parse_string is only used for the authentication negotiators.

It can itself determine the length of the string it has to
transfer. Andrew B., could you take a look at the length calculation?
Is that safe?

Thanks,

Volker
(This used to be commit 0ef69b586a8f1fa11a41a3900180ea2090b60bfd)

1 files changed, 7 insertions, 1 deletions

diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c
index 696142905b..e0a75d7382 100644
--- a/source3/rpc_parse/parse_prs.c
+++ b/source3/rpc_parse/parse_prs.c
@@ -1159,10 +1159,16 @@ BOOL prs_unistr(const char *name, prs_struct *ps, int depth, UNISTR *str)
  not include the null-termination character.
  ********************************************************************/
 
-BOOL prs_string(const char *name, prs_struct *ps, int depth, char *str, int len, int max_buf_size)
+BOOL prs_string(const char *name, prs_struct *ps, int depth, char *str, int max_buf_size)
 {
 	char *q;
 	int i;
+	int len;
+
+	if (UNMARSHALLING(ps))
+		len = strlen(&ps->data_p[ps->data_offset]);
+	else
+		len = strlen(str);
 
 	len = MIN(len, (max_buf_size-1));