sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-19 21:57:57 +03:00
Code

s4:dsdb use talloc_strndup() in GET_STRING_LDB() rather than walk off the end

Browse Source 
The problem is that samdb_result_string() and
ldb_msg_find_attr_as_string() both simply cast the string, rather than
ensuring the return value is NULL terminated.  This may be best
regarded as a flaw in LDB, but fixing it there is going to be more
difficult.

Andrew Bartlett
This commit is contained in:
Andrew Bartlett 2009-08-24 13:09:10 +10:00
parent 0f98d539e2
commit cc330f9362
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
source4/dsdb/schema/schema_init.c
View File

@ -653,14 +653,24 @@ static int dsdb_schema_setup_ldb_schema_attribute(struct ldb_context *ldb,
}
#define GET_STRING_LDB(msg, attr, mem_ctx, p, elem, strict) do { \
(p)->elem = samdb_result_string(msg, attr, NULL);\
if (strict && (p)->elem == NULL) { \
d_printf("%s: %s == NULL\n", __location__, attr); \
return WERR_INVALID_PARAM; \
} \
talloc_steal(mem_ctx, (p)->elem); \
struct ldb_val *get_string_val = ldb_msg_find_ldb_val(msg, attr); \
if (get_string_val == NULL) { \
if (strict) { \
d_printf("%s: %s == NULL\n", __location__, attr); \
return WERR_INVALID_PARAM; \
} else { \
(p)->elem = NULL; \
} \
} else { \
(p)->elem = talloc_strndup(mem_ctx, \
(const char *)get_string_val->data, \
get_string_val->length); \
if (!(p)->elem) { \
d_printf("%s: talloc_strndup failed for %s\n", __location__, attr); \
return WERR_NOMEM; \
} \
} \
} while (0)
#define GET_STRING_LIST_LDB(msg, attr, mem_ctx, p, elem, strict) do { \