sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-26 10:04:02 +03:00
Code

ldb: Be strict about talloc_memdup() and passed in buffers in ldb_dn_set_component()

Browse Source 
This ensures we do not over-read the source buffer, but still NUL terminate.

This may be related to debuain bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808769

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
This commit is contained in:
Andrew Bartlett 2016-01-04 12:12:37 +13:00
parent ff94a01e19
commit 084bab5a06
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/ldb/common/ldb_dn.c
View File

@ -1907,11 +1907,23 @@ int ldb_dn_set_component(struct ldb_dn *dn, int num,
}
v.length = val.length;
v.data = (uint8_t *)talloc_memdup(dn, val.data, v.length+1);
/*
* This is like talloc_memdup(dn, v.data, v.length + 1), but
* avoids the over-read
*/
v.data = (uint8_t *)talloc_size(dn, v.length+1);
if ( ! v.data) {
talloc_free(n);
return LDB_ERR_OTHER;
}
memcpy(v.data, val.data, val.length);
/*
* Enforce NUL termination outside the stated length, as is
* traditional in LDB
*/
v.data[v.length] = '\0';
talloc_free(dn->components[num].name);
talloc_free(dn->components[num].value.data);