diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2007-06-13 05:14:00 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 14:53:17 -0500 |
| commit | f7110d928afd61cee203d07fd85968af993a327f (patch) | |
| tree | 292cc7b845553e9b2c4be6649d8a9c5881b9e3f4 | |
| parent | ac00b6517e08977f44e7a3b106b97b899881d6aa (diff) | |
| download | samba-f7110d928afd61cee203d07fd85968af993a327f.tar.gz samba-f7110d928afd61cee203d07fd85968af993a327f.tar.bz2 samba-f7110d928afd61cee203d07fd85968af993a327f.zip | |
r23455: These buffers may not be null terminated. Ensure we don't run past the
end of teh buffer printing the error strings.
Andrew Bartlett
(This used to be commit 37e7070ca92e2f48fa02f7fd6736e5b26520f559)
| -rw-r--r-- | source4/auth/gensec/gensec_gssapi.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c index 5596949eda..8a629405da 100644 --- a/source4/auth/gensec/gensec_gssapi.c +++ b/source4/auth/gensec/gensec_gssapi.c @@ -87,18 +87,29 @@ static char *gssapi_error_string(TALLOC_CTX *mem_ctx, OM_uint32 disp_min_stat, disp_maj_stat; gss_buffer_desc maj_error_message; gss_buffer_desc min_error_message; + char *maj_error_string, *min_error_string; OM_uint32 msg_ctx = 0; char *ret; maj_error_message.value = NULL; min_error_message.value = NULL; + maj_error_message.length = 0; + min_error_message.length = 0; disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE, mech, &msg_ctx, &maj_error_message); disp_maj_stat = gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE, mech, &msg_ctx, &min_error_message); - ret = talloc_asprintf(mem_ctx, "%s: %s", (char *)maj_error_message.value, (char *)min_error_message.value); + + maj_error_string = talloc_strndup(mem_ctx, (char *)maj_error_message.value, maj_error_message.length); + + min_error_string = talloc_strndup(mem_ctx, (char *)min_error_message.value, min_error_message.length); + + ret = talloc_asprintf(mem_ctx, "%s: %s", maj_error_string, min_error_string); + + talloc_free(maj_error_string); + talloc_free(min_error_string); gss_release_buffer(&disp_min_stat, &maj_error_message); gss_release_buffer(&disp_min_stat, &min_error_message); |