);
++ length_client_1 = ndr_get_array_length(ndr, &r->client);
++ if (length_client_1 > size_client_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_1, length_client_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, length_client_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_0, 0);
+ }
+ if (r->user) {
+@@ -2667,11 +2735,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user));
+- if (ndr_get_array_length(ndr, &r->user) > ndr_get_array_size(ndr, &r->user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user), ndr_get_array_length(ndr, &r->user));
++ size_user_1 = ndr_get_array_size(ndr, &r->user);
++ length_user_1 = ndr_get_array_length(ndr, &r->user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ }
+@@ -2727,6 +2797,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessCtr1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -2746,13 +2817,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -2828,10 +2900,16 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessInfo2(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessInfo2 *r)
+ {
+ uint32_t _ptr_client;
++ uint32_t size_client_1 = 0;
++ uint32_t length_client_1 = 0;
+ TALLOC_CTX *_mem_save_client_0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_user_0;
+ uint32_t _ptr_client_type;
++ uint32_t size_client_type_1 = 0;
++ uint32_t length_client_type_1 = 0;
+ TALLOC_CTX *_mem_save_client_type_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -2865,11 +2943,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->client, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client));
+- if (ndr_get_array_length(ndr, &r->client) > ndr_get_array_size(ndr, &r->client)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client), ndr_get_array_length(ndr, &r->client));
++ size_client_1 = ndr_get_array_size(ndr, &r->client);
++ length_client_1 = ndr_get_array_length(ndr, &r->client);
++ if (length_client_1 > size_client_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_1, length_client_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, length_client_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_0, 0);
+ }
+ if (r->user) {
+@@ -2877,11 +2957,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user));
+- if (ndr_get_array_length(ndr, &r->user) > ndr_get_array_size(ndr, &r->user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user), ndr_get_array_length(ndr, &r->user));
++ size_user_1 = ndr_get_array_size(ndr, &r->user);
++ length_user_1 = ndr_get_array_length(ndr, &r->user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ if (r->client_type) {
+@@ -2889,11 +2971,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->client_type, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client_type));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client_type));
+- if (ndr_get_array_length(ndr, &r->client_type) > ndr_get_array_size(ndr, &r->client_type)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client_type), ndr_get_array_length(ndr, &r->client_type));
++ size_client_type_1 = ndr_get_array_size(ndr, &r->client_type);
++ length_client_type_1 = ndr_get_array_length(ndr, &r->client_type);
++ if (length_client_type_1 > size_client_type_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_type_1, length_client_type_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client_type), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_type, ndr_get_array_length(ndr, &r->client_type), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_type_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_type, length_client_type_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_type_0, 0);
+ }
+ }
+@@ -2955,6 +3039,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessCtr2(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessCtr2 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -2974,13 +3059,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo2(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo2(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -3047,8 +3133,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessInfo10(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessInfo10 *r)
+ {
+ uint32_t _ptr_client;
++ uint32_t size_client_1 = 0;
++ uint32_t length_client_1 = 0;
+ TALLOC_CTX *_mem_save_client_0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_user_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3074,11 +3164,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->client, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client));
+- if (ndr_get_array_length(ndr, &r->client) > ndr_get_array_size(ndr, &r->client)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client), ndr_get_array_length(ndr, &r->client));
++ size_client_1 = ndr_get_array_size(ndr, &r->client);
++ length_client_1 = ndr_get_array_length(ndr, &r->client);
++ if (length_client_1 > size_client_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_1, length_client_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, length_client_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_0, 0);
+ }
+ if (r->user) {
+@@ -3086,11 +3178,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user));
+- if (ndr_get_array_length(ndr, &r->user) > ndr_get_array_size(ndr, &r->user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user), ndr_get_array_length(ndr, &r->user));
++ size_user_1 = ndr_get_array_size(ndr, &r->user);
++ length_user_1 = ndr_get_array_length(ndr, &r->user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ }
+@@ -3144,6 +3238,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessCtr10(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessCtr10 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -3163,13 +3258,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo10(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo10(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -3252,12 +3348,20 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessInfo502(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessInfo502 *r)
+ {
+ uint32_t _ptr_client;
++ uint32_t size_client_1 = 0;
++ uint32_t length_client_1 = 0;
+ TALLOC_CTX *_mem_save_client_0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_user_0;
+ uint32_t _ptr_client_type;
++ uint32_t size_client_type_1 = 0;
++ uint32_t length_client_type_1 = 0;
+ TALLOC_CTX *_mem_save_client_type_0;
+ uint32_t _ptr_transport;
++ uint32_t size_transport_1 = 0;
++ uint32_t length_transport_1 = 0;
+ TALLOC_CTX *_mem_save_transport_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3297,11 +3401,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->client, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client));
+- if (ndr_get_array_length(ndr, &r->client) > ndr_get_array_size(ndr, &r->client)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client), ndr_get_array_length(ndr, &r->client));
++ size_client_1 = ndr_get_array_size(ndr, &r->client);
++ length_client_1 = ndr_get_array_length(ndr, &r->client);
++ if (length_client_1 > size_client_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_1, length_client_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, ndr_get_array_length(ndr, &r->client), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client, length_client_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_0, 0);
+ }
+ if (r->user) {
+@@ -3309,11 +3415,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->user));
+- if (ndr_get_array_length(ndr, &r->user) > ndr_get_array_size(ndr, &r->user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->user), ndr_get_array_length(ndr, &r->user));
++ size_user_1 = ndr_get_array_size(ndr, &r->user);
++ length_user_1 = ndr_get_array_length(ndr, &r->user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, ndr_get_array_length(ndr, &r->user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ if (r->client_type) {
+@@ -3321,11 +3429,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->client_type, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client_type));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client_type));
+- if (ndr_get_array_length(ndr, &r->client_type) > ndr_get_array_size(ndr, &r->client_type)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client_type), ndr_get_array_length(ndr, &r->client_type));
++ size_client_type_1 = ndr_get_array_size(ndr, &r->client_type);
++ length_client_type_1 = ndr_get_array_length(ndr, &r->client_type);
++ if (length_client_type_1 > size_client_type_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_type_1, length_client_type_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client_type), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_type, ndr_get_array_length(ndr, &r->client_type), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_type_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_type, length_client_type_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_type_0, 0);
+ }
+ if (r->transport) {
+@@ -3333,11 +3443,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->transport, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->transport));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->transport));
+- if (ndr_get_array_length(ndr, &r->transport) > ndr_get_array_size(ndr, &r->transport)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->transport), ndr_get_array_length(ndr, &r->transport));
++ size_transport_1 = ndr_get_array_size(ndr, &r->transport);
++ length_transport_1 = ndr_get_array_length(ndr, &r->transport);
++ if (length_transport_1 > size_transport_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_transport_1, length_transport_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->transport), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->transport, ndr_get_array_length(ndr, &r->transport), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_transport_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->transport, length_transport_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_transport_0, 0);
+ }
+ }
+@@ -3405,6 +3517,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessCtr502(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSessCtr502 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -3424,13 +3537,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo502(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetSessInfo502(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -3545,10 +3659,15 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ TALLOC_CTX *_mem_save_ctr2_0;
++ uint32_t _ptr_ctr2;
+ TALLOC_CTX *_mem_save_ctr10_0;
++ uint32_t _ptr_ctr10;
+ TALLOC_CTX *_mem_save_ctr502_0;
++ uint32_t _ptr_ctr502;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -3558,7 +3677,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -3568,7 +3686,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -3578,7 +3695,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 2: {
+- uint32_t _ptr_ctr2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr2));
+ if (_ptr_ctr2) {
+ NDR_PULL_ALLOC(ndr, r->ctr2);
+@@ -3588,7 +3704,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 10: {
+- uint32_t _ptr_ctr10;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr10));
+ if (_ptr_ctr10) {
+ NDR_PULL_ALLOC(ndr, r->ctr10);
+@@ -3598,7 +3713,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 502: {
+- uint32_t _ptr_ctr502;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr502));
+ if (_ptr_ctr502) {
+ NDR_PULL_ALLOC(ndr, r->ctr502);
+@@ -3835,6 +3949,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareInfo0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareInfo0 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3852,11 +3968,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ }
+@@ -3902,6 +4020,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -3921,13 +4040,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -3993,8 +4113,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareInfo1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareInfo1 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4019,11 +4143,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->comment) {
+@@ -4031,11 +4157,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -4088,6 +4216,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -4107,13 +4236,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -4196,12 +4326,20 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareInfo2(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareInfo2 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ uint32_t _ptr_password;
++ uint32_t size_password_1 = 0;
++ uint32_t length_password_1 = 0;
+ TALLOC_CTX *_mem_save_password_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4241,11 +4379,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->comment) {
+@@ -4253,11 +4393,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ if (r->path) {
+@@ -4265,11 +4407,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (r->password) {
+@@ -4277,11 +4421,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->password));
+- if (ndr_get_array_length(ndr, &r->password) > ndr_get_array_size(ndr, &r->password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->password), ndr_get_array_length(ndr, &r->password));
++ size_password_1 = ndr_get_array_size(ndr, &r->password);
++ length_password_1 = ndr_get_array_length(ndr, &r->password);
++ if (length_password_1 > size_password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_password_1, length_password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, length_password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_password_0, 0);
+ }
+ }
+@@ -4349,6 +4495,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr2(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr2 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -4368,13 +4515,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo2(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo2(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -4441,8 +4589,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareInfo501(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareInfo501 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4468,11 +4620,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->comment) {
+@@ -4480,11 +4634,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -4538,6 +4694,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr501(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr501 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -4557,13 +4714,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo501(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo501(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -4648,12 +4806,20 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareInfo502(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareInfo502 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ TALLOC_CTX *_mem_save_path_0;
+ uint32_t _ptr_password;
++ uint32_t size_password_1 = 0;
++ uint32_t length_password_1 = 0;
+ TALLOC_CTX *_mem_save_password_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4694,11 +4860,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->comment) {
+@@ -4706,11 +4874,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ if (r->path) {
+@@ -4718,11 +4888,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->path));
+- if (ndr_get_array_length(ndr, &r->path) > ndr_get_array_size(ndr, &r->path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->path), ndr_get_array_length(ndr, &r->path));
++ size_path_1 = ndr_get_array_size(ndr, &r->path);
++ length_path_1 = ndr_get_array_length(ndr, &r->path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, ndr_get_array_length(ndr, &r->path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (r->password) {
+@@ -4730,11 +4902,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->password, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->password));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->password));
+- if (ndr_get_array_length(ndr, &r->password) > ndr_get_array_size(ndr, &r->password)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->password), ndr_get_array_length(ndr, &r->password));
++ size_password_1 = ndr_get_array_size(ndr, &r->password);
++ length_password_1 = ndr_get_array_length(ndr, &r->password);
++ if (length_password_1 > size_password_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_password_1, length_password_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, ndr_get_array_length(ndr, &r->password), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_password_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->password, length_password_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_password_0, 0);
+ }
+ NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_BUFFERS, &r->sd_buf));
+@@ -4804,6 +4978,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr502(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr502 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -4823,13 +4998,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo502(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo502(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -4887,6 +5063,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareInfo1004(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareInfo1004 *r)
+ {
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -4904,11 +5082,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -4954,6 +5134,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr1004(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr1004 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -4973,13 +5154,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1004(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1004(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5094,6 +5276,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr1005(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr1005 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -5113,10 +5296,11 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1005(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5208,6 +5392,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr1006(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr1006 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -5227,10 +5412,11 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1006(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5289,6 +5475,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareInfo1007(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareInfo1007 *r)
+ {
+ uint32_t _ptr_alternate_directory_name;
++ uint32_t size_alternate_directory_name_1 = 0;
++ uint32_t length_alternate_directory_name_1 = 0;
+ TALLOC_CTX *_mem_save_alternate_directory_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -5307,11 +5495,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->alternate_directory_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->alternate_directory_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->alternate_directory_name));
+- if (ndr_get_array_length(ndr, &r->alternate_directory_name) > ndr_get_array_size(ndr, &r->alternate_directory_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->alternate_directory_name), ndr_get_array_length(ndr, &r->alternate_directory_name));
++ size_alternate_directory_name_1 = ndr_get_array_size(ndr, &r->alternate_directory_name);
++ length_alternate_directory_name_1 = ndr_get_array_length(ndr, &r->alternate_directory_name);
++ if (length_alternate_directory_name_1 > size_alternate_directory_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_alternate_directory_name_1, length_alternate_directory_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->alternate_directory_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->alternate_directory_name, ndr_get_array_length(ndr, &r->alternate_directory_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_alternate_directory_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->alternate_directory_name, length_alternate_directory_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_alternate_directory_name_0, 0);
+ }
+ }
+@@ -5358,6 +5548,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr1007(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr1007 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -5377,13 +5568,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1007(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetShareInfo1007(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5446,6 +5638,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCtr1501(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetShareCtr1501 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -5465,13 +5658,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -5636,15 +5830,25 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info0_0;
++ uint32_t _ptr_info0;
+ TALLOC_CTX *_mem_save_info1_0;
++ uint32_t _ptr_info1;
+ TALLOC_CTX *_mem_save_info2_0;
++ uint32_t _ptr_info2;
+ TALLOC_CTX *_mem_save_info501_0;
++ uint32_t _ptr_info501;
+ TALLOC_CTX *_mem_save_info502_0;
++ uint32_t _ptr_info502;
+ TALLOC_CTX *_mem_save_info1004_0;
++ uint32_t _ptr_info1004;
+ TALLOC_CTX *_mem_save_info1005_0;
++ uint32_t _ptr_info1005;
+ TALLOC_CTX *_mem_save_info1006_0;
++ uint32_t _ptr_info1006;
+ TALLOC_CTX *_mem_save_info1007_0;
++ uint32_t _ptr_info1007;
+ TALLOC_CTX *_mem_save_info1501_0;
++ uint32_t _ptr_info1501;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -5654,7 +5858,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_info0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info0));
+ if (_ptr_info0) {
+ NDR_PULL_ALLOC(ndr, r->info0);
+@@ -5664,7 +5867,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_info1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1));
+ if (_ptr_info1) {
+ NDR_PULL_ALLOC(ndr, r->info1);
+@@ -5674,7 +5876,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 2: {
+- uint32_t _ptr_info2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info2));
+ if (_ptr_info2) {
+ NDR_PULL_ALLOC(ndr, r->info2);
+@@ -5684,7 +5885,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 501: {
+- uint32_t _ptr_info501;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info501));
+ if (_ptr_info501) {
+ NDR_PULL_ALLOC(ndr, r->info501);
+@@ -5694,7 +5894,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 502: {
+- uint32_t _ptr_info502;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info502));
+ if (_ptr_info502) {
+ NDR_PULL_ALLOC(ndr, r->info502);
+@@ -5704,7 +5903,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1004: {
+- uint32_t _ptr_info1004;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1004));
+ if (_ptr_info1004) {
+ NDR_PULL_ALLOC(ndr, r->info1004);
+@@ -5714,7 +5912,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1005: {
+- uint32_t _ptr_info1005;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1005));
+ if (_ptr_info1005) {
+ NDR_PULL_ALLOC(ndr, r->info1005);
+@@ -5724,7 +5921,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1006: {
+- uint32_t _ptr_info1006;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1006));
+ if (_ptr_info1006) {
+ NDR_PULL_ALLOC(ndr, r->info1006);
+@@ -5734,7 +5930,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1007: {
+- uint32_t _ptr_info1007;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1007));
+ if (_ptr_info1007) {
+ NDR_PULL_ALLOC(ndr, r->info1007);
+@@ -5744,7 +5939,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1501: {
+- uint32_t _ptr_info1501;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1501));
+ if (_ptr_info1501) {
+ NDR_PULL_ALLOC(ndr, r->info1501);
+@@ -6088,15 +6282,25 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ TALLOC_CTX *_mem_save_ctr2_0;
++ uint32_t _ptr_ctr2;
+ TALLOC_CTX *_mem_save_ctr501_0;
++ uint32_t _ptr_ctr501;
+ TALLOC_CTX *_mem_save_ctr502_0;
++ uint32_t _ptr_ctr502;
+ TALLOC_CTX *_mem_save_ctr1004_0;
++ uint32_t _ptr_ctr1004;
+ TALLOC_CTX *_mem_save_ctr1005_0;
++ uint32_t _ptr_ctr1005;
+ TALLOC_CTX *_mem_save_ctr1006_0;
++ uint32_t _ptr_ctr1006;
+ TALLOC_CTX *_mem_save_ctr1007_0;
++ uint32_t _ptr_ctr1007;
+ TALLOC_CTX *_mem_save_ctr1501_0;
++ uint32_t _ptr_ctr1501;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -6106,7 +6310,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -6116,7 +6319,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -6126,7 +6328,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 2: {
+- uint32_t _ptr_ctr2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr2));
+ if (_ptr_ctr2) {
+ NDR_PULL_ALLOC(ndr, r->ctr2);
+@@ -6136,7 +6337,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 501: {
+- uint32_t _ptr_ctr501;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr501));
+ if (_ptr_ctr501) {
+ NDR_PULL_ALLOC(ndr, r->ctr501);
+@@ -6146,7 +6346,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 502: {
+- uint32_t _ptr_ctr502;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr502));
+ if (_ptr_ctr502) {
+ NDR_PULL_ALLOC(ndr, r->ctr502);
+@@ -6156,7 +6355,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1004: {
+- uint32_t _ptr_ctr1004;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1004));
+ if (_ptr_ctr1004) {
+ NDR_PULL_ALLOC(ndr, r->ctr1004);
+@@ -6166,7 +6364,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1005: {
+- uint32_t _ptr_ctr1005;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1005));
+ if (_ptr_ctr1005) {
+ NDR_PULL_ALLOC(ndr, r->ctr1005);
+@@ -6176,7 +6373,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1006: {
+- uint32_t _ptr_ctr1006;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1006));
+ if (_ptr_ctr1006) {
+ NDR_PULL_ALLOC(ndr, r->ctr1006);
+@@ -6186,7 +6382,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1007: {
+- uint32_t _ptr_ctr1007;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1007));
+ if (_ptr_ctr1007) {
+ NDR_PULL_ALLOC(ndr, r->ctr1007);
+@@ -6196,7 +6391,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1501: {
+- uint32_t _ptr_ctr1501;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1501));
+ if (_ptr_ctr1501) {
+ NDR_PULL_ALLOC(ndr, r->ctr1501);
+@@ -6502,6 +6696,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_srvs
+ _PUBLIC_ enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo100(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo100 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -6520,11 +6716,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_srvs
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ }
+@@ -6577,8 +6775,12 @@ _PUBLIC_ enum ndr_err_code ndr_push_srvs
+ _PUBLIC_ enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo101(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo101 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -6606,11 +6808,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_srvs
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (r->comment) {
+@@ -6618,11 +6822,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_srvs
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -6697,10 +6903,16 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo102(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo102 *r)
+ {
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ uint32_t _ptr_userpath;
++ uint32_t size_userpath_1 = 0;
++ uint32_t length_userpath_1 = 0;
+ TALLOC_CTX *_mem_save_userpath_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -6740,11 +6952,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (r->comment) {
+@@ -6752,11 +6966,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ if (r->userpath) {
+@@ -6764,11 +6980,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->userpath, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->userpath));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->userpath));
+- if (ndr_get_array_length(ndr, &r->userpath) > ndr_get_array_size(ndr, &r->userpath)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->userpath), ndr_get_array_length(ndr, &r->userpath));
++ size_userpath_1 = ndr_get_array_size(ndr, &r->userpath);
++ length_userpath_1 = ndr_get_array_length(ndr, &r->userpath);
++ if (length_userpath_1 > size_userpath_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_userpath_1, length_userpath_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->userpath), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->userpath, ndr_get_array_length(ndr, &r->userpath), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_userpath_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->userpath, length_userpath_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_userpath_0, 0);
+ }
+ }
+@@ -6873,10 +7091,16 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo402(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo402 *r)
+ {
+ uint32_t _ptr_alerts;
++ uint32_t size_alerts_1 = 0;
++ uint32_t length_alerts_1 = 0;
+ TALLOC_CTX *_mem_save_alerts_0;
+ uint32_t _ptr_guestaccount;
++ uint32_t size_guestaccount_1 = 0;
++ uint32_t length_guestaccount_1 = 0;
+ TALLOC_CTX *_mem_save_guestaccount_0;
+ uint32_t _ptr_srvheuristics;
++ uint32_t size_srvheuristics_1 = 0;
++ uint32_t length_srvheuristics_1 = 0;
+ TALLOC_CTX *_mem_save_srvheuristics_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -6934,11 +7158,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->alerts, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->alerts));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->alerts));
+- if (ndr_get_array_length(ndr, &r->alerts) > ndr_get_array_size(ndr, &r->alerts)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->alerts), ndr_get_array_length(ndr, &r->alerts));
++ size_alerts_1 = ndr_get_array_size(ndr, &r->alerts);
++ length_alerts_1 = ndr_get_array_length(ndr, &r->alerts);
++ if (length_alerts_1 > size_alerts_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_alerts_1, length_alerts_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->alerts), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->alerts, ndr_get_array_length(ndr, &r->alerts), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_alerts_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->alerts, length_alerts_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_alerts_0, 0);
+ }
+ if (r->guestaccount) {
+@@ -6946,11 +7172,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->guestaccount, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->guestaccount));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->guestaccount));
+- if (ndr_get_array_length(ndr, &r->guestaccount) > ndr_get_array_size(ndr, &r->guestaccount)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->guestaccount), ndr_get_array_length(ndr, &r->guestaccount));
++ size_guestaccount_1 = ndr_get_array_size(ndr, &r->guestaccount);
++ length_guestaccount_1 = ndr_get_array_length(ndr, &r->guestaccount);
++ if (length_guestaccount_1 > size_guestaccount_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_guestaccount_1, length_guestaccount_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->guestaccount), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->guestaccount, ndr_get_array_length(ndr, &r->guestaccount), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_guestaccount_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->guestaccount, length_guestaccount_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_guestaccount_0, 0);
+ }
+ if (r->srvheuristics) {
+@@ -6958,11 +7186,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->srvheuristics, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->srvheuristics));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->srvheuristics));
+- if (ndr_get_array_length(ndr, &r->srvheuristics) > ndr_get_array_size(ndr, &r->srvheuristics)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->srvheuristics), ndr_get_array_length(ndr, &r->srvheuristics));
++ size_srvheuristics_1 = ndr_get_array_size(ndr, &r->srvheuristics);
++ length_srvheuristics_1 = ndr_get_array_length(ndr, &r->srvheuristics);
++ if (length_srvheuristics_1 > size_srvheuristics_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_srvheuristics_1, length_srvheuristics_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->srvheuristics), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->srvheuristics, ndr_get_array_length(ndr, &r->srvheuristics), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_srvheuristics_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->srvheuristics, length_srvheuristics_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_srvheuristics_0, 0);
+ }
+ }
+@@ -7094,12 +7324,20 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo403(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo403 *r)
+ {
+ uint32_t _ptr_alerts;
++ uint32_t size_alerts_1 = 0;
++ uint32_t length_alerts_1 = 0;
+ TALLOC_CTX *_mem_save_alerts_0;
+ uint32_t _ptr_guestaccount;
++ uint32_t size_guestaccount_1 = 0;
++ uint32_t length_guestaccount_1 = 0;
+ TALLOC_CTX *_mem_save_guestaccount_0;
+ uint32_t _ptr_srvheuristics;
++ uint32_t size_srvheuristics_1 = 0;
++ uint32_t length_srvheuristics_1 = 0;
+ TALLOC_CTX *_mem_save_srvheuristics_0;
+ uint32_t _ptr_autopath;
++ uint32_t size_autopath_1 = 0;
++ uint32_t length_autopath_1 = 0;
+ TALLOC_CTX *_mem_save_autopath_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -7165,11 +7403,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->alerts, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->alerts));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->alerts));
+- if (ndr_get_array_length(ndr, &r->alerts) > ndr_get_array_size(ndr, &r->alerts)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->alerts), ndr_get_array_length(ndr, &r->alerts));
++ size_alerts_1 = ndr_get_array_size(ndr, &r->alerts);
++ length_alerts_1 = ndr_get_array_length(ndr, &r->alerts);
++ if (length_alerts_1 > size_alerts_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_alerts_1, length_alerts_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->alerts), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->alerts, ndr_get_array_length(ndr, &r->alerts), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_alerts_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->alerts, length_alerts_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_alerts_0, 0);
+ }
+ if (r->guestaccount) {
+@@ -7177,11 +7417,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->guestaccount, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->guestaccount));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->guestaccount));
+- if (ndr_get_array_length(ndr, &r->guestaccount) > ndr_get_array_size(ndr, &r->guestaccount)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->guestaccount), ndr_get_array_length(ndr, &r->guestaccount));
++ size_guestaccount_1 = ndr_get_array_size(ndr, &r->guestaccount);
++ length_guestaccount_1 = ndr_get_array_length(ndr, &r->guestaccount);
++ if (length_guestaccount_1 > size_guestaccount_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_guestaccount_1, length_guestaccount_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->guestaccount), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->guestaccount, ndr_get_array_length(ndr, &r->guestaccount), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_guestaccount_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->guestaccount, length_guestaccount_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_guestaccount_0, 0);
+ }
+ if (r->srvheuristics) {
+@@ -7189,11 +7431,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->srvheuristics, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->srvheuristics));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->srvheuristics));
+- if (ndr_get_array_length(ndr, &r->srvheuristics) > ndr_get_array_size(ndr, &r->srvheuristics)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->srvheuristics), ndr_get_array_length(ndr, &r->srvheuristics));
++ size_srvheuristics_1 = ndr_get_array_size(ndr, &r->srvheuristics);
++ length_srvheuristics_1 = ndr_get_array_length(ndr, &r->srvheuristics);
++ if (length_srvheuristics_1 > size_srvheuristics_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_srvheuristics_1, length_srvheuristics_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->srvheuristics), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->srvheuristics, ndr_get_array_length(ndr, &r->srvheuristics), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_srvheuristics_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->srvheuristics, length_srvheuristics_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_srvheuristics_0, 0);
+ }
+ if (r->autopath) {
+@@ -7201,11 +7445,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->autopath, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->autopath));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->autopath));
+- if (ndr_get_array_length(ndr, &r->autopath) > ndr_get_array_size(ndr, &r->autopath)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->autopath), ndr_get_array_length(ndr, &r->autopath));
++ size_autopath_1 = ndr_get_array_size(ndr, &r->autopath);
++ length_autopath_1 = ndr_get_array_length(ndr, &r->autopath);
++ if (length_autopath_1 > size_autopath_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_autopath_1, length_autopath_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->autopath), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->autopath, ndr_get_array_length(ndr, &r->autopath), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_autopath_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->autopath, length_autopath_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_autopath_0, 0);
+ }
+ }
+@@ -7418,6 +7664,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo503(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo503 *r)
+ {
+ uint32_t _ptr_domain;
++ uint32_t size_domain_1 = 0;
++ uint32_t length_domain_1 = 0;
+ TALLOC_CTX *_mem_save_domain_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -7476,11 +7724,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain));
+- if (ndr_get_array_length(ndr, &r->domain) > ndr_get_array_size(ndr, &r->domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain), ndr_get_array_length(ndr, &r->domain));
++ size_domain_1 = ndr_get_array_size(ndr, &r->domain);
++ length_domain_1 = ndr_get_array_length(ndr, &r->domain);
++ if (length_domain_1 > size_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_1, length_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, length_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_0, 0);
+ }
+ }
+@@ -7616,6 +7866,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo599(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo599 *r)
+ {
+ uint32_t _ptr_domain;
++ uint32_t size_domain_1 = 0;
++ uint32_t length_domain_1 = 0;
+ TALLOC_CTX *_mem_save_domain_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -7687,11 +7939,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain));
+- if (ndr_get_array_length(ndr, &r->domain) > ndr_get_array_size(ndr, &r->domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain), ndr_get_array_length(ndr, &r->domain));
++ size_domain_1 = ndr_get_array_size(ndr, &r->domain);
++ length_domain_1 = ndr_get_array_length(ndr, &r->domain);
++ if (length_domain_1 > size_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_1, length_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, length_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_0, 0);
+ }
+ }
+@@ -7786,6 +8040,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvInfo1005(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetSrvInfo1005 *r)
+ {
+ uint32_t _ptr_comment;
++ uint32_t size_comment_1 = 0;
++ uint32_t length_comment_1 = 0;
+ TALLOC_CTX *_mem_save_comment_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -7803,11 +8059,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->comment, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->comment));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->comment));
+- if (ndr_get_array_length(ndr, &r->comment) > ndr_get_array_size(ndr, &r->comment)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->comment), ndr_get_array_length(ndr, &r->comment));
++ size_comment_1 = ndr_get_array_size(ndr, &r->comment);
++ length_comment_1 = ndr_get_array_length(ndr, &r->comment);
++ if (length_comment_1 > size_comment_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_comment_1, length_comment_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, ndr_get_array_length(ndr, &r->comment), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_comment_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->comment, length_comment_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_comment_0, 0);
+ }
+ }
+@@ -10045,64 +10303,123 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_info100_0;
++ uint32_t _ptr_info100;
+ TALLOC_CTX *_mem_save_info101_0;
++ uint32_t _ptr_info101;
+ TALLOC_CTX *_mem_save_info102_0;
++ uint32_t _ptr_info102;
+ TALLOC_CTX *_mem_save_info402_0;
++ uint32_t _ptr_info402;
+ TALLOC_CTX *_mem_save_info403_0;
++ uint32_t _ptr_info403;
+ TALLOC_CTX *_mem_save_info502_0;
++ uint32_t _ptr_info502;
+ TALLOC_CTX *_mem_save_info503_0;
++ uint32_t _ptr_info503;
+ TALLOC_CTX *_mem_save_info599_0;
++ uint32_t _ptr_info599;
+ TALLOC_CTX *_mem_save_info1005_0;
++ uint32_t _ptr_info1005;
+ TALLOC_CTX *_mem_save_info1010_0;
++ uint32_t _ptr_info1010;
+ TALLOC_CTX *_mem_save_info1016_0;
++ uint32_t _ptr_info1016;
+ TALLOC_CTX *_mem_save_info1017_0;
++ uint32_t _ptr_info1017;
+ TALLOC_CTX *_mem_save_info1018_0;
++ uint32_t _ptr_info1018;
+ TALLOC_CTX *_mem_save_info1107_0;
++ uint32_t _ptr_info1107;
+ TALLOC_CTX *_mem_save_info1501_0;
++ uint32_t _ptr_info1501;
+ TALLOC_CTX *_mem_save_info1502_0;
++ uint32_t _ptr_info1502;
+ TALLOC_CTX *_mem_save_info1503_0;
++ uint32_t _ptr_info1503;
+ TALLOC_CTX *_mem_save_info1506_0;
++ uint32_t _ptr_info1506;
+ TALLOC_CTX *_mem_save_info1509_0;
++ uint32_t _ptr_info1509;
+ TALLOC_CTX *_mem_save_info1510_0;
++ uint32_t _ptr_info1510;
+ TALLOC_CTX *_mem_save_info1511_0;
++ uint32_t _ptr_info1511;
+ TALLOC_CTX *_mem_save_info1512_0;
++ uint32_t _ptr_info1512;
+ TALLOC_CTX *_mem_save_info1513_0;
++ uint32_t _ptr_info1513;
+ TALLOC_CTX *_mem_save_info1514_0;
++ uint32_t _ptr_info1514;
+ TALLOC_CTX *_mem_save_info1515_0;
++ uint32_t _ptr_info1515;
+ TALLOC_CTX *_mem_save_info1516_0;
++ uint32_t _ptr_info1516;
+ TALLOC_CTX *_mem_save_info1518_0;
++ uint32_t _ptr_info1518;
+ TALLOC_CTX *_mem_save_info1520_0;
++ uint32_t _ptr_info1520;
+ TALLOC_CTX *_mem_save_info1521_0;
++ uint32_t _ptr_info1521;
+ TALLOC_CTX *_mem_save_info1522_0;
++ uint32_t _ptr_info1522;
+ TALLOC_CTX *_mem_save_info1523_0;
++ uint32_t _ptr_info1523;
+ TALLOC_CTX *_mem_save_info1524_0;
++ uint32_t _ptr_info1524;
+ TALLOC_CTX *_mem_save_info1525_0;
++ uint32_t _ptr_info1525;
+ TALLOC_CTX *_mem_save_info1528_0;
++ uint32_t _ptr_info1528;
+ TALLOC_CTX *_mem_save_info1529_0;
++ uint32_t _ptr_info1529;
+ TALLOC_CTX *_mem_save_info1530_0;
++ uint32_t _ptr_info1530;
+ TALLOC_CTX *_mem_save_info1533_0;
++ uint32_t _ptr_info1533;
+ TALLOC_CTX *_mem_save_info1534_0;
++ uint32_t _ptr_info1534;
+ TALLOC_CTX *_mem_save_info1535_0;
++ uint32_t _ptr_info1535;
+ TALLOC_CTX *_mem_save_info1536_0;
++ uint32_t _ptr_info1536;
+ TALLOC_CTX *_mem_save_info1537_0;
++ uint32_t _ptr_info1537;
+ TALLOC_CTX *_mem_save_info1538_0;
++ uint32_t _ptr_info1538;
+ TALLOC_CTX *_mem_save_info1539_0;
++ uint32_t _ptr_info1539;
+ TALLOC_CTX *_mem_save_info1540_0;
++ uint32_t _ptr_info1540;
+ TALLOC_CTX *_mem_save_info1541_0;
++ uint32_t _ptr_info1541;
+ TALLOC_CTX *_mem_save_info1542_0;
++ uint32_t _ptr_info1542;
+ TALLOC_CTX *_mem_save_info1543_0;
++ uint32_t _ptr_info1543;
+ TALLOC_CTX *_mem_save_info1544_0;
++ uint32_t _ptr_info1544;
+ TALLOC_CTX *_mem_save_info1545_0;
++ uint32_t _ptr_info1545;
+ TALLOC_CTX *_mem_save_info1546_0;
++ uint32_t _ptr_info1546;
+ TALLOC_CTX *_mem_save_info1547_0;
++ uint32_t _ptr_info1547;
+ TALLOC_CTX *_mem_save_info1548_0;
++ uint32_t _ptr_info1548;
+ TALLOC_CTX *_mem_save_info1549_0;
++ uint32_t _ptr_info1549;
+ TALLOC_CTX *_mem_save_info1550_0;
++ uint32_t _ptr_info1550;
+ TALLOC_CTX *_mem_save_info1552_0;
++ uint32_t _ptr_info1552;
+ TALLOC_CTX *_mem_save_info1553_0;
++ uint32_t _ptr_info1553;
+ TALLOC_CTX *_mem_save_info1554_0;
++ uint32_t _ptr_info1554;
+ TALLOC_CTX *_mem_save_info1555_0;
++ uint32_t _ptr_info1555;
+ TALLOC_CTX *_mem_save_info1556_0;
++ uint32_t _ptr_info1556;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -10112,7 +10429,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 100: {
+- uint32_t _ptr_info100;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info100));
+ if (_ptr_info100) {
+ NDR_PULL_ALLOC(ndr, r->info100);
+@@ -10122,7 +10438,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 101: {
+- uint32_t _ptr_info101;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info101));
+ if (_ptr_info101) {
+ NDR_PULL_ALLOC(ndr, r->info101);
+@@ -10132,7 +10447,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 102: {
+- uint32_t _ptr_info102;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info102));
+ if (_ptr_info102) {
+ NDR_PULL_ALLOC(ndr, r->info102);
+@@ -10142,7 +10456,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 402: {
+- uint32_t _ptr_info402;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info402));
+ if (_ptr_info402) {
+ NDR_PULL_ALLOC(ndr, r->info402);
+@@ -10152,7 +10465,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 403: {
+- uint32_t _ptr_info403;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info403));
+ if (_ptr_info403) {
+ NDR_PULL_ALLOC(ndr, r->info403);
+@@ -10162,7 +10474,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 502: {
+- uint32_t _ptr_info502;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info502));
+ if (_ptr_info502) {
+ NDR_PULL_ALLOC(ndr, r->info502);
+@@ -10172,7 +10483,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 503: {
+- uint32_t _ptr_info503;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info503));
+ if (_ptr_info503) {
+ NDR_PULL_ALLOC(ndr, r->info503);
+@@ -10182,7 +10492,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 599: {
+- uint32_t _ptr_info599;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info599));
+ if (_ptr_info599) {
+ NDR_PULL_ALLOC(ndr, r->info599);
+@@ -10192,7 +10501,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1005: {
+- uint32_t _ptr_info1005;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1005));
+ if (_ptr_info1005) {
+ NDR_PULL_ALLOC(ndr, r->info1005);
+@@ -10202,7 +10510,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1010: {
+- uint32_t _ptr_info1010;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1010));
+ if (_ptr_info1010) {
+ NDR_PULL_ALLOC(ndr, r->info1010);
+@@ -10212,7 +10519,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1016: {
+- uint32_t _ptr_info1016;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1016));
+ if (_ptr_info1016) {
+ NDR_PULL_ALLOC(ndr, r->info1016);
+@@ -10222,7 +10528,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1017: {
+- uint32_t _ptr_info1017;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1017));
+ if (_ptr_info1017) {
+ NDR_PULL_ALLOC(ndr, r->info1017);
+@@ -10232,7 +10537,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1018: {
+- uint32_t _ptr_info1018;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1018));
+ if (_ptr_info1018) {
+ NDR_PULL_ALLOC(ndr, r->info1018);
+@@ -10242,7 +10546,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1107: {
+- uint32_t _ptr_info1107;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1107));
+ if (_ptr_info1107) {
+ NDR_PULL_ALLOC(ndr, r->info1107);
+@@ -10252,7 +10555,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1501: {
+- uint32_t _ptr_info1501;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1501));
+ if (_ptr_info1501) {
+ NDR_PULL_ALLOC(ndr, r->info1501);
+@@ -10262,7 +10564,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1502: {
+- uint32_t _ptr_info1502;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1502));
+ if (_ptr_info1502) {
+ NDR_PULL_ALLOC(ndr, r->info1502);
+@@ -10272,7 +10573,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1503: {
+- uint32_t _ptr_info1503;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1503));
+ if (_ptr_info1503) {
+ NDR_PULL_ALLOC(ndr, r->info1503);
+@@ -10282,7 +10582,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1506: {
+- uint32_t _ptr_info1506;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1506));
+ if (_ptr_info1506) {
+ NDR_PULL_ALLOC(ndr, r->info1506);
+@@ -10292,7 +10591,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1509: {
+- uint32_t _ptr_info1509;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1509));
+ if (_ptr_info1509) {
+ NDR_PULL_ALLOC(ndr, r->info1509);
+@@ -10302,7 +10600,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1510: {
+- uint32_t _ptr_info1510;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1510));
+ if (_ptr_info1510) {
+ NDR_PULL_ALLOC(ndr, r->info1510);
+@@ -10312,7 +10609,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1511: {
+- uint32_t _ptr_info1511;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1511));
+ if (_ptr_info1511) {
+ NDR_PULL_ALLOC(ndr, r->info1511);
+@@ -10322,7 +10618,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1512: {
+- uint32_t _ptr_info1512;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1512));
+ if (_ptr_info1512) {
+ NDR_PULL_ALLOC(ndr, r->info1512);
+@@ -10332,7 +10627,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1513: {
+- uint32_t _ptr_info1513;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1513));
+ if (_ptr_info1513) {
+ NDR_PULL_ALLOC(ndr, r->info1513);
+@@ -10342,7 +10636,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1514: {
+- uint32_t _ptr_info1514;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1514));
+ if (_ptr_info1514) {
+ NDR_PULL_ALLOC(ndr, r->info1514);
+@@ -10352,7 +10645,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1515: {
+- uint32_t _ptr_info1515;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1515));
+ if (_ptr_info1515) {
+ NDR_PULL_ALLOC(ndr, r->info1515);
+@@ -10362,7 +10654,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1516: {
+- uint32_t _ptr_info1516;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1516));
+ if (_ptr_info1516) {
+ NDR_PULL_ALLOC(ndr, r->info1516);
+@@ -10372,7 +10663,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1518: {
+- uint32_t _ptr_info1518;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1518));
+ if (_ptr_info1518) {
+ NDR_PULL_ALLOC(ndr, r->info1518);
+@@ -10382,7 +10672,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1520: {
+- uint32_t _ptr_info1520;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1520));
+ if (_ptr_info1520) {
+ NDR_PULL_ALLOC(ndr, r->info1520);
+@@ -10392,7 +10681,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1521: {
+- uint32_t _ptr_info1521;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1521));
+ if (_ptr_info1521) {
+ NDR_PULL_ALLOC(ndr, r->info1521);
+@@ -10402,7 +10690,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1522: {
+- uint32_t _ptr_info1522;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1522));
+ if (_ptr_info1522) {
+ NDR_PULL_ALLOC(ndr, r->info1522);
+@@ -10412,7 +10699,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1523: {
+- uint32_t _ptr_info1523;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1523));
+ if (_ptr_info1523) {
+ NDR_PULL_ALLOC(ndr, r->info1523);
+@@ -10422,7 +10708,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1524: {
+- uint32_t _ptr_info1524;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1524));
+ if (_ptr_info1524) {
+ NDR_PULL_ALLOC(ndr, r->info1524);
+@@ -10432,7 +10717,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1525: {
+- uint32_t _ptr_info1525;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1525));
+ if (_ptr_info1525) {
+ NDR_PULL_ALLOC(ndr, r->info1525);
+@@ -10442,7 +10726,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1528: {
+- uint32_t _ptr_info1528;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1528));
+ if (_ptr_info1528) {
+ NDR_PULL_ALLOC(ndr, r->info1528);
+@@ -10452,7 +10735,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1529: {
+- uint32_t _ptr_info1529;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1529));
+ if (_ptr_info1529) {
+ NDR_PULL_ALLOC(ndr, r->info1529);
+@@ -10462,7 +10744,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1530: {
+- uint32_t _ptr_info1530;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1530));
+ if (_ptr_info1530) {
+ NDR_PULL_ALLOC(ndr, r->info1530);
+@@ -10472,7 +10753,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1533: {
+- uint32_t _ptr_info1533;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1533));
+ if (_ptr_info1533) {
+ NDR_PULL_ALLOC(ndr, r->info1533);
+@@ -10482,7 +10762,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1534: {
+- uint32_t _ptr_info1534;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1534));
+ if (_ptr_info1534) {
+ NDR_PULL_ALLOC(ndr, r->info1534);
+@@ -10492,7 +10771,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1535: {
+- uint32_t _ptr_info1535;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1535));
+ if (_ptr_info1535) {
+ NDR_PULL_ALLOC(ndr, r->info1535);
+@@ -10502,7 +10780,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1536: {
+- uint32_t _ptr_info1536;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1536));
+ if (_ptr_info1536) {
+ NDR_PULL_ALLOC(ndr, r->info1536);
+@@ -10512,7 +10789,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1537: {
+- uint32_t _ptr_info1537;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1537));
+ if (_ptr_info1537) {
+ NDR_PULL_ALLOC(ndr, r->info1537);
+@@ -10522,7 +10798,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1538: {
+- uint32_t _ptr_info1538;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1538));
+ if (_ptr_info1538) {
+ NDR_PULL_ALLOC(ndr, r->info1538);
+@@ -10532,7 +10807,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1539: {
+- uint32_t _ptr_info1539;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1539));
+ if (_ptr_info1539) {
+ NDR_PULL_ALLOC(ndr, r->info1539);
+@@ -10542,7 +10816,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1540: {
+- uint32_t _ptr_info1540;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1540));
+ if (_ptr_info1540) {
+ NDR_PULL_ALLOC(ndr, r->info1540);
+@@ -10552,7 +10825,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1541: {
+- uint32_t _ptr_info1541;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1541));
+ if (_ptr_info1541) {
+ NDR_PULL_ALLOC(ndr, r->info1541);
+@@ -10562,7 +10834,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1542: {
+- uint32_t _ptr_info1542;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1542));
+ if (_ptr_info1542) {
+ NDR_PULL_ALLOC(ndr, r->info1542);
+@@ -10572,7 +10843,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1543: {
+- uint32_t _ptr_info1543;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1543));
+ if (_ptr_info1543) {
+ NDR_PULL_ALLOC(ndr, r->info1543);
+@@ -10582,7 +10852,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1544: {
+- uint32_t _ptr_info1544;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1544));
+ if (_ptr_info1544) {
+ NDR_PULL_ALLOC(ndr, r->info1544);
+@@ -10592,7 +10861,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1545: {
+- uint32_t _ptr_info1545;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1545));
+ if (_ptr_info1545) {
+ NDR_PULL_ALLOC(ndr, r->info1545);
+@@ -10602,7 +10870,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1546: {
+- uint32_t _ptr_info1546;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1546));
+ if (_ptr_info1546) {
+ NDR_PULL_ALLOC(ndr, r->info1546);
+@@ -10612,7 +10879,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1547: {
+- uint32_t _ptr_info1547;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1547));
+ if (_ptr_info1547) {
+ NDR_PULL_ALLOC(ndr, r->info1547);
+@@ -10622,7 +10888,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1548: {
+- uint32_t _ptr_info1548;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1548));
+ if (_ptr_info1548) {
+ NDR_PULL_ALLOC(ndr, r->info1548);
+@@ -10632,7 +10897,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1549: {
+- uint32_t _ptr_info1549;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1549));
+ if (_ptr_info1549) {
+ NDR_PULL_ALLOC(ndr, r->info1549);
+@@ -10642,7 +10906,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1550: {
+- uint32_t _ptr_info1550;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1550));
+ if (_ptr_info1550) {
+ NDR_PULL_ALLOC(ndr, r->info1550);
+@@ -10652,7 +10915,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1552: {
+- uint32_t _ptr_info1552;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1552));
+ if (_ptr_info1552) {
+ NDR_PULL_ALLOC(ndr, r->info1552);
+@@ -10662,7 +10924,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1553: {
+- uint32_t _ptr_info1553;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1553));
+ if (_ptr_info1553) {
+ NDR_PULL_ALLOC(ndr, r->info1553);
+@@ -10672,7 +10933,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1554: {
+- uint32_t _ptr_info1554;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1554));
+ if (_ptr_info1554) {
+ NDR_PULL_ALLOC(ndr, r->info1554);
+@@ -10682,7 +10942,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1555: {
+- uint32_t _ptr_info1555;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1555));
+ if (_ptr_info1555) {
+ NDR_PULL_ALLOC(ndr, r->info1555);
+@@ -10692,7 +10951,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1556: {
+- uint32_t _ptr_info1556;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_info1556));
+ if (_ptr_info1556) {
+ NDR_PULL_ALLOC(ndr, r->info1556);
+@@ -11806,11 +12064,13 @@ static enum ndr_err_code ndr_push_srvsvc
+
+ static enum ndr_err_code ndr_pull_srvsvc_NetDiskInfo0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetDiskInfo0 *r)
+ {
++ uint32_t size_disk_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 4));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__disk_offset));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->__disk_length));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->disk, r->__disk_length, sizeof(uint16_t), CH_UTF16));
++ size_disk_0 = r->__disk_length;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->disk, size_disk_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -11853,6 +12113,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetDiskInfo(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetDiskInfo *r)
+ {
+ uint32_t _ptr_disks;
++ uint32_t size_disks_1 = 0;
++ uint32_t length_disks_1 = 0;
+ uint32_t cntr_disks_1;
+ TALLOC_CTX *_mem_save_disks_0;
+ TALLOC_CTX *_mem_save_disks_1;
+@@ -11873,13 +12135,15 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->disks, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->disks));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->disks));
+- if (ndr_get_array_length(ndr, &r->disks) > ndr_get_array_size(ndr, &r->disks)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->disks), ndr_get_array_length(ndr, &r->disks));
++ size_disks_1 = ndr_get_array_size(ndr, &r->disks);
++ length_disks_1 = ndr_get_array_length(ndr, &r->disks);
++ if (length_disks_1 > size_disks_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_disks_1, length_disks_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->disks, ndr_get_array_size(ndr, &r->disks));
++ NDR_PULL_ALLOC_N(ndr, r->disks, size_disks_1);
+ _mem_save_disks_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->disks, 0);
+- for (cntr_disks_1 = 0; cntr_disks_1 < ndr_get_array_length(ndr, &r->disks); cntr_disks_1++) {
++ for (cntr_disks_1 = 0; cntr_disks_1 < length_disks_1; cntr_disks_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetDiskInfo0(ndr, NDR_SCALARS, &r->disks[cntr_disks_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_disks_1, 0);
+@@ -12034,10 +12298,15 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportInfo0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportInfo0 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_addr;
++ uint32_t size_addr_1 = 0;
+ TALLOC_CTX *_mem_save_addr_0;
+ uint32_t _ptr_net_addr;
++ uint32_t size_net_addr_1 = 0;
++ uint32_t length_net_addr_1 = 0;
+ TALLOC_CTX *_mem_save_net_addr_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -12069,19 +12338,22 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->addr) {
+ _mem_save_addr_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->addr));
+- NDR_PULL_ALLOC_N(ndr, r->addr, ndr_get_array_size(ndr, &r->addr));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, ndr_get_array_size(ndr, &r->addr)));
++ size_addr_1 = ndr_get_array_size(ndr, &r->addr);
++ NDR_PULL_ALLOC_N(ndr, r->addr, size_addr_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, size_addr_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_addr_0, 0);
+ }
+ if (r->net_addr) {
+@@ -12089,11 +12361,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->net_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->net_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->net_addr));
+- if (ndr_get_array_length(ndr, &r->net_addr) > ndr_get_array_size(ndr, &r->net_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->net_addr), ndr_get_array_length(ndr, &r->net_addr));
++ size_net_addr_1 = ndr_get_array_size(ndr, &r->net_addr);
++ length_net_addr_1 = ndr_get_array_length(ndr, &r->net_addr);
++ if (length_net_addr_1 > size_net_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_net_addr_1, length_net_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_net_addr_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, length_net_addr_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_net_addr_0, 0);
+ }
+ if (r->addr) {
+@@ -12156,6 +12430,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportCtr0(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportCtr0 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -12175,13 +12450,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -12260,12 +12536,19 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportInfo1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportInfo1 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_addr;
++ uint32_t size_addr_1 = 0;
+ TALLOC_CTX *_mem_save_addr_0;
+ uint32_t _ptr_net_addr;
++ uint32_t size_net_addr_1 = 0;
++ uint32_t length_net_addr_1 = 0;
+ TALLOC_CTX *_mem_save_net_addr_0;
+ uint32_t _ptr_domain;
++ uint32_t size_domain_1 = 0;
++ uint32_t length_domain_1 = 0;
+ TALLOC_CTX *_mem_save_domain_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -12303,19 +12586,22 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->addr) {
+ _mem_save_addr_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->addr));
+- NDR_PULL_ALLOC_N(ndr, r->addr, ndr_get_array_size(ndr, &r->addr));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, ndr_get_array_size(ndr, &r->addr)));
++ size_addr_1 = ndr_get_array_size(ndr, &r->addr);
++ NDR_PULL_ALLOC_N(ndr, r->addr, size_addr_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, size_addr_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_addr_0, 0);
+ }
+ if (r->net_addr) {
+@@ -12323,11 +12609,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->net_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->net_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->net_addr));
+- if (ndr_get_array_length(ndr, &r->net_addr) > ndr_get_array_size(ndr, &r->net_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->net_addr), ndr_get_array_length(ndr, &r->net_addr));
++ size_net_addr_1 = ndr_get_array_size(ndr, &r->net_addr);
++ length_net_addr_1 = ndr_get_array_length(ndr, &r->net_addr);
++ if (length_net_addr_1 > size_net_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_net_addr_1, length_net_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_net_addr_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, length_net_addr_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_net_addr_0, 0);
+ }
+ if (r->domain) {
+@@ -12335,11 +12623,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain));
+- if (ndr_get_array_length(ndr, &r->domain) > ndr_get_array_size(ndr, &r->domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain), ndr_get_array_length(ndr, &r->domain));
++ size_domain_1 = ndr_get_array_size(ndr, &r->domain);
++ length_domain_1 = ndr_get_array_length(ndr, &r->domain);
++ if (length_domain_1 > size_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_1, length_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, length_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_0, 0);
+ }
+ if (r->addr) {
+@@ -12408,6 +12698,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportCtr1(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportCtr1 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -12427,13 +12718,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo1(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo1(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -12513,12 +12805,19 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportInfo2(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportInfo2 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_addr;
++ uint32_t size_addr_1 = 0;
+ TALLOC_CTX *_mem_save_addr_0;
+ uint32_t _ptr_net_addr;
++ uint32_t size_net_addr_1 = 0;
++ uint32_t length_net_addr_1 = 0;
+ TALLOC_CTX *_mem_save_net_addr_0;
+ uint32_t _ptr_domain;
++ uint32_t size_domain_1 = 0;
++ uint32_t length_domain_1 = 0;
+ TALLOC_CTX *_mem_save_domain_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -12557,19 +12856,22 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->addr) {
+ _mem_save_addr_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->addr));
+- NDR_PULL_ALLOC_N(ndr, r->addr, ndr_get_array_size(ndr, &r->addr));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, ndr_get_array_size(ndr, &r->addr)));
++ size_addr_1 = ndr_get_array_size(ndr, &r->addr);
++ NDR_PULL_ALLOC_N(ndr, r->addr, size_addr_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, size_addr_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_addr_0, 0);
+ }
+ if (r->net_addr) {
+@@ -12577,11 +12879,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->net_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->net_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->net_addr));
+- if (ndr_get_array_length(ndr, &r->net_addr) > ndr_get_array_size(ndr, &r->net_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->net_addr), ndr_get_array_length(ndr, &r->net_addr));
++ size_net_addr_1 = ndr_get_array_size(ndr, &r->net_addr);
++ length_net_addr_1 = ndr_get_array_length(ndr, &r->net_addr);
++ if (length_net_addr_1 > size_net_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_net_addr_1, length_net_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_net_addr_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, length_net_addr_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_net_addr_0, 0);
+ }
+ if (r->domain) {
+@@ -12589,11 +12893,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain));
+- if (ndr_get_array_length(ndr, &r->domain) > ndr_get_array_size(ndr, &r->domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain), ndr_get_array_length(ndr, &r->domain));
++ size_domain_1 = ndr_get_array_size(ndr, &r->domain);
++ length_domain_1 = ndr_get_array_length(ndr, &r->domain);
++ if (length_domain_1 > size_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_1, length_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, length_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_0, 0);
+ }
+ if (r->addr) {
+@@ -12663,6 +12969,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportCtr2(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportCtr2 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -12682,13 +12989,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo2(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo2(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -12770,13 +13078,21 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportInfo3(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportInfo3 *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ uint32_t _ptr_addr;
++ uint32_t size_addr_1 = 0;
+ TALLOC_CTX *_mem_save_addr_0;
+ uint32_t _ptr_net_addr;
++ uint32_t size_net_addr_1 = 0;
++ uint32_t length_net_addr_1 = 0;
+ TALLOC_CTX *_mem_save_net_addr_0;
+ uint32_t _ptr_domain;
++ uint32_t size_domain_1 = 0;
++ uint32_t length_domain_1 = 0;
+ TALLOC_CTX *_mem_save_domain_0;
++ uint32_t size_unknown3_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->vcs));
+@@ -12807,7 +13123,8 @@ static enum ndr_err_code ndr_pull_srvsvc
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->unknown1));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->unknown2));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->unknown3, 256));
++ size_unknown3_0 = 256;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->unknown3, size_unknown3_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 5));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -12816,19 +13133,22 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->addr) {
+ _mem_save_addr_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->addr));
+- NDR_PULL_ALLOC_N(ndr, r->addr, ndr_get_array_size(ndr, &r->addr));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, ndr_get_array_size(ndr, &r->addr)));
++ size_addr_1 = ndr_get_array_size(ndr, &r->addr);
++ NDR_PULL_ALLOC_N(ndr, r->addr, size_addr_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->addr, size_addr_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_addr_0, 0);
+ }
+ if (r->net_addr) {
+@@ -12836,11 +13156,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->net_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->net_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->net_addr));
+- if (ndr_get_array_length(ndr, &r->net_addr) > ndr_get_array_size(ndr, &r->net_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->net_addr), ndr_get_array_length(ndr, &r->net_addr));
++ size_net_addr_1 = ndr_get_array_size(ndr, &r->net_addr);
++ length_net_addr_1 = ndr_get_array_length(ndr, &r->net_addr);
++ if (length_net_addr_1 > size_net_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_net_addr_1, length_net_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, ndr_get_array_length(ndr, &r->net_addr), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_net_addr_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->net_addr, length_net_addr_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_net_addr_0, 0);
+ }
+ if (r->domain) {
+@@ -12848,11 +13170,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->domain, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->domain));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->domain));
+- if (ndr_get_array_length(ndr, &r->domain) > ndr_get_array_size(ndr, &r->domain)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->domain), ndr_get_array_length(ndr, &r->domain));
++ size_domain_1 = ndr_get_array_size(ndr, &r->domain);
++ length_domain_1 = ndr_get_array_length(ndr, &r->domain);
++ if (length_domain_1 > size_domain_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_domain_1, length_domain_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, ndr_get_array_length(ndr, &r->domain), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_domain_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->domain, length_domain_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_domain_0, 0);
+ }
+ if (r->addr) {
+@@ -12924,6 +13248,7 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportCtr3(struct ndr_pull *ndr, int ndr_flags, struct srvsvc_NetTransportCtr3 *r)
+ {
+ uint32_t _ptr_array;
++ uint32_t size_array_1 = 0;
+ uint32_t cntr_array_1;
+ TALLOC_CTX *_mem_save_array_0;
+ TALLOC_CTX *_mem_save_array_1;
+@@ -12943,13 +13268,14 @@ static enum ndr_err_code ndr_pull_srvsvc
+ _mem_save_array_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->array));
+- NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
++ size_array_1 = ndr_get_array_size(ndr, &r->array);
++ NDR_PULL_ALLOC_N(ndr, r->array, size_array_1);
+ _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo3(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
+ }
+- for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
++ for (cntr_array_1 = 0; cntr_array_1 < size_array_1; cntr_array_1++) {
+ NDR_CHECK(ndr_pull_srvsvc_NetTransportInfo3(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
+@@ -13054,9 +13380,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ int level;
+ uint32_t _level;
+ TALLOC_CTX *_mem_save_ctr0_0;
++ uint32_t _ptr_ctr0;
+ TALLOC_CTX *_mem_save_ctr1_0;
++ uint32_t _ptr_ctr1;
+ TALLOC_CTX *_mem_save_ctr2_0;
++ uint32_t _ptr_ctr2;
+ TALLOC_CTX *_mem_save_ctr3_0;
++ uint32_t _ptr_ctr3;
+ level = ndr_pull_get_switch_value(ndr, r);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &_level));
+@@ -13066,7 +13396,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_CHECK(ndr_pull_union_align(ndr, 5));
+ switch (level) {
+ case 0: {
+- uint32_t _ptr_ctr0;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr0));
+ if (_ptr_ctr0) {
+ NDR_PULL_ALLOC(ndr, r->ctr0);
+@@ -13076,7 +13405,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 1: {
+- uint32_t _ptr_ctr1;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
+ if (_ptr_ctr1) {
+ NDR_PULL_ALLOC(ndr, r->ctr1);
+@@ -13086,7 +13414,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 2: {
+- uint32_t _ptr_ctr2;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr2));
+ if (_ptr_ctr2) {
+ NDR_PULL_ALLOC(ndr, r->ctr2);
+@@ -13096,7 +13423,6 @@ static enum ndr_err_code ndr_pull_srvsvc
+ break; }
+
+ case 3: {
+- uint32_t _ptr_ctr3;
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr3));
+ if (_ptr_ctr3) {
+ NDR_PULL_ALLOC(ndr, r->ctr3);
+@@ -13487,6 +13813,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_ctr_0;
+@@ -13506,11 +13834,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -13652,6 +13982,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevGetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevGetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_device_name_0 = 0;
++ uint32_t length_device_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+@@ -13668,20 +14002,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.device_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.device_name));
+- if (ndr_get_array_length(ndr, &r->in.device_name) > ndr_get_array_size(ndr, &r->in.device_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.device_name), ndr_get_array_length(ndr, &r->in.device_name));
++ size_device_name_0 = ndr_get_array_size(ndr, &r->in.device_name);
++ length_device_name_0 = ndr_get_array_length(ndr, &r->in.device_name);
++ if (length_device_name_0 > size_device_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_device_name_0, length_device_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.device_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.device_name, ndr_get_array_length(ndr, &r->in.device_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_device_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.device_name, length_device_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+ NDR_PULL_ALLOC(ndr, r->out.info);
+ ZERO_STRUCTP(r->out.info);
+@@ -13759,6 +14097,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevControl(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevControl *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_device_name_0 = 0;
++ uint32_t length_device_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -13772,20 +14114,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.device_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.device_name));
+- if (ndr_get_array_length(ndr, &r->in.device_name) > ndr_get_array_size(ndr, &r->in.device_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.device_name), ndr_get_array_length(ndr, &r->in.device_name));
++ size_device_name_0 = ndr_get_array_size(ndr, &r->in.device_name);
++ length_device_name_0 = ndr_get_array_length(ndr, &r->in.device_name);
++ if (length_device_name_0 > size_device_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_device_name_0, length_device_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.device_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.device_name, ndr_get_array_length(ndr, &r->in.device_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_device_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.device_name, length_device_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.opcode));
+ }
+ if (flags & NDR_OUT) {
+@@ -13871,7 +14217,11 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevQEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_user_0;
+@@ -13892,11 +14242,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_user));
+@@ -13910,11 +14262,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.user));
+- if (ndr_get_array_length(ndr, &r->in.user) > ndr_get_array_size(ndr, &r->in.user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.user), ndr_get_array_length(ndr, &r->in.user));
++ size_user_1 = ndr_get_array_size(ndr, &r->in.user);
++ length_user_1 = ndr_get_array_length(ndr, &r->in.user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -14066,6 +14420,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQGetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevQGetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_queue_name_0 = 0;
++ uint32_t length_queue_name_0 = 0;
++ uint32_t size_user_0 = 0;
++ uint32_t length_user_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+@@ -14082,27 +14442,33 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.queue_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.queue_name));
+- if (ndr_get_array_length(ndr, &r->in.queue_name) > ndr_get_array_size(ndr, &r->in.queue_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.queue_name), ndr_get_array_length(ndr, &r->in.queue_name));
++ size_queue_name_0 = ndr_get_array_size(ndr, &r->in.queue_name);
++ length_queue_name_0 = ndr_get_array_length(ndr, &r->in.queue_name);
++ if (length_queue_name_0 > size_queue_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_queue_name_0, length_queue_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_queue_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, length_queue_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.user));
+- if (ndr_get_array_length(ndr, &r->in.user) > ndr_get_array_size(ndr, &r->in.user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.user), ndr_get_array_length(ndr, &r->in.user));
++ size_user_0 = ndr_get_array_size(ndr, &r->in.user);
++ length_user_0 = ndr_get_array_length(ndr, &r->in.user);
++ if (length_user_0 > size_user_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_0, length_user_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, length_user_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+ NDR_PULL_ALLOC(ndr, r->out.info);
+ ZERO_STRUCTP(r->out.info);
+@@ -14191,6 +14557,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQSetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevQSetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_queue_name_0 = 0;
++ uint32_t length_queue_name_0 = 0;
+ uint32_t _ptr_parm_error;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_parm_error_0;
+@@ -14208,20 +14578,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.queue_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.queue_name));
+- if (ndr_get_array_length(ndr, &r->in.queue_name) > ndr_get_array_size(ndr, &r->in.queue_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.queue_name), ndr_get_array_length(ndr, &r->in.queue_name));
++ size_queue_name_0 = ndr_get_array_size(ndr, &r->in.queue_name);
++ length_queue_name_0 = ndr_get_array_length(ndr, &r->in.queue_name);
++ if (length_queue_name_0 > size_queue_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_queue_name_0, length_queue_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_queue_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, length_queue_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+ NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->in.info, r->in.level));
+ NDR_CHECK(ndr_pull_srvsvc_NetCharDevQInfo(ndr, NDR_SCALARS|NDR_BUFFERS, &r->in.info));
+@@ -14323,6 +14697,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQPurge(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevQPurge *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_queue_name_0 = 0;
++ uint32_t length_queue_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -14336,20 +14714,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.queue_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.queue_name));
+- if (ndr_get_array_length(ndr, &r->in.queue_name) > ndr_get_array_size(ndr, &r->in.queue_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.queue_name), ndr_get_array_length(ndr, &r->in.queue_name));
++ size_queue_name_0 = ndr_get_array_size(ndr, &r->in.queue_name);
++ length_queue_name_0 = ndr_get_array_length(ndr, &r->in.queue_name);
++ if (length_queue_name_0 > size_queue_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_queue_name_0, length_queue_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_queue_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, length_queue_name_0, sizeof(uint16_t), CH_UTF16));
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->out.result));
+@@ -14413,6 +14795,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetCharDevQPurgeSelf(struct ndr_pull *ndr, int flags, struct srvsvc_NetCharDevQPurgeSelf *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_queue_name_0 = 0;
++ uint32_t length_queue_name_0 = 0;
++ uint32_t size_computer_name_0 = 0;
++ uint32_t length_computer_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -14426,27 +14814,33 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.queue_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.queue_name));
+- if (ndr_get_array_length(ndr, &r->in.queue_name) > ndr_get_array_size(ndr, &r->in.queue_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.queue_name), ndr_get_array_length(ndr, &r->in.queue_name));
++ size_queue_name_0 = ndr_get_array_size(ndr, &r->in.queue_name);
++ length_queue_name_0 = ndr_get_array_length(ndr, &r->in.queue_name);
++ if (length_queue_name_0 > size_queue_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_queue_name_0, length_queue_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, ndr_get_array_length(ndr, &r->in.queue_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_queue_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.queue_name, length_queue_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.computer_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.computer_name));
+- if (ndr_get_array_length(ndr, &r->in.computer_name) > ndr_get_array_size(ndr, &r->in.computer_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.computer_name), ndr_get_array_length(ndr, &r->in.computer_name));
++ size_computer_name_0 = ndr_get_array_size(ndr, &r->in.computer_name);
++ length_computer_name_0 = ndr_get_array_length(ndr, &r->in.computer_name);
++ if (length_computer_name_0 > size_computer_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_computer_name_0, length_computer_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.computer_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.computer_name, ndr_get_array_length(ndr, &r->in.computer_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_computer_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.computer_name, length_computer_name_0, sizeof(uint16_t), CH_UTF16));
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->out.result));
+@@ -14531,7 +14925,11 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetConnEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetConnEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_path_0;
+@@ -14552,11 +14950,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_path));
+@@ -14570,11 +14970,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.path));
+- if (ndr_get_array_length(ndr, &r->in.path) > ndr_get_array_size(ndr, &r->in.path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.path), ndr_get_array_length(ndr, &r->in.path));
++ size_path_1 = ndr_get_array_size(ndr, &r->in.path);
++ length_path_1 = ndr_get_array_length(ndr, &r->in.path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -14747,8 +15149,14 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetFileEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetFileEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_path;
++ uint32_t size_path_1 = 0;
++ uint32_t length_path_1 = 0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_path_0;
+@@ -14770,11 +15178,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_path));
+@@ -14788,11 +15198,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.path, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.path));
+- if (ndr_get_array_length(ndr, &r->in.path) > ndr_get_array_size(ndr, &r->in.path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.path), ndr_get_array_length(ndr, &r->in.path));
++ size_path_1 = ndr_get_array_size(ndr, &r->in.path);
++ length_path_1 = ndr_get_array_length(ndr, &r->in.path);
++ if (length_path_1 > size_path_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_1, length_path_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, length_path_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_path_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_user));
+@@ -14806,11 +15218,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.user));
+- if (ndr_get_array_length(ndr, &r->in.user) > ndr_get_array_size(ndr, &r->in.user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.user), ndr_get_array_length(ndr, &r->in.user));
++ size_user_1 = ndr_get_array_size(ndr, &r->in.user);
++ length_user_1 = ndr_get_array_length(ndr, &r->in.user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -14961,6 +15375,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetFileGetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetFileGetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+@@ -14977,11 +15393,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.fid));
+@@ -15058,6 +15476,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetFileClose(struct ndr_pull *ndr, int flags, struct srvsvc_NetFileClose *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -15071,11 +15491,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.fid));
+@@ -15169,8 +15591,14 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetSessEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_client;
++ uint32_t size_client_1 = 0;
++ uint32_t length_client_1 = 0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_client_0;
+@@ -15192,11 +15620,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_client));
+@@ -15210,11 +15640,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.client, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.client));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.client));
+- if (ndr_get_array_length(ndr, &r->in.client) > ndr_get_array_size(ndr, &r->in.client)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.client), ndr_get_array_length(ndr, &r->in.client));
++ size_client_1 = ndr_get_array_size(ndr, &r->in.client);
++ length_client_1 = ndr_get_array_length(ndr, &r->in.client);
++ if (length_client_1 > size_client_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_1, length_client_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.client), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.client, ndr_get_array_length(ndr, &r->in.client), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.client, length_client_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_user));
+@@ -15228,11 +15660,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.user));
+- if (ndr_get_array_length(ndr, &r->in.user) > ndr_get_array_size(ndr, &r->in.user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.user), ndr_get_array_length(ndr, &r->in.user));
++ size_user_1 = ndr_get_array_size(ndr, &r->in.user);
++ length_user_1 = ndr_get_array_length(ndr, &r->in.user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -15390,8 +15824,14 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSessDel(struct ndr_pull *ndr, int flags, struct srvsvc_NetSessDel *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_client;
++ uint32_t size_client_1 = 0;
++ uint32_t length_client_1 = 0;
+ uint32_t _ptr_user;
++ uint32_t size_user_1 = 0;
++ uint32_t length_user_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_client_0;
+ TALLOC_CTX *_mem_save_user_0;
+@@ -15407,11 +15847,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_client));
+@@ -15425,11 +15867,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.client, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.client));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.client));
+- if (ndr_get_array_length(ndr, &r->in.client) > ndr_get_array_size(ndr, &r->in.client)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.client), ndr_get_array_length(ndr, &r->in.client));
++ size_client_1 = ndr_get_array_size(ndr, &r->in.client);
++ length_client_1 = ndr_get_array_length(ndr, &r->in.client);
++ if (length_client_1 > size_client_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_1, length_client_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.client), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.client, ndr_get_array_length(ndr, &r->in.client), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.client, length_client_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_user));
+@@ -15443,11 +15887,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.user, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.user));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.user));
+- if (ndr_get_array_length(ndr, &r->in.user) > ndr_get_array_size(ndr, &r->in.user)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.user), ndr_get_array_length(ndr, &r->in.user));
++ size_user_1 = ndr_get_array_size(ndr, &r->in.user);
++ length_user_1 = ndr_get_array_length(ndr, &r->in.user);
++ if (length_user_1 > size_user_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_user_1, length_user_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, ndr_get_array_length(ndr, &r->in.user), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_user_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.user, length_user_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user_0, 0);
+ }
+ }
+@@ -15530,6 +15976,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareAdd(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareAdd *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_parm_error;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -15548,11 +15996,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -15681,6 +16131,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareEnumAll(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareEnumAll *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_ctr_0;
+@@ -15700,11 +16152,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -15846,6 +16300,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareGetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareGetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_share_name_0 = 0;
++ uint32_t length_share_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+@@ -15862,20 +16320,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share_name));
+- if (ndr_get_array_length(ndr, &r->in.share_name) > ndr_get_array_size(ndr, &r->in.share_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share_name), ndr_get_array_length(ndr, &r->in.share_name));
++ size_share_name_0 = ndr_get_array_size(ndr, &r->in.share_name);
++ length_share_name_0 = ndr_get_array_length(ndr, &r->in.share_name);
++ if (length_share_name_0 > size_share_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_name_0, length_share_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, length_share_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+ NDR_PULL_ALLOC(ndr, r->out.info);
+ ZERO_STRUCTP(r->out.info);
+@@ -15966,6 +16428,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareSetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareSetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_share_name_0 = 0;
++ uint32_t length_share_name_0 = 0;
+ uint32_t _ptr_parm_error;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -15984,20 +16450,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share_name));
+- if (ndr_get_array_length(ndr, &r->in.share_name) > ndr_get_array_size(ndr, &r->in.share_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share_name), ndr_get_array_length(ndr, &r->in.share_name));
++ size_share_name_0 = ndr_get_array_size(ndr, &r->in.share_name);
++ length_share_name_0 = ndr_get_array_length(ndr, &r->in.share_name);
++ if (length_share_name_0 > size_share_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_name_0, length_share_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, length_share_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->in.info);
+@@ -16109,6 +16579,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareDel(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareDel *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_share_name_0 = 0;
++ uint32_t length_share_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -16122,20 +16596,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share_name));
+- if (ndr_get_array_length(ndr, &r->in.share_name) > ndr_get_array_size(ndr, &r->in.share_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share_name), ndr_get_array_length(ndr, &r->in.share_name));
++ size_share_name_0 = ndr_get_array_size(ndr, &r->in.share_name);
++ length_share_name_0 = ndr_get_array_length(ndr, &r->in.share_name);
++ if (length_share_name_0 > size_share_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_name_0, length_share_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, length_share_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.reserved));
+ }
+ if (flags & NDR_OUT) {
+@@ -16198,6 +16676,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareDelSticky(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareDelSticky *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_share_name_0 = 0;
++ uint32_t length_share_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -16211,20 +16693,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share_name));
+- if (ndr_get_array_length(ndr, &r->in.share_name) > ndr_get_array_size(ndr, &r->in.share_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share_name), ndr_get_array_length(ndr, &r->in.share_name));
++ size_share_name_0 = ndr_get_array_size(ndr, &r->in.share_name);
++ length_share_name_0 = ndr_get_array_length(ndr, &r->in.share_name);
++ if (length_share_name_0 > size_share_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_name_0, length_share_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, ndr_get_array_length(ndr, &r->in.share_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share_name, length_share_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.reserved));
+ }
+ if (flags & NDR_OUT) {
+@@ -16290,6 +16776,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareCheck(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareCheck *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_device_name_0 = 0;
++ uint32_t length_device_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_type_0;
+ if (flags & NDR_IN) {
+@@ -16306,20 +16796,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.device_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.device_name));
+- if (ndr_get_array_length(ndr, &r->in.device_name) > ndr_get_array_size(ndr, &r->in.device_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.device_name), ndr_get_array_length(ndr, &r->in.device_name));
++ size_device_name_0 = ndr_get_array_size(ndr, &r->in.device_name);
++ length_device_name_0 = ndr_get_array_length(ndr, &r->in.device_name);
++ if (length_device_name_0 > size_device_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_device_name_0, length_device_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.device_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.device_name, ndr_get_array_length(ndr, &r->in.device_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_device_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.device_name, length_device_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_ALLOC(ndr, r->out.type);
+ ZERO_STRUCTP(r->out.type);
+ }
+@@ -16394,6 +16888,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvGetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetSrvGetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+ if (flags & NDR_IN) {
+@@ -16410,11 +16906,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -16502,6 +17000,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSrvSetInfo(struct ndr_pull *ndr, int flags, struct srvsvc_NetSrvSetInfo *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_parm_error;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -16520,11 +17020,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -16654,6 +17156,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetDiskEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetDiskEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -16673,11 +17177,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -16827,7 +17333,11 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetServerStatisticsGet(struct ndr_pull *ndr, int flags, struct srvsvc_NetServerStatisticsGet *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_service;
++ uint32_t size_service_1 = 0;
++ uint32_t length_service_1 = 0;
+ uint32_t _ptr_stats;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_service_0;
+@@ -16847,11 +17357,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_service));
+@@ -16865,11 +17377,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.service, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.service));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.service));
+- if (ndr_get_array_length(ndr, &r->in.service) > ndr_get_array_size(ndr, &r->in.service)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.service), ndr_get_array_length(ndr, &r->in.service));
++ size_service_1 = ndr_get_array_size(ndr, &r->in.service);
++ length_service_1 = ndr_get_array_length(ndr, &r->in.service);
++ if (length_service_1 > size_service_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_service_1, length_service_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.service), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.service, ndr_get_array_length(ndr, &r->in.service), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_service_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.service, length_service_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_service_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -16968,6 +17482,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportAdd(struct ndr_pull *ndr, int flags, struct srvsvc_NetTransportAdd *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -16981,11 +17497,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -17069,6 +17587,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetTransportEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_transports_0;
+@@ -17088,11 +17608,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -17229,6 +17751,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetTransportDel(struct ndr_pull *ndr, int flags, struct srvsvc_NetTransportDel *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info0_0;
+ if (flags & NDR_IN) {
+@@ -17243,11 +17767,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -17324,6 +17850,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetRemoteTOD(struct ndr_pull *ndr, int flags, struct srvsvc_NetRemoteTOD *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_info;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_0;
+@@ -17342,11 +17870,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_PULL_ALLOC(ndr, r->out.info);
+@@ -17441,7 +17971,11 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSetServiceBits(struct ndr_pull *ndr, int flags, struct srvsvc_NetSetServiceBits *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_transport;
++ uint32_t size_transport_1 = 0;
++ uint32_t length_transport_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_transport_0;
+ if (flags & NDR_IN) {
+@@ -17456,11 +17990,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_transport));
+@@ -17474,11 +18010,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.transport, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.transport));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.transport));
+- if (ndr_get_array_length(ndr, &r->in.transport) > ndr_get_array_size(ndr, &r->in.transport)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.transport), ndr_get_array_length(ndr, &r->in.transport));
++ size_transport_1 = ndr_get_array_size(ndr, &r->in.transport);
++ length_transport_1 = ndr_get_array_length(ndr, &r->in.transport);
++ if (length_transport_1 > size_transport_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_transport_1, length_transport_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.transport), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.transport, ndr_get_array_length(ndr, &r->in.transport), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_transport_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.transport, length_transport_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_transport_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.servicebits));
+@@ -17554,6 +18092,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetPathType(struct ndr_pull *ndr, int flags, struct srvsvc_NetPathType *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_path_0 = 0;
++ uint32_t length_path_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_pathtype_0;
+ if (flags & NDR_IN) {
+@@ -17570,20 +18112,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.path));
+- if (ndr_get_array_length(ndr, &r->in.path) > ndr_get_array_size(ndr, &r->in.path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.path), ndr_get_array_length(ndr, &r->in.path));
++ size_path_0 = ndr_get_array_size(ndr, &r->in.path);
++ length_path_0 = ndr_get_array_length(ndr, &r->in.path);
++ if (length_path_0 > size_path_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_0, length_path_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, length_path_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.pathflags));
+ NDR_PULL_ALLOC(ndr, r->out.pathtype);
+ ZERO_STRUCTP(r->out.pathtype);
+@@ -17674,6 +18220,13 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetPathCanonicalize(struct ndr_pull *ndr, int flags, struct srvsvc_NetPathCanonicalize *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_path_0 = 0;
++ uint32_t length_path_0 = 0;
++ uint32_t size_can_path_0 = 0;
++ uint32_t size_prefix_0 = 0;
++ uint32_t length_prefix_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_pathtype_0;
+ if (flags & NDR_IN) {
+@@ -17690,28 +18243,34 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.path));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.path));
+- if (ndr_get_array_length(ndr, &r->in.path) > ndr_get_array_size(ndr, &r->in.path)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.path), ndr_get_array_length(ndr, &r->in.path));
++ size_path_0 = ndr_get_array_size(ndr, &r->in.path);
++ length_path_0 = ndr_get_array_length(ndr, &r->in.path);
++ if (length_path_0 > size_path_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path_0, length_path_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, ndr_get_array_length(ndr, &r->in.path), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path, length_path_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.maxbuf));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.prefix));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.prefix));
+- if (ndr_get_array_length(ndr, &r->in.prefix) > ndr_get_array_size(ndr, &r->in.prefix)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.prefix), ndr_get_array_length(ndr, &r->in.prefix));
++ size_prefix_0 = ndr_get_array_size(ndr, &r->in.prefix);
++ length_prefix_0 = ndr_get_array_length(ndr, &r->in.prefix);
++ if (length_prefix_0 > size_prefix_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_prefix_0, length_prefix_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.prefix), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.prefix, ndr_get_array_length(ndr, &r->in.prefix), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_prefix_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.prefix, length_prefix_0, sizeof(uint16_t), CH_UTF16));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->in.pathtype);
+ }
+@@ -17725,8 +18284,9 @@ static enum ndr_err_code ndr_pull_srvsvc
+ }
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.can_path));
+- NDR_PULL_ALLOC_N(ndr, r->out.can_path, ndr_get_array_size(ndr, &r->out.can_path));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.can_path, ndr_get_array_size(ndr, &r->out.can_path)));
++ size_can_path_0 = ndr_get_array_size(ndr, &r->out.can_path);
++ NDR_PULL_ALLOC_N(ndr, r->out.can_path, size_can_path_0);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.can_path, size_can_path_0));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->out.pathtype);
+ }
+@@ -17812,6 +18372,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetPathCompare(struct ndr_pull *ndr, int flags, struct srvsvc_NetPathCompare *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_path1_0 = 0;
++ uint32_t length_path1_0 = 0;
++ uint32_t size_path2_0 = 0;
++ uint32_t length_path2_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -17825,27 +18391,33 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.path1));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.path1));
+- if (ndr_get_array_length(ndr, &r->in.path1) > ndr_get_array_size(ndr, &r->in.path1)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.path1), ndr_get_array_length(ndr, &r->in.path1));
++ size_path1_0 = ndr_get_array_size(ndr, &r->in.path1);
++ length_path1_0 = ndr_get_array_length(ndr, &r->in.path1);
++ if (length_path1_0 > size_path1_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path1_0, length_path1_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.path1), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path1, ndr_get_array_length(ndr, &r->in.path1), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path1_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path1, length_path1_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.path2));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.path2));
+- if (ndr_get_array_length(ndr, &r->in.path2) > ndr_get_array_size(ndr, &r->in.path2)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.path2), ndr_get_array_length(ndr, &r->in.path2));
++ size_path2_0 = ndr_get_array_size(ndr, &r->in.path2);
++ length_path2_0 = ndr_get_array_length(ndr, &r->in.path2);
++ if (length_path2_0 > size_path2_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_path2_0, length_path2_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.path2), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path2, ndr_get_array_length(ndr, &r->in.path2), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_path2_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.path2, length_path2_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.pathtype));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.pathflags));
+ }
+@@ -17912,6 +18484,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetNameValidate(struct ndr_pull *ndr, int flags, struct srvsvc_NetNameValidate *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_name_0 = 0;
++ uint32_t length_name_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -17925,20 +18501,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.name));
+- if (ndr_get_array_length(ndr, &r->in.name) > ndr_get_array_size(ndr, &r->in.name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.name), ndr_get_array_length(ndr, &r->in.name));
++ size_name_0 = ndr_get_array_size(ndr, &r->in.name);
++ length_name_0 = ndr_get_array_length(ndr, &r->in.name);
++ if (length_name_0 > size_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_0, length_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name, ndr_get_array_length(ndr, &r->in.name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name, length_name_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.name_type));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ }
+@@ -18049,6 +18629,12 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetPRNameCompare(struct ndr_pull *ndr, int flags, struct srvsvc_NetPRNameCompare *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_name1_0 = 0;
++ uint32_t length_name1_0 = 0;
++ uint32_t size_name2_0 = 0;
++ uint32_t length_name2_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -18062,27 +18648,33 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.name1));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.name1));
+- if (ndr_get_array_length(ndr, &r->in.name1) > ndr_get_array_size(ndr, &r->in.name1)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.name1), ndr_get_array_length(ndr, &r->in.name1));
++ size_name1_0 = ndr_get_array_size(ndr, &r->in.name1);
++ length_name1_0 = ndr_get_array_length(ndr, &r->in.name1);
++ if (length_name1_0 > size_name1_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name1_0, length_name1_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.name1), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name1, ndr_get_array_length(ndr, &r->in.name1), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name1_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name1, length_name1_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.name2));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.name2));
+- if (ndr_get_array_length(ndr, &r->in.name2) > ndr_get_array_size(ndr, &r->in.name2)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.name2), ndr_get_array_length(ndr, &r->in.name2));
++ size_name2_0 = ndr_get_array_size(ndr, &r->in.name2);
++ length_name2_0 = ndr_get_array_length(ndr, &r->in.name2);
++ if (length_name2_0 > size_name2_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name2_0, length_name2_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.name2), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name2, ndr_get_array_length(ndr, &r->in.name2), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name2_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.name2, length_name2_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.name_type));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
+ }
+@@ -18164,6 +18756,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareEnum(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareEnum *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_resume_handle;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_info_ctr_0;
+@@ -18183,11 +18777,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -18328,6 +18924,10 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetShareDelStart(struct ndr_pull *ndr, int flags, struct srvsvc_NetShareDelStart *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
++ uint32_t size_share_0 = 0;
++ uint32_t length_share_0 = 0;
+ uint32_t _ptr_hnd;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_hnd_0;
+@@ -18345,20 +18945,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share));
+- if (ndr_get_array_length(ndr, &r->in.share) > ndr_get_array_size(ndr, &r->in.share)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share), ndr_get_array_length(ndr, &r->in.share));
++ size_share_0 = ndr_get_array_size(ndr, &r->in.share);
++ length_share_0 = ndr_get_array_length(ndr, &r->in.share);
++ if (length_share_0 > size_share_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_0, length_share_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, length_share_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.reserved));
+ }
+ if (flags & NDR_OUT) {
+@@ -18542,7 +19146,13 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetGetFileSecurity(struct ndr_pull *ndr, int flags, struct srvsvc_NetGetFileSecurity *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_share;
++ uint32_t size_share_1 = 0;
++ uint32_t length_share_1 = 0;
++ uint32_t size_file_0 = 0;
++ uint32_t length_file_0 = 0;
+ uint32_t _ptr_sd_buf;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_share_0;
+@@ -18562,11 +19172,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_share));
+@@ -18580,20 +19192,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.share, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share));
+- if (ndr_get_array_length(ndr, &r->in.share) > ndr_get_array_size(ndr, &r->in.share)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share), ndr_get_array_length(ndr, &r->in.share));
++ size_share_1 = ndr_get_array_size(ndr, &r->in.share);
++ length_share_1 = ndr_get_array_length(ndr, &r->in.share);
++ if (length_share_1 > size_share_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_1, length_share_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, length_share_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_share_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.file));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.file));
+- if (ndr_get_array_length(ndr, &r->in.file) > ndr_get_array_size(ndr, &r->in.file)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.file), ndr_get_array_length(ndr, &r->in.file));
++ size_file_0 = ndr_get_array_size(ndr, &r->in.file);
++ length_file_0 = ndr_get_array_length(ndr, &r->in.file);
++ if (length_file_0 > size_file_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_file_0, length_file_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.file), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.file, ndr_get_array_length(ndr, &r->in.file), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_file_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.file, length_file_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_security_secinfo(ndr, NDR_SCALARS, &r->in.securityinformation));
+ NDR_PULL_ALLOC(ndr, r->out.sd_buf);
+ ZERO_STRUCTP(r->out.sd_buf);
+@@ -18702,7 +19318,13 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetSetFileSecurity(struct ndr_pull *ndr, int flags, struct srvsvc_NetSetFileSecurity *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_share;
++ uint32_t size_share_1 = 0;
++ uint32_t length_share_1 = 0;
++ uint32_t size_file_0 = 0;
++ uint32_t length_file_0 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_share_0;
+ TALLOC_CTX *_mem_save_sd_buf_0;
+@@ -18718,11 +19340,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_share));
+@@ -18736,20 +19360,24 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.share, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.share));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.share));
+- if (ndr_get_array_length(ndr, &r->in.share) > ndr_get_array_size(ndr, &r->in.share)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.share), ndr_get_array_length(ndr, &r->in.share));
++ size_share_1 = ndr_get_array_size(ndr, &r->in.share);
++ length_share_1 = ndr_get_array_length(ndr, &r->in.share);
++ if (length_share_1 > size_share_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_share_1, length_share_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, ndr_get_array_length(ndr, &r->in.share), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_share_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.share, length_share_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_share_0, 0);
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.file));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.file));
+- if (ndr_get_array_length(ndr, &r->in.file) > ndr_get_array_size(ndr, &r->in.file)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.file), ndr_get_array_length(ndr, &r->in.file));
++ size_file_0 = ndr_get_array_size(ndr, &r->in.file);
++ length_file_0 = ndr_get_array_length(ndr, &r->in.file);
++ if (length_file_0 > size_file_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_file_0, length_file_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.file), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.file, ndr_get_array_length(ndr, &r->in.file), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_file_0, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.file, length_file_0, sizeof(uint16_t), CH_UTF16));
+ NDR_CHECK(ndr_pull_security_secinfo(ndr, NDR_SCALARS, &r->in.securityinformation));
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+ NDR_PULL_ALLOC(ndr, r->in.sd_buf);
+@@ -18827,6 +19455,8 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetServerTransportAddEx(struct ndr_pull *ndr, int flags, struct srvsvc_NetServerTransportAddEx *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ if (flags & NDR_IN) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_server_unc));
+@@ -18840,11 +19470,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.level));
+@@ -18924,8 +19556,14 @@ static enum ndr_err_code ndr_push_srvsvc
+ static enum ndr_err_code ndr_pull_srvsvc_NetServerSetServiceBitsEx(struct ndr_pull *ndr, int flags, struct srvsvc_NetServerSetServiceBitsEx *r)
+ {
+ uint32_t _ptr_server_unc;
++ uint32_t size_server_unc_1 = 0;
++ uint32_t length_server_unc_1 = 0;
+ uint32_t _ptr_emulated_server_unc;
++ uint32_t size_emulated_server_unc_1 = 0;
++ uint32_t length_emulated_server_unc_1 = 0;
+ uint32_t _ptr_transport;
++ uint32_t size_transport_1 = 0;
++ uint32_t length_transport_1 = 0;
+ TALLOC_CTX *_mem_save_server_unc_0;
+ TALLOC_CTX *_mem_save_emulated_server_unc_0;
+ TALLOC_CTX *_mem_save_transport_0;
+@@ -18941,11 +19579,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.server_unc));
+- if (ndr_get_array_length(ndr, &r->in.server_unc) > ndr_get_array_size(ndr, &r->in.server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.server_unc), ndr_get_array_length(ndr, &r->in.server_unc));
++ size_server_unc_1 = ndr_get_array_size(ndr, &r->in.server_unc);
++ length_server_unc_1 = ndr_get_array_length(ndr, &r->in.server_unc);
++ if (length_server_unc_1 > size_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_unc_1, length_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, ndr_get_array_length(ndr, &r->in.server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.server_unc, length_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_emulated_server_unc));
+@@ -18959,11 +19599,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.emulated_server_unc, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.emulated_server_unc));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.emulated_server_unc));
+- if (ndr_get_array_length(ndr, &r->in.emulated_server_unc) > ndr_get_array_size(ndr, &r->in.emulated_server_unc)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.emulated_server_unc), ndr_get_array_length(ndr, &r->in.emulated_server_unc));
++ size_emulated_server_unc_1 = ndr_get_array_size(ndr, &r->in.emulated_server_unc);
++ length_emulated_server_unc_1 = ndr_get_array_length(ndr, &r->in.emulated_server_unc);
++ if (length_emulated_server_unc_1 > size_emulated_server_unc_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_emulated_server_unc_1, length_emulated_server_unc_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.emulated_server_unc), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.emulated_server_unc, ndr_get_array_length(ndr, &r->in.emulated_server_unc), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_emulated_server_unc_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.emulated_server_unc, length_emulated_server_unc_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_emulated_server_unc_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_transport));
+@@ -18977,11 +19619,13 @@ static enum ndr_err_code ndr_pull_srvsvc
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.transport, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.transport));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.transport));
+- if (ndr_get_array_length(ndr, &r->in.transport) > ndr_get_array_size(ndr, &r->in.transport)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.transport), ndr_get_array_length(ndr, &r->in.transport));
++ size_transport_1 = ndr_get_array_size(ndr, &r->in.transport);
++ length_transport_1 = ndr_get_array_length(ndr, &r->in.transport);
++ if (length_transport_1 > size_transport_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_transport_1, length_transport_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.transport), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.transport, ndr_get_array_length(ndr, &r->in.transport), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_transport_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.transport, length_transport_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_transport_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.servicebitsofinterest));
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_named_pipe_auth.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_named_pipe_auth.c
+@@ -58,16 +58,25 @@ static enum ndr_err_code ndr_push_named_
+ static enum ndr_err_code ndr_pull_named_pipe_auth_req_info2(struct ndr_pull *ndr, int ndr_flags, struct named_pipe_auth_req_info2 *r)
+ {
+ uint32_t _ptr_client_name;
++ uint32_t size_client_name_1 = 0;
++ uint32_t length_client_name_1 = 0;
+ TALLOC_CTX *_mem_save_client_name_0;
+ uint32_t _ptr_client_addr;
++ uint32_t size_client_addr_1 = 0;
++ uint32_t length_client_addr_1 = 0;
+ TALLOC_CTX *_mem_save_client_addr_0;
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ uint32_t _ptr_server_addr;
++ uint32_t size_server_addr_1 = 0;
++ uint32_t length_server_addr_1 = 0;
+ TALLOC_CTX *_mem_save_server_addr_0;
+ uint32_t _ptr_sam_info3;
+ TALLOC_CTX *_mem_save_sam_info3_0;
+ uint32_t _ptr_session_key;
++ uint32_t size_session_key_1 = 0;
+ TALLOC_CTX *_mem_save_session_key_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -118,11 +127,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->client_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client_name));
+- if (ndr_get_array_length(ndr, &r->client_name) > ndr_get_array_size(ndr, &r->client_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client_name), ndr_get_array_length(ndr, &r->client_name));
++ size_client_name_1 = ndr_get_array_size(ndr, &r->client_name);
++ length_client_name_1 = ndr_get_array_length(ndr, &r->client_name);
++ if (length_client_name_1 > size_client_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_name_1, length_client_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client_name), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_name, ndr_get_array_length(ndr, &r->client_name), sizeof(uint8_t), CH_UTF8));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_name_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_name, length_client_name_1, sizeof(uint8_t), CH_UTF8));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_name_0, 0);
+ }
+ if (r->client_addr) {
+@@ -130,11 +141,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->client_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client_addr));
+- if (ndr_get_array_length(ndr, &r->client_addr) > ndr_get_array_size(ndr, &r->client_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client_addr), ndr_get_array_length(ndr, &r->client_addr));
++ size_client_addr_1 = ndr_get_array_size(ndr, &r->client_addr);
++ length_client_addr_1 = ndr_get_array_length(ndr, &r->client_addr);
++ if (length_client_addr_1 > size_client_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_addr_1, length_client_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client_addr), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_addr, ndr_get_array_length(ndr, &r->client_addr), sizeof(uint8_t), CH_DOS));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_addr_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_addr, length_client_addr_1, sizeof(uint8_t), CH_DOS));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_addr_0, 0);
+ }
+ if (r->server_name) {
+@@ -142,11 +155,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint8_t), CH_UTF8));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint8_t), CH_UTF8));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (r->server_addr) {
+@@ -154,11 +169,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_addr));
+- if (ndr_get_array_length(ndr, &r->server_addr) > ndr_get_array_size(ndr, &r->server_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_addr), ndr_get_array_length(ndr, &r->server_addr));
++ size_server_addr_1 = ndr_get_array_size(ndr, &r->server_addr);
++ length_server_addr_1 = ndr_get_array_length(ndr, &r->server_addr);
++ if (length_server_addr_1 > size_server_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_addr_1, length_server_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_addr), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_addr, ndr_get_array_length(ndr, &r->server_addr), sizeof(uint8_t), CH_DOS));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_addr_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_addr, length_server_addr_1, sizeof(uint8_t), CH_DOS));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_addr_0, 0);
+ }
+ if (r->sam_info3) {
+@@ -171,8 +188,9 @@ static enum ndr_err_code ndr_pull_named_
+ _mem_save_session_key_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->session_key, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->session_key));
+- NDR_PULL_ALLOC_N(ndr, r->session_key, ndr_get_array_size(ndr, &r->session_key));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->session_key, ndr_get_array_size(ndr, &r->session_key)));
++ size_session_key_1 = ndr_get_array_size(ndr, &r->session_key);
++ NDR_PULL_ALLOC_N(ndr, r->session_key, size_session_key_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->session_key, size_session_key_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_session_key_0, 0);
+ }
+ if (r->session_key) {
+@@ -288,18 +306,28 @@ static enum ndr_err_code ndr_push_named_
+ static enum ndr_err_code ndr_pull_named_pipe_auth_req_info3(struct ndr_pull *ndr, int ndr_flags, struct named_pipe_auth_req_info3 *r)
+ {
+ uint32_t _ptr_client_name;
++ uint32_t size_client_name_1 = 0;
++ uint32_t length_client_name_1 = 0;
+ TALLOC_CTX *_mem_save_client_name_0;
+ uint32_t _ptr_client_addr;
++ uint32_t size_client_addr_1 = 0;
++ uint32_t length_client_addr_1 = 0;
+ TALLOC_CTX *_mem_save_client_addr_0;
+ uint32_t _ptr_server_name;
++ uint32_t size_server_name_1 = 0;
++ uint32_t length_server_name_1 = 0;
+ TALLOC_CTX *_mem_save_server_name_0;
+ uint32_t _ptr_server_addr;
++ uint32_t size_server_addr_1 = 0;
++ uint32_t length_server_addr_1 = 0;
+ TALLOC_CTX *_mem_save_server_addr_0;
+ uint32_t _ptr_sam_info3;
+ TALLOC_CTX *_mem_save_sam_info3_0;
+ uint32_t _ptr_session_key;
++ uint32_t size_session_key_1 = 0;
+ TALLOC_CTX *_mem_save_session_key_0;
+ uint32_t _ptr_gssapi_delegated_creds;
++ uint32_t size_gssapi_delegated_creds_1 = 0;
+ TALLOC_CTX *_mem_save_gssapi_delegated_creds_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -357,11 +385,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->client_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client_name));
+- if (ndr_get_array_length(ndr, &r->client_name) > ndr_get_array_size(ndr, &r->client_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client_name), ndr_get_array_length(ndr, &r->client_name));
++ size_client_name_1 = ndr_get_array_size(ndr, &r->client_name);
++ length_client_name_1 = ndr_get_array_length(ndr, &r->client_name);
++ if (length_client_name_1 > size_client_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_name_1, length_client_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client_name), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_name, ndr_get_array_length(ndr, &r->client_name), sizeof(uint8_t), CH_UTF8));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_name_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_name, length_client_name_1, sizeof(uint8_t), CH_UTF8));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_name_0, 0);
+ }
+ if (r->client_addr) {
+@@ -369,11 +399,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->client_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->client_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->client_addr));
+- if (ndr_get_array_length(ndr, &r->client_addr) > ndr_get_array_size(ndr, &r->client_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->client_addr), ndr_get_array_length(ndr, &r->client_addr));
++ size_client_addr_1 = ndr_get_array_size(ndr, &r->client_addr);
++ length_client_addr_1 = ndr_get_array_length(ndr, &r->client_addr);
++ if (length_client_addr_1 > size_client_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_client_addr_1, length_client_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->client_addr), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_addr, ndr_get_array_length(ndr, &r->client_addr), sizeof(uint8_t), CH_DOS));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_client_addr_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->client_addr, length_client_addr_1, sizeof(uint8_t), CH_DOS));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_client_addr_0, 0);
+ }
+ if (r->server_name) {
+@@ -381,11 +413,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_name));
+- if (ndr_get_array_length(ndr, &r->server_name) > ndr_get_array_size(ndr, &r->server_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_name), ndr_get_array_length(ndr, &r->server_name));
++ size_server_name_1 = ndr_get_array_size(ndr, &r->server_name);
++ length_server_name_1 = ndr_get_array_length(ndr, &r->server_name);
++ if (length_server_name_1 > size_server_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_name_1, length_server_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_name), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, ndr_get_array_length(ndr, &r->server_name), sizeof(uint8_t), CH_UTF8));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_name_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_name, length_server_name_1, sizeof(uint8_t), CH_UTF8));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_name_0, 0);
+ }
+ if (r->server_addr) {
+@@ -393,11 +427,13 @@ static enum ndr_err_code ndr_pull_named_
+ NDR_PULL_SET_MEM_CTX(ndr, r->server_addr, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->server_addr));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->server_addr));
+- if (ndr_get_array_length(ndr, &r->server_addr) > ndr_get_array_size(ndr, &r->server_addr)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->server_addr), ndr_get_array_length(ndr, &r->server_addr));
++ size_server_addr_1 = ndr_get_array_size(ndr, &r->server_addr);
++ length_server_addr_1 = ndr_get_array_length(ndr, &r->server_addr);
++ if (length_server_addr_1 > size_server_addr_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_server_addr_1, length_server_addr_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->server_addr), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_addr, ndr_get_array_length(ndr, &r->server_addr), sizeof(uint8_t), CH_DOS));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_server_addr_1, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->server_addr, length_server_addr_1, sizeof(uint8_t), CH_DOS));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_server_addr_0, 0);
+ }
+ if (r->sam_info3) {
+@@ -410,16 +446,18 @@ static enum ndr_err_code ndr_pull_named_
+ _mem_save_session_key_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->session_key, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->session_key));
+- NDR_PULL_ALLOC_N(ndr, r->session_key, ndr_get_array_size(ndr, &r->session_key));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->session_key, ndr_get_array_size(ndr, &r->session_key)));
++ size_session_key_1 = ndr_get_array_size(ndr, &r->session_key);
++ NDR_PULL_ALLOC_N(ndr, r->session_key, size_session_key_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->session_key, size_session_key_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_session_key_0, 0);
+ }
+ if (r->gssapi_delegated_creds) {
+ _mem_save_gssapi_delegated_creds_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->gssapi_delegated_creds, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->gssapi_delegated_creds));
+- NDR_PULL_ALLOC_N(ndr, r->gssapi_delegated_creds, ndr_get_array_size(ndr, &r->gssapi_delegated_creds));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->gssapi_delegated_creds, ndr_get_array_size(ndr, &r->gssapi_delegated_creds)));
++ size_gssapi_delegated_creds_1 = ndr_get_array_size(ndr, &r->gssapi_delegated_creds);
++ NDR_PULL_ALLOC_N(ndr, r->gssapi_delegated_creds, size_gssapi_delegated_creds_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->gssapi_delegated_creds, size_gssapi_delegated_creds_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_gssapi_delegated_creds_0, 0);
+ }
+ if (r->session_key) {
+@@ -641,6 +679,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_name
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_named_pipe_auth_req(struct ndr_pull *ndr, int ndr_flags, struct named_pipe_auth_req *r)
+ {
++ uint32_t size_magic_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ {
+@@ -649,7 +688,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_name
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->length));
+ ndr->flags = _flags_save_uint32;
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->magic, 4, sizeof(uint8_t), CH_DOS));
++ size_magic_0 = 4;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->magic, size_magic_0, sizeof(uint8_t), CH_DOS));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->level));
+ NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->info, r->level));
+ NDR_CHECK(ndr_pull_named_pipe_auth_req_info(ndr, NDR_SCALARS, &r->info));
+@@ -902,6 +942,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_name
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_named_pipe_auth_rep(struct ndr_pull *ndr, int ndr_flags, struct named_pipe_auth_rep *r)
+ {
++ uint32_t size_magic_0 = 0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 8));
+ {
+@@ -910,7 +951,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_name
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->length));
+ ndr->flags = _flags_save_uint32;
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->magic, 4, sizeof(uint8_t), CH_DOS));
++ size_magic_0 = 4;
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->magic, size_magic_0, sizeof(uint8_t), CH_DOS));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->level));
+ NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->info, r->level));
+ NDR_CHECK(ndr_pull_named_pipe_auth_rep_info(ndr, NDR_SCALARS, &r->info));
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_samr.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_samr.c
+@@ -305,6 +305,7 @@ static enum ndr_err_code ndr_push_samr_S
+ static enum ndr_err_code ndr_pull_samr_SamArray(struct ndr_pull *ndr, int ndr_flags, struct samr_SamArray *r)
+ {
+ uint32_t _ptr_entries;
++ uint32_t size_entries_1 = 0;
+ uint32_t cntr_entries_1;
+ TALLOC_CTX *_mem_save_entries_0;
+ TALLOC_CTX *_mem_save_entries_1;
+@@ -324,13 +325,14 @@ static enum ndr_err_code ndr_pull_samr_S
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->entries));
+- NDR_PULL_ALLOC_N(ndr, r->entries, ndr_get_array_size(ndr, &r->entries));
++ size_entries_1 = ndr_get_array_size(ndr, &r->entries);
++ NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_1);
+ _mem_save_entries_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_SamEntry(ndr, NDR_SCALARS, &r->entries[cntr_entries_1]));
+ }
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_SamEntry(ndr, NDR_BUFFERS, &r->entries[cntr_entries_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_1, 0);
+@@ -1252,6 +1254,7 @@ static enum ndr_err_code ndr_push_samr_I
+ static enum ndr_err_code ndr_pull_samr_Ids(struct ndr_pull *ndr, int ndr_flags, struct samr_Ids *r)
+ {
+ uint32_t _ptr_ids;
++ uint32_t size_ids_1 = 0;
+ uint32_t cntr_ids_1;
+ TALLOC_CTX *_mem_save_ids_0;
+ TALLOC_CTX *_mem_save_ids_1;
+@@ -1274,10 +1277,11 @@ static enum ndr_err_code ndr_pull_samr_I
+ _mem_save_ids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->ids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->ids));
+- NDR_PULL_ALLOC_N(ndr, r->ids, ndr_get_array_size(ndr, &r->ids));
++ size_ids_1 = ndr_get_array_size(ndr, &r->ids);
++ NDR_PULL_ALLOC_N(ndr, r->ids, size_ids_1);
+ _mem_save_ids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->ids, 0);
+- for (cntr_ids_1 = 0; cntr_ids_1 < r->count; cntr_ids_1++) {
++ for (cntr_ids_1 = 0; cntr_ids_1 < size_ids_1; cntr_ids_1++) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->ids[cntr_ids_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ids_1, 0);
+@@ -1633,10 +1637,12 @@ static enum ndr_err_code ndr_push_samr_R
+ static enum ndr_err_code ndr_pull_samr_RidTypeArray(struct ndr_pull *ndr, int ndr_flags, struct samr_RidTypeArray *r)
+ {
+ uint32_t _ptr_rids;
++ uint32_t size_rids_1 = 0;
+ uint32_t cntr_rids_1;
+ TALLOC_CTX *_mem_save_rids_0;
+ TALLOC_CTX *_mem_save_rids_1;
+ uint32_t _ptr_types;
++ uint32_t size_types_1 = 0;
+ uint32_t cntr_types_1;
+ TALLOC_CTX *_mem_save_types_0;
+ TALLOC_CTX *_mem_save_types_1;
+@@ -1662,10 +1668,11 @@ static enum ndr_err_code ndr_pull_samr_R
+ _mem_save_rids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->rids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->rids));
+- NDR_PULL_ALLOC_N(ndr, r->rids, ndr_get_array_size(ndr, &r->rids));
++ size_rids_1 = ndr_get_array_size(ndr, &r->rids);
++ NDR_PULL_ALLOC_N(ndr, r->rids, size_rids_1);
+ _mem_save_rids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->rids, 0);
+- for (cntr_rids_1 = 0; cntr_rids_1 < r->count; cntr_rids_1++) {
++ for (cntr_rids_1 = 0; cntr_rids_1 < size_rids_1; cntr_rids_1++) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->rids[cntr_rids_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_rids_1, 0);
+@@ -1675,10 +1682,11 @@ static enum ndr_err_code ndr_pull_samr_R
+ _mem_save_types_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->types, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->types));
+- NDR_PULL_ALLOC_N(ndr, r->types, ndr_get_array_size(ndr, &r->types));
++ size_types_1 = ndr_get_array_size(ndr, &r->types);
++ NDR_PULL_ALLOC_N(ndr, r->types, size_types_1);
+ _mem_save_types_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->types, 0);
+- for (cntr_types_1 = 0; cntr_types_1 < r->count; cntr_types_1++) {
++ for (cntr_types_1 = 0; cntr_types_1 < size_types_1; cntr_types_1++) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->types[cntr_types_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_types_1, 0);
+@@ -2089,6 +2097,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_samr
+ _PUBLIC_ enum ndr_err_code ndr_pull_samr_LogonHours(struct ndr_pull *ndr, int ndr_flags, struct samr_LogonHours *r)
+ {
+ uint32_t _ptr_bits;
++ uint32_t size_bits_1 = 0;
++ uint32_t length_bits_1 = 0;
+ TALLOC_CTX *_mem_save_bits_0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+@@ -2110,11 +2120,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_samr
+ NDR_PULL_SET_MEM_CTX(ndr, r->bits, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->bits));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->bits));
+- if (ndr_get_array_length(ndr, &r->bits) > ndr_get_array_size(ndr, &r->bits)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->bits), ndr_get_array_length(ndr, &r->bits));
++ size_bits_1 = ndr_get_array_size(ndr, &r->bits);
++ length_bits_1 = ndr_get_array_length(ndr, &r->bits);
++ if (length_bits_1 > size_bits_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_bits_1, length_bits_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->bits, ndr_get_array_size(ndr, &r->bits));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->bits, ndr_get_array_length(ndr, &r->bits)));
++ NDR_PULL_ALLOC_N(ndr, r->bits, size_bits_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->bits, length_bits_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_bits_0, 0);
+ }
+ if (r->bits) {
+@@ -2779,12 +2791,14 @@ _PUBLIC_ enum ndr_err_code ndr_push_samr
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_samr_Password(struct ndr_pull *ndr, int ndr_flags, struct samr_Password *r)
+ {
++ uint32_t size_hash_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->hash, 16));
++ size_hash_0 = 16;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->hash, size_hash_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 1));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -3002,6 +3016,7 @@ static enum ndr_err_code ndr_push_samr_U
+ static enum ndr_err_code ndr_pull_samr_UserInfo21(struct ndr_pull *ndr, int ndr_flags, struct samr_UserInfo21 *r)
+ {
+ uint32_t _ptr_buffer;
++ uint32_t size_buffer_1 = 0;
+ TALLOC_CTX *_mem_save_buffer_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -3064,8 +3079,9 @@ static enum ndr_err_code ndr_pull_samr_U
+ _mem_save_buffer_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->buffer, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->buffer));
+- NDR_PULL_ALLOC_N(ndr, r->buffer, ndr_get_array_size(ndr, &r->buffer));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->buffer, ndr_get_array_size(ndr, &r->buffer)));
++ size_buffer_1 = ndr_get_array_size(ndr, &r->buffer);
++ NDR_PULL_ALLOC_N(ndr, r->buffer, size_buffer_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->buffer, size_buffer_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffer_0, 0);
+ }
+ NDR_CHECK(ndr_pull_samr_LogonHours(ndr, NDR_BUFFERS, &r->logon_hours));
+@@ -3141,12 +3157,14 @@ _PUBLIC_ enum ndr_err_code ndr_push_samr
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_samr_CryptPassword(struct ndr_pull *ndr, int ndr_flags, struct samr_CryptPassword *r)
+ {
++ uint32_t size_data_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, 516));
++ size_data_0 = 516;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 1));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -3260,12 +3278,14 @@ static enum ndr_err_code ndr_push_samr_C
+
+ static enum ndr_err_code ndr_pull_samr_CryptPasswordEx(struct ndr_pull *ndr, int ndr_flags, struct samr_CryptPasswordEx *r)
+ {
++ uint32_t size_data_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 1));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, 532));
++ size_data_0 = 532;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 1));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -3923,6 +3943,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_samr
+ _PUBLIC_ enum ndr_err_code ndr_pull_samr_RidWithAttributeArray(struct ndr_pull *ndr, int ndr_flags, struct samr_RidWithAttributeArray *r)
+ {
+ uint32_t _ptr_rids;
++ uint32_t size_rids_1 = 0;
+ uint32_t cntr_rids_1;
+ TALLOC_CTX *_mem_save_rids_0;
+ TALLOC_CTX *_mem_save_rids_1;
+@@ -3942,10 +3963,11 @@ _PUBLIC_ enum ndr_err_code ndr_pull_samr
+ _mem_save_rids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->rids, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->rids));
+- NDR_PULL_ALLOC_N(ndr, r->rids, ndr_get_array_size(ndr, &r->rids));
++ size_rids_1 = ndr_get_array_size(ndr, &r->rids);
++ NDR_PULL_ALLOC_N(ndr, r->rids, size_rids_1);
+ _mem_save_rids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->rids, 0);
+- for (cntr_rids_1 = 0; cntr_rids_1 < r->count; cntr_rids_1++) {
++ for (cntr_rids_1 = 0; cntr_rids_1 < size_rids_1; cntr_rids_1++) {
+ NDR_CHECK(ndr_pull_samr_RidWithAttribute(ndr, NDR_SCALARS, &r->rids[cntr_rids_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_rids_1, 0);
+@@ -4061,6 +4083,7 @@ static enum ndr_err_code ndr_push_samr_D
+ static enum ndr_err_code ndr_pull_samr_DispInfoGeneral(struct ndr_pull *ndr, int ndr_flags, struct samr_DispInfoGeneral *r)
+ {
+ uint32_t _ptr_entries;
++ uint32_t size_entries_1 = 0;
+ uint32_t cntr_entries_1;
+ TALLOC_CTX *_mem_save_entries_0;
+ TALLOC_CTX *_mem_save_entries_1;
+@@ -4080,13 +4103,14 @@ static enum ndr_err_code ndr_pull_samr_D
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->entries));
+- NDR_PULL_ALLOC_N(ndr, r->entries, ndr_get_array_size(ndr, &r->entries));
++ size_entries_1 = ndr_get_array_size(ndr, &r->entries);
++ NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_1);
+ _mem_save_entries_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryGeneral(ndr, NDR_SCALARS, &r->entries[cntr_entries_1]));
+ }
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryGeneral(ndr, NDR_BUFFERS, &r->entries[cntr_entries_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_1, 0);
+@@ -4197,6 +4221,7 @@ static enum ndr_err_code ndr_push_samr_D
+ static enum ndr_err_code ndr_pull_samr_DispInfoFull(struct ndr_pull *ndr, int ndr_flags, struct samr_DispInfoFull *r)
+ {
+ uint32_t _ptr_entries;
++ uint32_t size_entries_1 = 0;
+ uint32_t cntr_entries_1;
+ TALLOC_CTX *_mem_save_entries_0;
+ TALLOC_CTX *_mem_save_entries_1;
+@@ -4216,13 +4241,14 @@ static enum ndr_err_code ndr_pull_samr_D
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->entries));
+- NDR_PULL_ALLOC_N(ndr, r->entries, ndr_get_array_size(ndr, &r->entries));
++ size_entries_1 = ndr_get_array_size(ndr, &r->entries);
++ NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_1);
+ _mem_save_entries_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryFull(ndr, NDR_SCALARS, &r->entries[cntr_entries_1]));
+ }
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryFull(ndr, NDR_BUFFERS, &r->entries[cntr_entries_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_1, 0);
+@@ -4333,6 +4359,7 @@ static enum ndr_err_code ndr_push_samr_D
+ static enum ndr_err_code ndr_pull_samr_DispInfoFullGroups(struct ndr_pull *ndr, int ndr_flags, struct samr_DispInfoFullGroups *r)
+ {
+ uint32_t _ptr_entries;
++ uint32_t size_entries_1 = 0;
+ uint32_t cntr_entries_1;
+ TALLOC_CTX *_mem_save_entries_0;
+ TALLOC_CTX *_mem_save_entries_1;
+@@ -4352,13 +4379,14 @@ static enum ndr_err_code ndr_pull_samr_D
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->entries));
+- NDR_PULL_ALLOC_N(ndr, r->entries, ndr_get_array_size(ndr, &r->entries));
++ size_entries_1 = ndr_get_array_size(ndr, &r->entries);
++ NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_1);
+ _mem_save_entries_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryFullGroup(ndr, NDR_SCALARS, &r->entries[cntr_entries_1]));
+ }
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryFullGroup(ndr, NDR_BUFFERS, &r->entries[cntr_entries_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_1, 0);
+@@ -4458,6 +4486,7 @@ static enum ndr_err_code ndr_push_samr_D
+ static enum ndr_err_code ndr_pull_samr_DispInfoAscii(struct ndr_pull *ndr, int ndr_flags, struct samr_DispInfoAscii *r)
+ {
+ uint32_t _ptr_entries;
++ uint32_t size_entries_1 = 0;
+ uint32_t cntr_entries_1;
+ TALLOC_CTX *_mem_save_entries_0;
+ TALLOC_CTX *_mem_save_entries_1;
+@@ -4477,13 +4506,14 @@ static enum ndr_err_code ndr_pull_samr_D
+ _mem_save_entries_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->entries));
+- NDR_PULL_ALLOC_N(ndr, r->entries, ndr_get_array_size(ndr, &r->entries));
++ size_entries_1 = ndr_get_array_size(ndr, &r->entries);
++ NDR_PULL_ALLOC_N(ndr, r->entries, size_entries_1);
+ _mem_save_entries_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->entries, 0);
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryAscii(ndr, NDR_SCALARS, &r->entries[cntr_entries_1]));
+ }
+- for (cntr_entries_1 = 0; cntr_entries_1 < r->count; cntr_entries_1++) {
++ for (cntr_entries_1 = 0; cntr_entries_1 < size_entries_1; cntr_entries_1++) {
+ NDR_CHECK(ndr_pull_samr_DispEntryAscii(ndr, NDR_BUFFERS, &r->entries[cntr_entries_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_entries_1, 0);
+@@ -4993,6 +5023,7 @@ static enum ndr_err_code ndr_push_samr_V
+ static enum ndr_err_code ndr_pull_samr_ValidationBlob(struct ndr_pull *ndr, int ndr_flags, struct samr_ValidationBlob *r)
+ {
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
+ TALLOC_CTX *_mem_save_data_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -5010,8 +5041,9 @@ static enum ndr_err_code ndr_pull_samr_V
+ _mem_save_data_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
+- NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_size(ndr, &r->data)));
++ size_data_1 = ndr_get_array_size(ndr, &r->data);
++ NDR_PULL_ALLOC_N(ndr, r->data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, size_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ if (r->data) {
+@@ -5066,6 +5098,7 @@ static enum ndr_err_code ndr_push_samr_V
+ static enum ndr_err_code ndr_pull_samr_ValidatePasswordInfo(struct ndr_pull *ndr, int ndr_flags, struct samr_ValidatePasswordInfo *r)
+ {
+ uint32_t _ptr_pwd_history;
++ uint32_t size_pwd_history_1 = 0;
+ uint32_t cntr_pwd_history_1;
+ TALLOC_CTX *_mem_save_pwd_history_0;
+ TALLOC_CTX *_mem_save_pwd_history_1;
+@@ -5090,13 +5123,14 @@ static enum ndr_err_code ndr_pull_samr_V
+ _mem_save_pwd_history_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->pwd_history, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->pwd_history));
+- NDR_PULL_ALLOC_N(ndr, r->pwd_history, ndr_get_array_size(ndr, &r->pwd_history));
++ size_pwd_history_1 = ndr_get_array_size(ndr, &r->pwd_history);
++ NDR_PULL_ALLOC_N(ndr, r->pwd_history, size_pwd_history_1);
+ _mem_save_pwd_history_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->pwd_history, 0);
+- for (cntr_pwd_history_1 = 0; cntr_pwd_history_1 < r->pwd_history_len; cntr_pwd_history_1++) {
++ for (cntr_pwd_history_1 = 0; cntr_pwd_history_1 < size_pwd_history_1; cntr_pwd_history_1++) {
+ NDR_CHECK(ndr_pull_samr_ValidationBlob(ndr, NDR_SCALARS, &r->pwd_history[cntr_pwd_history_1]));
+ }
+- for (cntr_pwd_history_1 = 0; cntr_pwd_history_1 < r->pwd_history_len; cntr_pwd_history_1++) {
++ for (cntr_pwd_history_1 = 0; cntr_pwd_history_1 < size_pwd_history_1; cntr_pwd_history_1++) {
+ NDR_CHECK(ndr_pull_samr_ValidationBlob(ndr, NDR_BUFFERS, &r->pwd_history[cntr_pwd_history_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_pwd_history_1, 0);
+@@ -7425,6 +7459,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_samr
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_samr_LookupNames(struct ndr_pull *ndr, int flags, struct samr_LookupNames *r)
+ {
++ uint32_t size_names_0 = 0;
++ uint32_t length_names_0 = 0;
+ uint32_t cntr_names_0;
+ TALLOC_CTX *_mem_save_domain_handle_0;
+ TALLOC_CTX *_mem_save_names_0;
+@@ -7446,16 +7482,18 @@ _PUBLIC_ enum ndr_err_code ndr_pull_samr
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.names));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.names));
+- if (ndr_get_array_length(ndr, &r->in.names) > ndr_get_array_size(ndr, &r->in.names)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.names), ndr_get_array_length(ndr, &r->in.names));
++ size_names_0 = ndr_get_array_size(ndr, &r->in.names);
++ length_names_0 = ndr_get_array_length(ndr, &r->in.names);
++ if (length_names_0 > size_names_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_names_0, length_names_0);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->in.names, ndr_get_array_size(ndr, &r->in.names));
++ NDR_PULL_ALLOC_N(ndr, r->in.names, size_names_0);
+ _mem_save_names_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.names, 0);
+- for (cntr_names_0 = 0; cntr_names_0 < ndr_get_array_length(ndr, &r->in.names); cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < length_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS, &r->in.names[cntr_names_0]));
+ }
+- for (cntr_names_0 = 0; cntr_names_0 < ndr_get_array_length(ndr, &r->in.names); cntr_names_0++) {
++ for (cntr_names_0 = 0; cntr_names_0 < length_names_0; cntr_names_0++) {
+ NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_BUFFERS, &r->in.names[cntr_names_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_names_0, 0);
+@@ -7567,6 +7605,8 @@ static enum ndr_err_code ndr_push_samr_L
+
+ static enum ndr_err_code ndr_pull_samr_LookupRids(struct ndr_pull *ndr, int flags, struct samr_LookupRids *r)
+ {
++ uint32_t size_rids_0 = 0;
++ uint32_t length_rids_0 = 0;
+ uint32_t cntr_rids_0;
+ TALLOC_CTX *_mem_save_domain_handle_0;
+ TALLOC_CTX *_mem_save_rids_0;
+@@ -7588,13 +7628,15 @@ static enum ndr_err_code ndr_pull_samr_L
+ }
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.rids));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.rids));
+- if (ndr_get_array_length(ndr, &r->in.rids) > ndr_get_array_size(ndr, &r->in.rids)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.rids), ndr_get_array_length(ndr, &r->in.rids));
++ size_rids_0 = ndr_get_array_size(ndr, &r->in.rids);
++ length_rids_0 = ndr_get_array_length(ndr, &r->in.rids);
++ if (length_rids_0 > size_rids_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_rids_0, length_rids_0);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->in.rids, ndr_get_array_size(ndr, &r->in.rids));
++ NDR_PULL_ALLOC_N(ndr, r->in.rids, size_rids_0);
+ _mem_save_rids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.rids, 0);
+- for (cntr_rids_0 = 0; cntr_rids_0 < ndr_get_array_length(ndr, &r->in.rids); cntr_rids_0++) {
++ for (cntr_rids_0 = 0; cntr_rids_0 < length_rids_0; cntr_rids_0++) {
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.rids[cntr_rids_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_rids_0, 0);
+@@ -11266,6 +11308,8 @@ static enum ndr_err_code ndr_push_samr_C
+ static enum ndr_err_code ndr_pull_samr_Connect2(struct ndr_pull *ndr, int flags, struct samr_Connect2 *r)
+ {
+ uint32_t _ptr_system_name;
++ uint32_t size_system_name_1 = 0;
++ uint32_t length_system_name_1 = 0;
+ TALLOC_CTX *_mem_save_system_name_0;
+ TALLOC_CTX *_mem_save_connect_handle_0;
+ if (flags & NDR_IN) {
+@@ -11282,11 +11326,13 @@ static enum ndr_err_code ndr_pull_samr_C
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.system_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.system_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.system_name));
+- if (ndr_get_array_length(ndr, &r->in.system_name) > ndr_get_array_size(ndr, &r->in.system_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.system_name), ndr_get_array_length(ndr, &r->in.system_name));
++ size_system_name_1 = ndr_get_array_size(ndr, &r->in.system_name);
++ length_system_name_1 = ndr_get_array_length(ndr, &r->in.system_name);
++ if (length_system_name_1 > size_system_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_system_name_1, length_system_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_system_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, length_system_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_system_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_samr_ConnectAccessMask(ndr, NDR_SCALARS, &r->in.access_mask));
+@@ -11586,6 +11632,8 @@ static enum ndr_err_code ndr_push_samr_C
+ static enum ndr_err_code ndr_pull_samr_Connect3(struct ndr_pull *ndr, int flags, struct samr_Connect3 *r)
+ {
+ uint32_t _ptr_system_name;
++ uint32_t size_system_name_1 = 0;
++ uint32_t length_system_name_1 = 0;
+ TALLOC_CTX *_mem_save_system_name_0;
+ TALLOC_CTX *_mem_save_connect_handle_0;
+ if (flags & NDR_IN) {
+@@ -11602,11 +11650,13 @@ static enum ndr_err_code ndr_pull_samr_C
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.system_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.system_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.system_name));
+- if (ndr_get_array_length(ndr, &r->in.system_name) > ndr_get_array_size(ndr, &r->in.system_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.system_name), ndr_get_array_length(ndr, &r->in.system_name));
++ size_system_name_1 = ndr_get_array_size(ndr, &r->in.system_name);
++ length_system_name_1 = ndr_get_array_length(ndr, &r->in.system_name);
++ if (length_system_name_1 > size_system_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_system_name_1, length_system_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_system_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, length_system_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_system_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.unknown));
+@@ -11686,6 +11736,8 @@ static enum ndr_err_code ndr_push_samr_C
+ static enum ndr_err_code ndr_pull_samr_Connect4(struct ndr_pull *ndr, int flags, struct samr_Connect4 *r)
+ {
+ uint32_t _ptr_system_name;
++ uint32_t size_system_name_1 = 0;
++ uint32_t length_system_name_1 = 0;
+ TALLOC_CTX *_mem_save_system_name_0;
+ TALLOC_CTX *_mem_save_connect_handle_0;
+ if (flags & NDR_IN) {
+@@ -11702,11 +11754,13 @@ static enum ndr_err_code ndr_pull_samr_C
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.system_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.system_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.system_name));
+- if (ndr_get_array_length(ndr, &r->in.system_name) > ndr_get_array_size(ndr, &r->in.system_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.system_name), ndr_get_array_length(ndr, &r->in.system_name));
++ size_system_name_1 = ndr_get_array_size(ndr, &r->in.system_name);
++ length_system_name_1 = ndr_get_array_length(ndr, &r->in.system_name);
++ if (length_system_name_1 > size_system_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_system_name_1, length_system_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_system_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, length_system_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_system_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_samr_ConnectVersion(ndr, NDR_SCALARS, &r->in.client_version));
+@@ -12084,6 +12138,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_samr
+ _PUBLIC_ enum ndr_err_code ndr_pull_samr_Connect5(struct ndr_pull *ndr, int flags, struct samr_Connect5 *r)
+ {
+ uint32_t _ptr_system_name;
++ uint32_t size_system_name_1 = 0;
++ uint32_t length_system_name_1 = 0;
+ TALLOC_CTX *_mem_save_system_name_0;
+ TALLOC_CTX *_mem_save_info_in_0;
+ TALLOC_CTX *_mem_save_level_out_0;
+@@ -12103,11 +12159,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_samr
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.system_name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.system_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.system_name));
+- if (ndr_get_array_length(ndr, &r->in.system_name) > ndr_get_array_size(ndr, &r->in.system_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.system_name), ndr_get_array_length(ndr, &r->in.system_name));
++ size_system_name_1 = ndr_get_array_size(ndr, &r->in.system_name);
++ length_system_name_1 = ndr_get_array_length(ndr, &r->in.system_name);
++ if (length_system_name_1 > size_system_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_system_name_1, length_system_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_system_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, length_system_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_system_name_0, 0);
+ }
+ NDR_CHECK(ndr_pull_samr_ConnectAccessMask(ndr, NDR_SCALARS, &r->in.access_mask));
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_security.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_security.c
+@@ -501,6 +501,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_secu
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_security_acl(struct ndr_pull *ndr, int ndr_flags, struct security_acl *r)
+ {
++ uint32_t size_aces_0 = 0;
+ uint32_t cntr_aces_0;
+ TALLOC_CTX *_mem_save_aces_0;
+ if (ndr_flags & NDR_SCALARS) {
+@@ -511,19 +512,21 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ if (r->num_aces > 1000) {
+ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+- NDR_PULL_ALLOC_N(ndr, r->aces, r->num_aces);
++ size_aces_0 = r->num_aces;
++ NDR_PULL_ALLOC_N(ndr, r->aces, size_aces_0);
+ _mem_save_aces_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->aces, 0);
+- for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) {
++ for (cntr_aces_0 = 0; cntr_aces_0 < size_aces_0; cntr_aces_0++) {
+ NDR_CHECK(ndr_pull_security_ace(ndr, NDR_SCALARS, &r->aces[cntr_aces_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_aces_0, 0);
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
++ size_aces_0 = r->num_aces;
+ _mem_save_aces_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->aces, 0);
+- for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) {
++ for (cntr_aces_0 = 0; cntr_aces_0 < size_aces_0; cntr_aces_0++) {
+ NDR_CHECK(ndr_pull_security_ace(ndr, NDR_BUFFERS, &r->aces[cntr_aces_0]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_aces_0, 0);
+@@ -898,6 +901,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ uint32_t _ptr_group_sid;
+ TALLOC_CTX *_mem_save_group_sid_0;
+ uint32_t _ptr_sids;
++ uint32_t size_sids_0 = 0;
+ uint32_t cntr_sids_0;
+ TALLOC_CTX *_mem_save_sids_0;
+ TALLOC_CTX *_mem_save_sids_1;
+@@ -919,10 +923,11 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_sids));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->sids));
+- NDR_PULL_ALLOC_N(ndr, r->sids, ndr_get_array_size(ndr, &r->sids));
++ size_sids_0 = ndr_get_array_size(ndr, &r->sids);
++ NDR_PULL_ALLOC_N(ndr, r->sids, size_sids_0);
+ _mem_save_sids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+- for (cntr_sids_0 = 0; cntr_sids_0 < r->num_sids; cntr_sids_0++) {
++ for (cntr_sids_0 = 0; cntr_sids_0 < size_sids_0; cntr_sids_0++) {
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sids));
+ if (_ptr_sids) {
+ NDR_PULL_ALLOC(ndr, r->sids[cntr_sids_0]);
+@@ -956,9 +961,10 @@ _PUBLIC_ enum ndr_err_code ndr_pull_secu
+ NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, r->group_sid));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_group_sid_0, 0);
+ }
++ size_sids_0 = ndr_get_array_size(ndr, &r->sids);
+ _mem_save_sids_0 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids, 0);
+- for (cntr_sids_0 = 0; cntr_sids_0 < r->num_sids; cntr_sids_0++) {
++ for (cntr_sids_0 = 0; cntr_sids_0 < size_sids_0; cntr_sids_0++) {
+ if (r->sids[cntr_sids_0]) {
+ _mem_save_sids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->sids[cntr_sids_0], 0);
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_winreg.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_winreg.c
+@@ -58,6 +58,8 @@ _PUBLIC_ enum ndr_err_code ndr_push_winr
+ _PUBLIC_ enum ndr_err_code ndr_pull_winreg_String(struct ndr_pull *ndr, int ndr_flags, struct winreg_String *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -77,11 +79,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_name_1, sizeof(uint16_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ }
+@@ -126,6 +130,8 @@ static enum ndr_err_code ndr_push_KeySec
+ static enum ndr_err_code ndr_pull_KeySecurityData(struct ndr_pull *ndr, int ndr_flags, struct KeySecurityData *r)
+ {
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
++ uint32_t length_data_1 = 0;
+ TALLOC_CTX *_mem_save_data_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -145,11 +151,13 @@ static enum ndr_err_code ndr_pull_KeySec
+ NDR_PULL_SET_MEM_CTX(ndr, r->data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->data));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->data));
+- if (ndr_get_array_length(ndr, &r->data) > ndr_get_array_size(ndr, &r->data)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->data), ndr_get_array_length(ndr, &r->data));
++ size_data_1 = ndr_get_array_size(ndr, &r->data);
++ length_data_1 = ndr_get_array_length(ndr, &r->data);
++ if (length_data_1 > size_data_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_data_1, length_data_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->data, ndr_get_array_size(ndr, &r->data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, ndr_get_array_length(ndr, &r->data)));
++ NDR_PULL_ALLOC_N(ndr, r->data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->data, length_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ if (r->data) {
+@@ -266,6 +274,8 @@ static enum ndr_err_code ndr_push_winreg
+ static enum ndr_err_code ndr_pull_winreg_StringBuf(struct ndr_pull *ndr, int ndr_flags, struct winreg_StringBuf *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -285,10 +295,12 @@ static enum ndr_err_code ndr_pull_winreg
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->name) {
+@@ -339,6 +351,8 @@ static enum ndr_err_code ndr_push_winreg
+ static enum ndr_err_code ndr_pull_winreg_ValNameBuf(struct ndr_pull *ndr, int ndr_flags, struct winreg_ValNameBuf *r)
+ {
+ uint32_t _ptr_name;
++ uint32_t size_name_1 = 0;
++ uint32_t length_name_1 = 0;
+ TALLOC_CTX *_mem_save_name_0;
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+@@ -358,10 +372,12 @@ static enum ndr_err_code ndr_pull_winreg
+ NDR_PULL_SET_MEM_CTX(ndr, r->name, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->name));
+- if (ndr_get_array_length(ndr, &r->name) > ndr_get_array_size(ndr, &r->name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->name), ndr_get_array_length(ndr, &r->name));
++ size_name_1 = ndr_get_array_size(ndr, &r->name);
++ length_name_1 = ndr_get_array_length(ndr, &r->name);
++ if (length_name_1 > size_name_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_name_1, length_name_1);
+ }
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, ndr_get_array_length(ndr, &r->name), sizeof(uint16_t), CH_UTF16));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->name, length_name_1, sizeof(uint16_t), CH_UTF16));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_name_0, 0);
+ }
+ if (r->name) {
+@@ -1563,6 +1579,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ {
+ uint32_t _ptr_type;
+ uint32_t _ptr_value;
++ uint32_t size_value_1 = 0;
++ uint32_t length_value_1 = 0;
+ uint32_t _ptr_size;
+ uint32_t _ptr_length;
+ TALLOC_CTX *_mem_save_handle_0;
+@@ -1612,11 +1630,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.value, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.value));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.value));
+- if (ndr_get_array_length(ndr, &r->in.value) > ndr_get_array_size(ndr, &r->in.value)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.value), ndr_get_array_length(ndr, &r->in.value));
++ size_value_1 = ndr_get_array_size(ndr, &r->in.value);
++ length_value_1 = ndr_get_array_length(ndr, &r->in.value);
++ if (length_value_1 > size_value_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_value_1, length_value_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->in.value, ndr_get_array_size(ndr, &r->in.value));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.value, ndr_get_array_length(ndr, &r->in.value)));
++ NDR_PULL_ALLOC_N(ndr, r->in.value, size_value_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.value, length_value_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_value_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_size));
+@@ -1685,11 +1705,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, r->out.value, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.value));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.value));
+- if (ndr_get_array_length(ndr, &r->out.value) > ndr_get_array_size(ndr, &r->out.value)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.value), ndr_get_array_length(ndr, &r->out.value));
++ size_value_1 = ndr_get_array_size(ndr, &r->out.value);
++ length_value_1 = ndr_get_array_length(ndr, &r->out.value);
++ if (length_value_1 > size_value_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_value_1, length_value_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->out.value, ndr_get_array_size(ndr, &r->out.value));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.value, ndr_get_array_length(ndr, &r->out.value)));
++ NDR_PULL_ALLOC_N(ndr, r->out.value, size_value_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.value, length_value_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_value_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_size));
+@@ -2527,6 +2549,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ {
+ uint32_t _ptr_type;
+ uint32_t _ptr_data;
++ uint32_t size_data_1 = 0;
++ uint32_t length_data_1 = 0;
+ uint32_t _ptr_data_size;
+ uint32_t _ptr_data_length;
+ TALLOC_CTX *_mem_save_handle_0;
+@@ -2575,11 +2599,19 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.data));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.data));
+- if (ndr_get_array_length(ndr, &r->in.data) > ndr_get_array_size(ndr, &r->in.data)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.data), ndr_get_array_length(ndr, &r->in.data));
++ size_data_1 = ndr_get_array_size(ndr, &r->in.data);
++ if (size_data_1 > 0x4000000) {
++ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+ }
+- NDR_PULL_ALLOC_N(ndr, r->in.data, ndr_get_array_size(ndr, &r->in.data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.data, ndr_get_array_length(ndr, &r->in.data)));
++ length_data_1 = ndr_get_array_length(ndr, &r->in.data);
++ if (length_data_1 > 0x4000000) {
++ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
++ }
++ if (length_data_1 > size_data_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_data_1, length_data_1);
++ }
++ NDR_PULL_ALLOC_N(ndr, r->in.data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.data, length_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_data_size));
+@@ -2639,11 +2671,19 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, r->out.data, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.data));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.data));
+- if (ndr_get_array_length(ndr, &r->out.data) > ndr_get_array_size(ndr, &r->out.data)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.data), ndr_get_array_length(ndr, &r->out.data));
++ size_data_1 = ndr_get_array_size(ndr, &r->out.data);
++ if (size_data_1 > 0x4000000) {
++ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
++ }
++ length_data_1 = ndr_get_array_length(ndr, &r->out.data);
++ if (length_data_1 > 0x4000000) {
++ return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
++ }
++ if (length_data_1 > size_data_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_data_1, length_data_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->out.data, ndr_get_array_size(ndr, &r->out.data));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.data, ndr_get_array_length(ndr, &r->out.data)));
++ NDR_PULL_ALLOC_N(ndr, r->out.data, size_data_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.data, length_data_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_data_0, 0);
+ }
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_data_size));
+@@ -3076,6 +3116,7 @@ static enum ndr_err_code ndr_push_winreg
+
+ static enum ndr_err_code ndr_pull_winreg_SetValue(struct ndr_pull *ndr, int flags, struct winreg_SetValue *r)
+ {
++ uint32_t size_data_1 = 0;
+ TALLOC_CTX *_mem_save_handle_0;
+ if (flags & NDR_IN) {
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -3088,10 +3129,11 @@ static enum ndr_err_code ndr_pull_winreg
+ NDR_CHECK(ndr_pull_winreg_String(ndr, NDR_SCALARS|NDR_BUFFERS, &r->in.name));
+ NDR_CHECK(ndr_pull_winreg_Type(ndr, NDR_SCALARS, &r->in.type));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.data));
++ size_data_1 = ndr_get_array_size(ndr, &r->in.data);
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+- NDR_PULL_ALLOC_N(ndr, r->in.data, ndr_get_array_size(ndr, &r->in.data));
++ NDR_PULL_ALLOC_N(ndr, r->in.data, size_data_1);
+ }
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.data, ndr_get_array_size(ndr, &r->in.data)));
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.data, size_data_1));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.size));
+ if (r->in.data) {
+ NDR_CHECK(ndr_check_array_size(ndr, (void*)&r->in.data, r->in.size));
+@@ -3656,8 +3698,12 @@ _PUBLIC_ enum ndr_err_code ndr_push_winr
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_winreg_QueryMultipleValues(struct ndr_pull *ndr, int flags, struct winreg_QueryMultipleValues *r)
+ {
++ uint32_t size_values_1 = 0;
++ uint32_t length_values_1 = 0;
+ uint32_t cntr_values_1;
+ uint32_t _ptr_buffer;
++ uint32_t size_buffer_1 = 0;
++ uint32_t length_buffer_1 = 0;
+ TALLOC_CTX *_mem_save_key_handle_0;
+ TALLOC_CTX *_mem_save_values_1;
+ TALLOC_CTX *_mem_save_buffer_0;
+@@ -3674,19 +3720,21 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_key_handle_0, LIBNDR_FLAG_REF_ALLOC);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.values));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.values));
+- if (ndr_get_array_length(ndr, &r->in.values) > ndr_get_array_size(ndr, &r->in.values)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.values), ndr_get_array_length(ndr, &r->in.values));
++ size_values_1 = ndr_get_array_size(ndr, &r->in.values);
++ length_values_1 = ndr_get_array_length(ndr, &r->in.values);
++ if (length_values_1 > size_values_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_values_1, length_values_1);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+- NDR_PULL_ALLOC_N(ndr, r->in.values, ndr_get_array_size(ndr, &r->in.values));
++ NDR_PULL_ALLOC_N(ndr, r->in.values, size_values_1);
+ }
+- memcpy(r->out.values, r->in.values, (ndr_get_array_size(ndr, &r->in.values)) * sizeof(*r->in.values));
++ memcpy(r->out.values, r->in.values, (size_values_1) * sizeof(*r->in.values));
+ _mem_save_values_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.values, 0);
+- for (cntr_values_1 = 0; cntr_values_1 < ndr_get_array_length(ndr, &r->in.values); cntr_values_1++) {
++ for (cntr_values_1 = 0; cntr_values_1 < length_values_1; cntr_values_1++) {
+ NDR_CHECK(ndr_pull_QueryMultipleValue(ndr, NDR_SCALARS, &r->in.values[cntr_values_1]));
+ }
+- for (cntr_values_1 = 0; cntr_values_1 < ndr_get_array_length(ndr, &r->in.values); cntr_values_1++) {
++ for (cntr_values_1 = 0; cntr_values_1 < length_values_1; cntr_values_1++) {
+ NDR_CHECK(ndr_pull_QueryMultipleValue(ndr, NDR_BUFFERS, &r->in.values[cntr_values_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_values_1, 0);
+@@ -3702,11 +3750,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, r->in.buffer, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->in.buffer));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->in.buffer));
+- if (ndr_get_array_length(ndr, &r->in.buffer) > ndr_get_array_size(ndr, &r->in.buffer)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->in.buffer), ndr_get_array_length(ndr, &r->in.buffer));
++ size_buffer_1 = ndr_get_array_size(ndr, &r->in.buffer);
++ length_buffer_1 = ndr_get_array_length(ndr, &r->in.buffer);
++ if (length_buffer_1 > size_buffer_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_buffer_1, length_buffer_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->in.buffer, ndr_get_array_size(ndr, &r->in.buffer));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.buffer, ndr_get_array_length(ndr, &r->in.buffer)));
++ NDR_PULL_ALLOC_N(ndr, r->in.buffer, size_buffer_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->in.buffer, length_buffer_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffer_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+@@ -3736,19 +3786,21 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ if (flags & NDR_OUT) {
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.values));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.values));
+- if (ndr_get_array_length(ndr, &r->out.values) > ndr_get_array_size(ndr, &r->out.values)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.values), ndr_get_array_length(ndr, &r->out.values));
++ size_values_1 = ndr_get_array_size(ndr, &r->out.values);
++ length_values_1 = ndr_get_array_length(ndr, &r->out.values);
++ if (length_values_1 > size_values_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_values_1, length_values_1);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+- NDR_PULL_ALLOC_N(ndr, r->out.values, ndr_get_array_size(ndr, &r->out.values));
++ NDR_PULL_ALLOC_N(ndr, r->out.values, size_values_1);
+ }
+- memcpy(r->out.values, r->in.values, (ndr_get_array_size(ndr, &r->out.values)) * sizeof(*r->in.values));
++ memcpy(r->out.values, r->in.values, (size_values_1) * sizeof(*r->in.values));
+ _mem_save_values_1 = NDR_PULL_GET_MEM_CTX(ndr);
+ NDR_PULL_SET_MEM_CTX(ndr, r->out.values, 0);
+- for (cntr_values_1 = 0; cntr_values_1 < ndr_get_array_length(ndr, &r->out.values); cntr_values_1++) {
++ for (cntr_values_1 = 0; cntr_values_1 < length_values_1; cntr_values_1++) {
+ NDR_CHECK(ndr_pull_QueryMultipleValue(ndr, NDR_SCALARS, &r->out.values[cntr_values_1]));
+ }
+- for (cntr_values_1 = 0; cntr_values_1 < ndr_get_array_length(ndr, &r->out.values); cntr_values_1++) {
++ for (cntr_values_1 = 0; cntr_values_1 < length_values_1; cntr_values_1++) {
+ NDR_CHECK(ndr_pull_QueryMultipleValue(ndr, NDR_BUFFERS, &r->out.values[cntr_values_1]));
+ }
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_values_1, 0);
+@@ -3763,11 +3815,13 @@ _PUBLIC_ enum ndr_err_code ndr_pull_winr
+ NDR_PULL_SET_MEM_CTX(ndr, r->out.buffer, 0);
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->out.buffer));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->out.buffer));
+- if (ndr_get_array_length(ndr, &r->out.buffer) > ndr_get_array_size(ndr, &r->out.buffer)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->out.buffer), ndr_get_array_length(ndr, &r->out.buffer));
++ size_buffer_1 = ndr_get_array_size(ndr, &r->out.buffer);
++ length_buffer_1 = ndr_get_array_length(ndr, &r->out.buffer);
++ if (length_buffer_1 > size_buffer_1) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_buffer_1, length_buffer_1);
+ }
+- NDR_PULL_ALLOC_N(ndr, r->out.buffer, ndr_get_array_size(ndr, &r->out.buffer));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.buffer, ndr_get_array_length(ndr, &r->out.buffer)));
++ NDR_PULL_ALLOC_N(ndr, r->out.buffer, size_buffer_1);
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.buffer, length_buffer_1));
+ NDR_PULL_SET_MEM_CTX(ndr, _mem_save_buffer_0, 0);
+ }
+ if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+--- samba-3.5.6~dfsg.orig/librpc/gen_ndr/ndr_schannel.c
++++ samba-3.5.6~dfsg/librpc/gen_ndr/ndr_schannel.c
+@@ -42,6 +42,11 @@ _PUBLIC_ enum ndr_err_code ndr_push_netl
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_netlogon_creds_CredentialState(struct ndr_pull *ndr, int ndr_flags, struct netlogon_creds_CredentialState *r)
+ {
++ uint32_t size_session_key_0 = 0;
++ uint32_t size_computer_name_0 = 0;
++ uint32_t length_computer_name_0 = 0;
++ uint32_t size_account_name_0 = 0;
++ uint32_t length_account_name_0 = 0;
+ uint32_t _ptr_sid;
+ TALLOC_CTX *_mem_save_sid_0;
+ {
+@@ -50,7 +55,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_netl
+ if (ndr_flags & NDR_SCALARS) {
+ NDR_CHECK(ndr_pull_align(ndr, 5));
+ NDR_CHECK(ndr_pull_netr_NegotiateFlags(ndr, NDR_SCALARS, &r->negotiate_flags));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->session_key, 16));
++ size_session_key_0 = 16;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->session_key, size_session_key_0));
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->sequence));
+ NDR_CHECK(ndr_pull_netr_Credential(ndr, NDR_SCALARS, &r->seed));
+ NDR_CHECK(ndr_pull_netr_Credential(ndr, NDR_SCALARS, &r->client));
+@@ -58,18 +64,22 @@ _PUBLIC_ enum ndr_err_code ndr_pull_netl
+ NDR_CHECK(ndr_pull_netr_SchannelType(ndr, NDR_SCALARS, &r->secure_channel_type));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->computer_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->computer_name));
+- if (ndr_get_array_length(ndr, &r->computer_name) > ndr_get_array_size(ndr, &r->computer_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->computer_name), ndr_get_array_length(ndr, &r->computer_name));
++ size_computer_name_0 = ndr_get_array_size(ndr, &r->computer_name);
++ length_computer_name_0 = ndr_get_array_length(ndr, &r->computer_name);
++ if (length_computer_name_0 > size_computer_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_computer_name_0, length_computer_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->computer_name), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_name, ndr_get_array_length(ndr, &r->computer_name), sizeof(uint8_t), CH_UTF8));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_computer_name_0, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->computer_name, length_computer_name_0, sizeof(uint8_t), CH_UTF8));
+ NDR_CHECK(ndr_pull_array_size(ndr, &r->account_name));
+ NDR_CHECK(ndr_pull_array_length(ndr, &r->account_name));
+- if (ndr_get_array_length(ndr, &r->account_name) > ndr_get_array_size(ndr, &r->account_name)) {
+- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->account_name), ndr_get_array_length(ndr, &r->account_name));
++ size_account_name_0 = ndr_get_array_size(ndr, &r->account_name);
++ length_account_name_0 = ndr_get_array_length(ndr, &r->account_name);
++ if (length_account_name_0 > size_account_name_0) {
++ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", size_account_name_0, length_account_name_0);
+ }
+- NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->account_name), sizeof(uint8_t)));
+- NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->account_name, ndr_get_array_length(ndr, &r->account_name), sizeof(uint8_t), CH_UTF8));
++ NDR_CHECK(ndr_check_string_terminator(ndr, length_account_name_0, sizeof(uint8_t)));
++ NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->account_name, length_account_name_0, sizeof(uint8_t), CH_UTF8));
+ NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sid));
+ if (_ptr_sid) {
+ NDR_PULL_ALLOC(ndr, r->sid);
+@@ -535,6 +545,9 @@ _PUBLIC_ enum ndr_err_code ndr_push_NL_A
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_NL_AUTH_SIGNATURE(struct ndr_pull *ndr, int ndr_flags, struct NL_AUTH_SIGNATURE *r)
+ {
++ uint32_t size_SequenceNumber_0 = 0;
++ uint32_t size_Checksum_0 = 0;
++ uint32_t size_Confounder_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+@@ -544,9 +557,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_NL_A
+ NDR_CHECK(ndr_pull_NL_SEAL_ALGORITHM(ndr, NDR_SCALARS, &r->SealAlgorithm));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->Pad));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->Flags));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->SequenceNumber, 8));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Checksum, 8));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Confounder, 8));
++ size_SequenceNumber_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->SequenceNumber, size_SequenceNumber_0));
++ size_Checksum_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Checksum, size_Checksum_0));
++ size_Confounder_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Confounder, size_Confounder_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 3));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
+@@ -600,6 +616,9 @@ _PUBLIC_ enum ndr_err_code ndr_push_NL_A
+
+ _PUBLIC_ enum ndr_err_code ndr_pull_NL_AUTH_SHA2_SIGNATURE(struct ndr_pull *ndr, int ndr_flags, struct NL_AUTH_SHA2_SIGNATURE *r)
+ {
++ uint32_t size_SequenceNumber_0 = 0;
++ uint32_t size_Checksum_0 = 0;
++ uint32_t size_Confounder_0 = 0;
+ {
+ uint32_t _flags_save_STRUCT = ndr->flags;
+ ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
+@@ -609,9 +628,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_NL_A
+ NDR_CHECK(ndr_pull_NL_SEAL_ALGORITHM(ndr, NDR_SCALARS, &r->SealAlgorithm));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->Pad));
+ NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->Flags));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->SequenceNumber, 8));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Checksum, 32));
+- NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Confounder, 8));
++ size_SequenceNumber_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->SequenceNumber, size_SequenceNumber_0));
++ size_Checksum_0 = 32;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Checksum, size_Checksum_0));
++ size_Confounder_0 = 8;
++ NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->Confounder, size_Confounder_0));
+ NDR_CHECK(ndr_pull_trailer_align(ndr, 3));
+ }
+ if (ndr_flags & NDR_BUFFERS) {
Modified: branches/samba/squeeze/debian/patches/series
===================================================================
--- branches/samba/squeeze/debian/patches/series 2013-01-31 09:38:32 UTC (rev 4186)
+++ branches/samba/squeeze/debian/patches/series 2013-01-31 09:39:25 UTC (rev 4187)
@@ -32,3 +32,6 @@
0001-s3-Fix-bug-8238-KB2536276-prevents-access-to-sha.patch
security-CVE-2012-1182.patch
security-CVE-2012-2111.patch
+debian-changes-2:3.5.6~dfsg-3squeeze8
+security-CVE-2013-0213.patch
+security-CVE-2013-0214.patch
More information about the Pkg-samba-maint
mailing list