diff options
| author | Jeremy Allison <jra@samba.org> | 2014-04-08 10:38:33 -0700 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2014-04-09 01:29:07 +0200 |
| commit | 4f59580331b934b183c3344da57f2002d88d4512 (patch) | |
| tree | eae6e477a09c99782be998d0c46111106b01d9b5 /source3/lib | |
| parent | 8f46b130c5c796d66d26982f5cd99c52f7c8ece1 (diff) | |
| download | samba-4f59580331b934b183c3344da57f2002d88d4512.tar.gz samba-4f59580331b934b183c3344da57f2002d88d4512.tar.xz samba-4f59580331b934b183c3344da57f2002d88d4512.zip | |
s3-lib/util: fix logic inside set_namearray loops.
Additional fix for bug #10544 - s3-lib/util: set_namearray reads across end of namelist string.
Not strictly needed as the initial fix addresses
the problem, but corrects the internal logic
inside the loops.
https://bugzilla.samba.org/show_bug.cgi?id=10544
Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
Diffstat (limited to 'source3/lib')
| -rw-r--r-- | source3/lib/util.c | 26 |
1 files changed, 16 insertions, 10 deletions
diff --git a/source3/lib/util.c b/source3/lib/util.c index d061200bcd4..945fc971e97 100644 --- a/source3/lib/util.c +++ b/source3/lib/util.c @@ -1071,11 +1071,13 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in) /* find the next '/' or consume remaining */ name_end = strchr_m(nameptr, '/'); - if (name_end == NULL) - name_end = (char *)nameptr + strlen(nameptr); - - /* next segment please */ - nameptr = name_end + 1; + if (name_end == NULL) { + /* Point nameptr at the terminating '\0' */ + nameptr += strlen(nameptr); + } else { + /* next segment please */ + nameptr = name_end + 1; + } num_entries++; } @@ -1105,10 +1107,9 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in) /* find the next '/' or consume remaining */ name_end = strchr_m(nameptr, '/'); - if (name_end) + if (name_end != NULL) { *name_end = '\0'; - else - name_end = nameptr + strlen(nameptr); + } (*ppname_array)[i].is_wild = ms_has_wild(nameptr); if(((*ppname_array)[i].name = SMB_STRDUP(nameptr)) == NULL) { @@ -1117,8 +1118,13 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in) return; } - /* next segment please */ - nameptr = name_end + 1; + if (name_end == NULL) { + /* Point nameptr at the terminating '\0' */ + nameptr += strlen(nameptr); + } else { + /* next segment please */ + nameptr = name_end + 1; + } i++; } |