Remove strlower_m() and strupper_m() from source4 and common code.

This function is problematic because a string may expand in size when
changed into upper or lower case.  This will then push characters off
the end of the string in the s3 implementation, or panic in the former
s4 implementation.

Andrew Bartlett

1 files changed, 14 insertions, 14 deletions

diff --git a/source4/auth/ntlmssp/ntlmssp_server.c b/source4/auth/ntlmssp/ntlmssp_server.c
index 9db3b560c1..cdae37262e 100644
--- a/source4/auth/ntlmssp/ntlmssp_server.c
+++ b/source4/auth/ntlmssp/ntlmssp_server.c
@@ -308,26 +308,26 @@ NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
 	ntlmssp_state->server.netbios_domain = lpcfg_workgroup(gensec_security->settings->lp_ctx);
 
 	{
-		char dnsdomname[MAXHOSTNAMELEN], dnsname[MAXHOSTNAMELEN];
-
-		/* Find out the DNS domain name */
-		dnsdomname[0] = '\0';
-		safe_strcpy(dnsdomname, lpcfg_dnsdomain(gensec_security->settings->lp_ctx), sizeof(dnsdomname) - 1);
+		char *dnsdomain = lpcfg_dnsdomain(gensec_security->settings->lp_ctx);
+		char *dnsname, *lower_netbiosname;
+		lower_netbiosname = strlower_talloc(ntlmssp_state, ntlmssp_state->server.netbios_name);
 
 		/* Find out the DNS host name */
-		safe_strcpy(dnsname, ntlmssp_state->server.netbios_name, sizeof(dnsname) - 1);
-		if (dnsdomname[0] != '\0') {
-			safe_strcat(dnsname, ".", sizeof(dnsname) - 1);
-			safe_strcat(dnsname, dnsdomname, sizeof(dnsname) - 1);
+		if (dnsdomain && dnsdomain[0] != '\0') {
+			dnsname = talloc_asprintf(ntlmssp_state, "%s.%s",
+						  lower_netbiosname,
+						  dnsdomain);
+			talloc_free(lower_netbiosname);
+			ntlmssp_state->server.dns_name = dnsname;
+		} else {
+			ntlmssp_state->server.dns_name = lower_netbiosname;
 		}
-		strlower_m(dnsname);
 
-		ntlmssp_state->server.dns_name = talloc_strdup(ntlmssp_state,
-								      dnsname);
 		NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state->server.dns_name);
 
-		ntlmssp_state->server.dns_domain = talloc_strdup(ntlmssp_state,
-								        dnsdomname);
+		ntlmssp_state->server.dns_domain
+			= talloc_strdup(ntlmssp_state,
+					lpcfg_dnsdomain(gensec_security->settings->lp_ctx));
 		NT_STATUS_HAVE_NO_MEMORY(ntlmssp_state->server.dns_domain);
 	}