This doesn't look like it has anything to do with character set conversion, but it does :-).

Turns out one of the *really* significant differences between
convert_string() in source4 and source3, is that the one in
source3 will return 0 for byte length converted when called
with dest_len = 0 whereas the one in source4 returns (size_t)-1
and sets errno to E2BIG.

Allow the ndr_string code to cope with the (arguably correct)
way that the source4 implementation works. This code only gets
excercised in the print spooler tests, which aren't run in source4,
which is why this bug has lasted for so long.

You don't want to know how long it took me to find this :-).

Jeremy.

1 files changed, 10 insertions, 7 deletions

diff --git a/librpc/ndr/ndr_string.c b/librpc/ndr/ndr_string.c
index 402cf4e4ad..9cc26dacc5 100644
--- a/librpc/ndr/ndr_string.c
+++ b/librpc/ndr/ndr_string.c
@@ -705,17 +705,20 @@ _PUBLIC_ enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags,
 	required = byte_mul * length;
 	
 	NDR_PUSH_NEED_BYTES(ndr, required);
-	ret = convert_string(CH_UNIX, chset, 
+
+	if (required) {
+		ret = convert_string(CH_UNIX, chset, 
 			     var, strlen(var),
 			     ndr->data+ndr->offset, required);
-	if (ret == -1) {
-		return ndr_push_error(ndr, NDR_ERR_CHARCNV, 
+		if (ret == -1) {
+			return ndr_push_error(ndr, NDR_ERR_CHARCNV, 
 				      "Bad character conversion");
-	}
+		}
 
-	/* Make sure the remaining part of the string is filled with zeroes */
-	if (ret < required) {
-		memset(ndr->data+ndr->offset+ret, 0, required-ret);
+		/* Make sure the remaining part of the string is filled with zeroes */
+		if (ret < required) {
+			memset(ndr->data+ndr->offset+ret, 0, required-ret);
+		}
 	}
 
 	ndr->offset += required;