diff options
| author | Gerald Carter <jerry@samba.org> | 2007-02-05 15:16:30 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 12:17:43 -0500 |
| commit | a25203818798f823d3a08134fa9d89118bc9adc3 (patch) | |
| tree | 35f8adc3d27a7a03cc0308fd1b5dbb81e9a773da | |
| parent | 7093ba871cc181ccaeb2c62acf262290964085f5 (diff) | |
| download | samba-a25203818798f823d3a08134fa9d89118bc9adc3.tar.gz samba-a25203818798f823d3a08134fa9d89118bc9adc3.tar.bz2 samba-a25203818798f823d3a08134fa9d89118bc9adc3.zip | |
r21151: applying patches for CVE-2007-045[34]
(This used to be commit 1d46b2ae3447b3521987b2ab1064a6ea314cfa07)
| -rw-r--r-- | source3/modules/vfs_afsacl.c | 2 | ||||
| -rw-r--r-- | source3/nsswitch/winbind_nss_solaris.c | 6 |
2 files changed, 5 insertions, 3 deletions
diff --git a/source3/modules/vfs_afsacl.c b/source3/modules/vfs_afsacl.c index e7650fe457..43fa537d73 100644 --- a/source3/modules/vfs_afsacl.c +++ b/source3/modules/vfs_afsacl.c @@ -901,7 +901,7 @@ static BOOL afs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp, ZERO_STRUCT(dir_acl); ZERO_STRUCT(file_acl); - pstr_sprintf(name, fsp->fsp_name); + pstrcpy(name, fsp->fsp_name); if (!fsp->is_directory) { /* We need to get the name of the directory containing the diff --git a/source3/nsswitch/winbind_nss_solaris.c b/source3/nsswitch/winbind_nss_solaris.c index 04f464a798..3b069d339f 100644 --- a/source3/nsswitch/winbind_nss_solaris.c +++ b/source3/nsswitch/winbind_nss_solaris.c @@ -493,7 +493,8 @@ _nss_winbind_ipnodes_getbyname(nss_backend_t* be, void *args) af = AF_INET6; #endif - strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name)) ; + strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1); + request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0'; if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response)) == NSS_STATUS_SUCCESS ) { @@ -515,7 +516,8 @@ _nss_winbind_hosts_getbyname(nss_backend_t* be, void *args) ZERO_STRUCT(response); ZERO_STRUCT(request); - strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name)); + strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1); + request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0'; if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response)) == NSS_STATUS_SUCCESS ) { |