Fix a segfault found by metze & valgrind...

Don't overwrite past the end of a string.

Volker
(This used to be commit f036368efdcbe576552ea85a78e5e6199a2b2c6d)

1 files changed, 5 insertions, 3 deletions

diff --git a/source3/lib/gencache.c b/source3/lib/gencache.c
index 58e44e3f0b..f3740e3e12 100644
--- a/source3/lib/gencache.c
+++ b/source3/lib/gencache.c
@@ -319,9 +319,8 @@ void gencache_iterate(void (*fn)(const char* key, const char *value, time_t time
 	
 	while (node) {
 		/* ensure null termination of the key string */
-		node->node_key.dptr[node->node_key.dsize] = '\0';
-		keystr = node->node_key.dptr;
-
+		keystr = strndup(node->node_key.dptr, node->node_key.dsize);
+		
 		/* 
 		 * We don't use gencache_get function, because we need to iterate through
 		 * all of the entries. Validity verification is up to fn routine.
@@ -329,6 +328,8 @@ void gencache_iterate(void (*fn)(const char* key, const char *value, time_t time
 		databuf = tdb_fetch(cache, node->node_key);
 		if (!databuf.dptr || databuf.dsize <= TIMEOUT_LEN) {
 			SAFE_FREE(databuf.dptr);
+			SAFE_FREE(keystr);
+			node = node->next;
 			continue;
 		}
 		entry = strndup(databuf.dptr, databuf.dsize);
@@ -342,6 +343,7 @@ void gencache_iterate(void (*fn)(const char* key, const char *value, time_t time
 		
 		SAFE_FREE(valstr);
 		SAFE_FREE(entry);
+		SAFE_FREE(keystr);
 		node = node->next;
 	}