summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2003-04-23 14:07:33 +0000
committerAndrew Bartlett <abartlet@samba.org>2003-04-23 14:07:33 +0000
commit66468d23158694383f3759464ffa7ade1c1d6d6c (patch)
treebac4cf18f706365582693752c3cad8f1d14f7da9
parent11c453951a336969df3523779046fbd1380bcd64 (diff)
downloadsamba-66468d23158694383f3759464ffa7ade1c1d6d6c.tar.gz
samba-66468d23158694383f3759464ffa7ade1c1d6d6c.tar.bz2
samba-66468d23158694383f3759464ffa7ade1c1d6d6c.zip
Patch by Metze to ensure that we always at least initialize our output string
for rpc_pull_string. If we had a NULL or zero-length string, we would use uninitialised data in the result string. Andrew Bartlett (This used to be commit df10aee451b431a8a056a949a98393da256185da)
-rw-r--r--source3/lib/charcnv.c4
-rw-r--r--source3/lib/util_unistr.c5
-rw-r--r--source3/rpc_server/srv_samr_nt.c6
3 files changed, 12 insertions, 3 deletions
diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
index 7acb7147fd..5086f924db 100644
--- a/source3/lib/charcnv.c
+++ b/source3/lib/charcnv.c
@@ -420,6 +420,8 @@ size_t pull_ascii(char *dest, const void *src, size_t dest_len, size_t src_len,
if (dest_len)
dest[MIN(ret, dest_len-1)] = 0;
+ else
+ dest[0] = 0;
return src_len;
}
@@ -629,6 +631,8 @@ size_t pull_ucs2(const void *base_ptr, char *dest, const void *src, size_t dest_
ret = convert_string(CH_UCS2, CH_UNIX, src, src_len, dest, dest_len);
if (dest_len)
dest[MIN(ret, dest_len-1)] = 0;
+ else
+ dest[0] = 0;
return src_len;
}
diff --git a/source3/lib/util_unistr.c b/source3/lib/util_unistr.c
index 08bb03986f..5df0828295 100644
--- a/source3/lib/util_unistr.c
+++ b/source3/lib/util_unistr.c
@@ -229,7 +229,10 @@ char *skip_unibuf(char *src, size_t len)
*/
int rpcstr_pull(char* dest, void *src, int dest_len, int src_len, int flags)
{
- if (!src) return 0;
+ if (!src) {
+ dest[0] = 0;
+ return 0;
+ }
if(dest_len==-1) dest_len=MAXUNI-3;
return pull_ucs2(NULL, dest, src, dest_len, src_len, flags|STR_UNICODE|STR_NOALIGN);
}
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 7b2cd78dc6..d6441fd361 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -1473,13 +1473,14 @@ NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LO
for (i = 0; i < num_rids; i++) {
fstring name;
DOM_SID sid;
+ int ret;
r_u->status = NT_STATUS_NONE_MAPPED;
rid [i] = 0xffffffff;
type[i] = SID_NAME_UNKNOWN;
- rpcstr_pull(name, q_u->uni_name[i].buffer, sizeof(name), q_u->uni_name[i].uni_str_len*2, 0);
+ ret = rpcstr_pull(name, q_u->uni_name[i].buffer, sizeof(name), q_u->uni_name[i].uni_str_len*2, 0);
/*
* we are only looking for a name
@@ -1492,7 +1493,8 @@ NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LO
* a cleaner code is to add the sid of the domain we're looking in
* to the local_lookup_name function.
*/
- if(local_lookup_name(name, &sid, &local_type)) {
+
+ if ((ret > 0) && local_lookup_name(name, &sid, &local_type)) {
sid_split_rid(&sid, &local_rid);
if (sid_equal(&sid, &pol_sid)) {