mirror of
https://github.com/samba-team/samba.git
synced 2024-12-22 13:34:15 +03:00
ldb_msg: remove_element() checks element array bounds
Previously we half-heartedly checked one end. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
parent
652a4015e6
commit
06a02cb88c
@ -1222,14 +1222,14 @@ int ldb_msg_copy_attr(struct ldb_message *msg, const char *attr, const char *rep
|
|||||||
void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el)
|
void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el)
|
||||||
{
|
{
|
||||||
ptrdiff_t n = (el - msg->elements);
|
ptrdiff_t n = (el - msg->elements);
|
||||||
if (n >= msg->num_elements) {
|
if (n >= msg->num_elements || n < 0) {
|
||||||
/* should we abort() here? */
|
/* the element is not in the list. the caller is crazy. */
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
if (n != msg->num_elements-1) {
|
|
||||||
memmove(el, el+1, ((msg->num_elements-1) - n)*sizeof(*el));
|
|
||||||
}
|
|
||||||
msg->num_elements--;
|
msg->num_elements--;
|
||||||
|
if (n != msg->num_elements) {
|
||||||
|
memmove(el, el+1, (msg->num_elements - n)*sizeof(*el));
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user