diff options
| author | Björn Baumbach <bb@sernet.de> | 2014-04-07 13:46:42 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2014-04-08 21:44:15 +0200 |
| commit | 8f46b130c5c796d66d26982f5cd99c52f7c8ece1 (patch) | |
| tree | 66e83041f8dc3707331ff664fa3014b1b7d5fe5a /source3/lib | |
| parent | 85041c88d8c2755448d3d659ca7261c4ebf1ec29 (diff) | |
| download | samba-8f46b130c5c796d66d26982f5cd99c52f7c8ece1.tar.gz samba-8f46b130c5c796d66d26982f5cd99c52f7c8ece1.tar.xz samba-8f46b130c5c796d66d26982f5cd99c52f7c8ece1.zip | |
s3-lib/util: fix read across end of namelist string
If the namelist is not terminated with a '/', we try to read
the next character after the string termination '\0'.
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Apr 8 21:44:16 CEST 2014 on sn-devel-104
Diffstat (limited to 'source3/lib')
| -rw-r--r-- | source3/lib/util.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/source3/lib/util.c b/source3/lib/util.c index 374bc5d5c92..d061200bcd4 100644 --- a/source3/lib/util.c +++ b/source3/lib/util.c @@ -1035,6 +1035,7 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in) { char *name_end; char *namelist; + char *namelist_end; char *nameptr; int num_entries = 0; int i; @@ -1051,12 +1052,14 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in) } nameptr = namelist; + namelist_end = &namelist[strlen(namelist)]; + /* We need to make two passes over the string. The first to count the number of elements, the second to split it. */ - while(*nameptr) { + while(nameptr <= namelist_end) { if ( *nameptr == '/' ) { /* cope with multiple (useless) /s) */ nameptr++; @@ -1090,7 +1093,7 @@ void set_namearray(name_compare_entry **ppname_array, const char *namelist_in) /* Now copy out the names */ nameptr = namelist; i = 0; - while(*nameptr) { + while(nameptr <= namelist_end) { if ( *nameptr == '/' ) { /* cope with multiple (useless) /s) */ nameptr++; |