summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2010-04-19 15:50:11 +0200
committerVolker Lendecke <vl@samba.org>2010-04-19 16:31:02 +0200
commit6d898b45a381b3a93da4ac2c4e1af0487dd838ef (patch)
treeafb0f7c754c139b0a5cfd39deed836e33e95ec4c
parent23fd76433ab3f1fe4462e39633bc55e26bf050fc (diff)
downloadsamba-6d898b45a381b3a93da4ac2c4e1af0487dd838ef.tar.gz
samba-6d898b45a381b3a93da4ac2c4e1af0487dd838ef.tar.bz2
samba-6d898b45a381b3a93da4ac2c4e1af0487dd838ef.zip
libwbclient: Fix wbcListUsers against too small num_entries
Thanks for the s4 winbind sending 0 here and Tridge to point it out to me :-)
-rw-r--r--nsswitch/libwbclient/wbc_sid.c17
1 files changed, 11 insertions, 6 deletions
diff --git a/nsswitch/libwbclient/wbc_sid.c b/nsswitch/libwbclient/wbc_sid.c
index 2130077cd9..b3a683ddb5 100644
--- a/nsswitch/libwbclient/wbc_sid.c
+++ b/nsswitch/libwbclient/wbc_sid.c
@@ -638,8 +638,17 @@ wbcErr wbcListUsers(const char *domain_name,
next = (const char *)response.extra_data.data;
while (next) {
- const char *current = next;
- char *k = strchr(next, ',');
+ const char *current;
+ char *k;
+
+ if (num_users >= response.data.num_entries) {
+ wbc_status = WBC_ERR_INVALID_RESPONSE;
+ goto done;
+ }
+
+ current = next;
+ k = strchr(next, ',');
+
if (k) {
k[0] = '\0';
next = k+1;
@@ -650,10 +659,6 @@ wbcErr wbcListUsers(const char *domain_name,
users[num_users] = strdup(current);
BAIL_ON_PTR_ERROR(users[num_users], wbc_status);
num_users += 1;
- if (num_users > response.data.num_entries) {
- wbc_status = WBC_ERR_INVALID_RESPONSE;
- goto done;
- }
}
if (num_users != response.data.num_entries) {
wbc_status = WBC_ERR_INVALID_RESPONSE;