summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGerald Carter <jerry@samba.org>2007-02-05 15:16:30 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 12:17:43 -0500
commita25203818798f823d3a08134fa9d89118bc9adc3 (patch)
tree35f8adc3d27a7a03cc0308fd1b5dbb81e9a773da
parent7093ba871cc181ccaeb2c62acf262290964085f5 (diff)
downloadsamba-a25203818798f823d3a08134fa9d89118bc9adc3.tar.gz
samba-a25203818798f823d3a08134fa9d89118bc9adc3.tar.bz2
samba-a25203818798f823d3a08134fa9d89118bc9adc3.zip
r21151: applying patches for CVE-2007-045[34]
(This used to be commit 1d46b2ae3447b3521987b2ab1064a6ea314cfa07)
-rw-r--r--source3/modules/vfs_afsacl.c2
-rw-r--r--source3/nsswitch/winbind_nss_solaris.c6
2 files changed, 5 insertions, 3 deletions
diff --git a/source3/modules/vfs_afsacl.c b/source3/modules/vfs_afsacl.c
index e7650fe457..43fa537d73 100644
--- a/source3/modules/vfs_afsacl.c
+++ b/source3/modules/vfs_afsacl.c
@@ -901,7 +901,7 @@ static BOOL afs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
ZERO_STRUCT(dir_acl);
ZERO_STRUCT(file_acl);
- pstr_sprintf(name, fsp->fsp_name);
+ pstrcpy(name, fsp->fsp_name);
if (!fsp->is_directory) {
/* We need to get the name of the directory containing the
diff --git a/source3/nsswitch/winbind_nss_solaris.c b/source3/nsswitch/winbind_nss_solaris.c
index 04f464a798..3b069d339f 100644
--- a/source3/nsswitch/winbind_nss_solaris.c
+++ b/source3/nsswitch/winbind_nss_solaris.c
@@ -493,7 +493,8 @@ _nss_winbind_ipnodes_getbyname(nss_backend_t* be, void *args)
af = AF_INET6;
#endif
- strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name)) ;
+ strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+ request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
== NSS_STATUS_SUCCESS ) {
@@ -515,7 +516,8 @@ _nss_winbind_hosts_getbyname(nss_backend_t* be, void *args)
ZERO_STRUCT(response);
ZERO_STRUCT(request);
- strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name));
+ strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+ request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
== NSS_STATUS_SUCCESS ) {