mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
s3-lib/util: fix logic inside set_namearray loops.
Additional fix for bug #10544 - s3-lib/util: set_namearray reads across end of namelist string. Not strictly needed as the initial fix addresses the problem, but corrects the internal logic inside the loops. https://bugzilla.samba.org/show_bug.cgi?id=10544 Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Michael Adam <obnox@samba.org>
This commit is contained in:
parent
8f46b130c5
commit
4f59580331
@ -1071,11 +1071,13 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in)
|
||||
|
||||
/* find the next '/' or consume remaining */
|
||||
name_end = strchr_m(nameptr, '/');
|
||||
if (name_end == NULL)
|
||||
name_end = (char *)nameptr + strlen(nameptr);
|
||||
|
||||
/* next segment please */
|
||||
nameptr = name_end + 1;
|
||||
if (name_end == NULL) {
|
||||
/* Point nameptr at the terminating '\0' */
|
||||
nameptr += strlen(nameptr);
|
||||
} else {
|
||||
/* next segment please */
|
||||
nameptr = name_end + 1;
|
||||
}
|
||||
num_entries++;
|
||||
}
|
||||
|
||||
@ -1105,10 +1107,9 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in)
|
||||
|
||||
/* find the next '/' or consume remaining */
|
||||
name_end = strchr_m(nameptr, '/');
|
||||
if (name_end)
|
||||
if (name_end != NULL) {
|
||||
*name_end = '\0';
|
||||
else
|
||||
name_end = nameptr + strlen(nameptr);
|
||||
}
|
||||
|
||||
(*ppname_array)[i].is_wild = ms_has_wild(nameptr);
|
||||
if(((*ppname_array)[i].name = SMB_STRDUP(nameptr)) == NULL) {
|
||||
@ -1117,8 +1118,13 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in)
|
||||
return;
|
||||
}
|
||||
|
||||
/* next segment please */
|
||||
nameptr = name_end + 1;
|
||||
if (name_end == NULL) {
|
||||
/* Point nameptr at the terminating '\0' */
|
||||
nameptr += strlen(nameptr);
|
||||
} else {
|
||||
/* next segment please */
|
||||
nameptr = name_end + 1;
|
||||
}
|
||||
i++;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user