sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Code

s3-lib/util: fix logic inside set_namearray loops.

Browse Source 
Additional fix for bug #10544 - s3-lib/util: set_namearray reads across end of namelist string.

Not strictly needed as the initial fix addresses
the problem, but corrects the internal logic
inside the loops.

https://bugzilla.samba.org/show_bug.cgi?id=10544

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
This commit is contained in:
Jeremy Allison 2014-04-08 10:38:33 -07:00
parent 8f46b130c5
commit 4f59580331
1 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
source3/lib/util.c
View File

@ -1071,11 +1071,13 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in)
/* find the next '/' or consume remaining */ /* find the next '/' or consume remaining */
name_end = strchr_m(nameptr, '/'); name_end = strchr_m(nameptr, '/');
if (name_end == NULL) if (name_end == NULL) {
name_end = (char *)nameptr + strlen(nameptr); /* Point nameptr at the terminating '\0' */
nameptr += strlen(nameptr);
/* next segment please */ } else {
nameptr = name_end + 1; /* next segment please */
nameptr = name_end + 1;
}
num_entries++; num_entries++;
} }
@ -1105,10 +1107,9 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in)
/* find the next '/' or consume remaining */ /* find the next '/' or consume remaining */
name_end = strchr_m(nameptr, '/'); name_end = strchr_m(nameptr, '/');
if (name_end) if (name_end != NULL) {
*name_end = '\0'; *name_end = '\0';
else }
name_end = nameptr + strlen(nameptr);
(*ppname_array)[i].is_wild = ms_has_wild(nameptr); (*ppname_array)[i].is_wild = ms_has_wild(nameptr);
if(((*ppname_array)[i].name = SMB_STRDUP(nameptr)) == NULL) { if(((*ppname_array)[i].name = SMB_STRDUP(nameptr)) == NULL) {
@ -1117,8 +1118,13 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in)
return; return;
} }
/* next segment please */ if (name_end == NULL) {
nameptr = name_end + 1; /* Point nameptr at the terminating '\0' */
nameptr += strlen(nameptr);
} else {
/* next segment please */
nameptr = name_end + 1;
}
i++; i++;
} }