summaryrefslogtreecommitdiff
path: root/source4/auth
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2007-06-13 05:14:00 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 14:53:17 -0500
commitf7110d928afd61cee203d07fd85968af993a327f (patch)
tree292cc7b845553e9b2c4be6649d8a9c5881b9e3f4 /source4/auth
parentac00b6517e08977f44e7a3b106b97b899881d6aa (diff)
downloadsamba-f7110d928afd61cee203d07fd85968af993a327f.tar.gz
samba-f7110d928afd61cee203d07fd85968af993a327f.tar.bz2
samba-f7110d928afd61cee203d07fd85968af993a327f.zip
r23455: These buffers may not be null terminated. Ensure we don't run past the
end of teh buffer printing the error strings. Andrew Bartlett (This used to be commit 37e7070ca92e2f48fa02f7fd6736e5b26520f559)
Diffstat (limited to 'source4/auth')
-rw-r--r--source4/auth/gensec/gensec_gssapi.c13
1 files changed, 12 insertions, 1 deletions
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index 5596949eda..8a629405da 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -87,18 +87,29 @@ static char *gssapi_error_string(TALLOC_CTX *mem_ctx,
OM_uint32 disp_min_stat, disp_maj_stat;
gss_buffer_desc maj_error_message;
gss_buffer_desc min_error_message;
+ char *maj_error_string, *min_error_string;
OM_uint32 msg_ctx = 0;
char *ret;
maj_error_message.value = NULL;
min_error_message.value = NULL;
+ maj_error_message.length = 0;
+ min_error_message.length = 0;
disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE,
mech, &msg_ctx, &maj_error_message);
disp_maj_stat = gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE,
mech, &msg_ctx, &min_error_message);
- ret = talloc_asprintf(mem_ctx, "%s: %s", (char *)maj_error_message.value, (char *)min_error_message.value);
+
+ maj_error_string = talloc_strndup(mem_ctx, (char *)maj_error_message.value, maj_error_message.length);
+
+ min_error_string = talloc_strndup(mem_ctx, (char *)min_error_message.value, min_error_message.length);
+
+ ret = talloc_asprintf(mem_ctx, "%s: %s", maj_error_string, min_error_string);
+
+ talloc_free(maj_error_string);
+ talloc_free(min_error_string);
gss_release_buffer(&disp_min_stat, &maj_error_message);
gss_release_buffer(&disp_min_stat, &min_error_message);