diff options
| author | Volker Lendecke <vl@samba.org> | 2010-04-19 15:50:11 +0200 |
|---|---|---|
| committer | Volker Lendecke <vl@samba.org> | 2010-04-19 16:31:02 +0200 |
| commit | 6d898b45a381b3a93da4ac2c4e1af0487dd838ef (patch) | |
| tree | afb0f7c754c139b0a5cfd39deed836e33e95ec4c | |
| parent | 23fd76433ab3f1fe4462e39633bc55e26bf050fc (diff) | |
| download | samba-6d898b45a381b3a93da4ac2c4e1af0487dd838ef.tar.gz samba-6d898b45a381b3a93da4ac2c4e1af0487dd838ef.tar.bz2 samba-6d898b45a381b3a93da4ac2c4e1af0487dd838ef.zip | |
libwbclient: Fix wbcListUsers against too small num_entries
Thanks for the s4 winbind sending 0 here and Tridge to point it out to me :-)
| -rw-r--r-- | nsswitch/libwbclient/wbc_sid.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/nsswitch/libwbclient/wbc_sid.c b/nsswitch/libwbclient/wbc_sid.c index 2130077cd9..b3a683ddb5 100644 --- a/nsswitch/libwbclient/wbc_sid.c +++ b/nsswitch/libwbclient/wbc_sid.c @@ -638,8 +638,17 @@ wbcErr wbcListUsers(const char *domain_name, next = (const char *)response.extra_data.data; while (next) { - const char *current = next; - char *k = strchr(next, ','); + const char *current; + char *k; + + if (num_users >= response.data.num_entries) { + wbc_status = WBC_ERR_INVALID_RESPONSE; + goto done; + } + + current = next; + k = strchr(next, ','); + if (k) { k[0] = '\0'; next = k+1; @@ -650,10 +659,6 @@ wbcErr wbcListUsers(const char *domain_name, users[num_users] = strdup(current); BAIL_ON_PTR_ERROR(users[num_users], wbc_status); num_users += 1; - if (num_users > response.data.num_entries) { - wbc_status = WBC_ERR_INVALID_RESPONSE; - goto done; - } } if (num_users != response.data.num_entries) { wbc_status = WBC_ERR_INVALID_RESPONSE; |