sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

ldb_msg: remove_element() checks element array bounds

Browse Source 
Previously we half-heartedly checked one end.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Douglas Bagnall 2019-04-08 10:33:07 +12:00 committed by Andrew Bartlett
parent 652a4015e6
commit 06a02cb88c
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/ldb/common/ldb_msg.c
View File

@ -1222,14 +1222,14 @@ int ldb_msg_copy_attr(struct ldb_message *msg, const char *attr, const char *rep
void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el) void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el)
{ {
ptrdiff_t n = (el - msg->elements); ptrdiff_t n = (el - msg->elements);
if (n >= msg->num_elements) { if (n >= msg->num_elements || n < 0) {
/* should we abort() here? */ /* the element is not in the list. the caller is crazy. */
return; return;
} }
if (n != msg->num_elements-1) {
memmove(el, el+1, ((msg->num_elements-1) - n)*sizeof(*el));
}
msg->num_elements--; msg->num_elements--;
if (n != msg->num_elements) {
memmove(el, el+1, (msg->num_elements - n)*sizeof(*el));
}
} }