summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorGregor Beck <gbeck@sernet.de>2011-07-05 11:55:34 +0200
committerMichael Adam <obnox@samba.org>2011-08-15 17:15:14 +0200
commit8a36e721407dd8eb3b1df71fbbbc7a6e3c804e48 (patch)
tree61ba36ee8fec2fef5a430afa235abd4bb0f15b11 /source3
parent39f9c854ae258424deea7fcc004077404149dfe5 (diff)
downloadsamba-8a36e721407dd8eb3b1df71fbbbc7a6e3c804e48.tar.gz
samba-8a36e721407dd8eb3b1df71fbbbc7a6e3c804e48.tar.bz2
samba-8a36e721407dd8eb3b1df71fbbbc7a6e3c804e48.zip
s3: avoid reading past the end of buffer in tdb_unpack 'f' if zero termination is missing
Signed-off-by: Michael Adam <obnox@samba.org>
Diffstat (limited to 'source3')
-rw-r--r--source3/lib/util_tdb.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/source3/lib/util_tdb.c b/source3/lib/util_tdb.c
index 65e46119b4..fb586f45d2 100644
--- a/source3/lib/util_tdb.c
+++ b/source3/lib/util_tdb.c
@@ -417,7 +417,7 @@ int tdb_unpack(const uint8 *buf, int bufsize, const char *fmt, ...)
break;
case 'f': /* null-terminated string */
s = va_arg(ap,char *);
- len = strlen((const char *)buf) + 1;
+ len = strnlen((const char *)buf, bufsize) + 1;
if (bufsize < len || len > sizeof(fstring))
goto no_space;
memcpy(s, buf, len);