Use ldb_dn_from_ldb_val to avoid possible over-run of the value.

The ldb_val is length-limited, and while normally NULL terminated,
this avoids the chance that this particular value might not be, as
well as avoiding a cast.

Andrew Bartlett

2 files changed, 9 insertions, 9 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/linked_attributes.c b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
index bafd7e5ecf..a54a7d6472 100644
--- a/source4/dsdb/samdb/ldb_modules/linked_attributes.c
+++ b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
@@ -79,13 +79,13 @@ static struct la_context *linked_attributes_init(struct ldb_module *module,
 /* Common routine to handle reading the attributes and creating a
  * series of modify requests */
 static int la_store_op(struct la_context *ac,
-			enum la_op op, char *dn,
+		       enum la_op op, struct ldb_val *dn,
 			const char *name, const char *value)
 {
 	struct la_op_store *os, *tmp;
 	struct ldb_dn *op_dn;
 
-	op_dn = ldb_dn_new(ac, ac->module->ldb, dn);
+	op_dn = ldb_dn_from_ldb_val(ac, ac->module->ldb, dn);
 	if (!op_dn) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
@@ -233,7 +233,7 @@ static int linked_attributes_add(struct ldb_module *module, struct ldb_request *
 
 		for (j = 0; j < el->num_values; j++) {
 			ret = la_store_op(ac, LA_OP_ADD,
-					  (char *)el->values[j].data,
+					  &el->values[j],
 					  attr_name, attr_val);
 			if (ret != LDB_SUCCESS) {
 				return ret;
@@ -327,7 +327,7 @@ static int la_mod_search_callback(struct ldb_request *req, struct ldb_reply *are
 			/* make sure we manage each value */
 			for (j = 0; j < search_el->num_values; j++) {
 				ret = la_store_op(ac, LA_OP_DEL,
-					  (char *)search_el->values[j].data,
+						  &search_el->values[j],
 						  attr_name, dn);
 				if (ret != LDB_SUCCESS) {
 					talloc_free(ares);
@@ -445,7 +445,7 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 			/* For each value being added, we need to setup the adds */
 			for (j = 0; j < el->num_values; j++) {
 				ret = la_store_op(ac, LA_OP_ADD,
-					  (char *)el->values[j].data,
+						  &el->values[j],
 						  attr_name, attr_val);
 				if (ret != LDB_SUCCESS) {
 					return ret;
@@ -459,7 +459,7 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 				/* For each value being deleted, we need to setup the delete */
 				for (j = 0; j < el->num_values; j++) {
 					ret = la_store_op(ac, LA_OP_DEL,
-						  (char *)el->values[j].data,
+							  &el->values[j],
 							  attr_name, attr_val);
 					if (ret != LDB_SUCCESS) {
 						return ret;
@@ -701,7 +701,7 @@ static int la_op_search_callback(struct ldb_request *req,
 			}
 			for (j = 0; j < el->num_values; j++) {
 				ret = la_store_op(ac, LA_OP_DEL,
-					  (char *)el->values[j].data,
+						  &el->values[j],
 						  attr_name, deldn);
 				if (ret != LDB_SUCCESS) {
 					talloc_free(ares);
@@ -710,7 +710,7 @@ static int la_op_search_callback(struct ldb_request *req,
 				}
 				if (!adddn) continue;
 				ret = la_store_op(ac, LA_OP_ADD,
-					  (char *)el->values[j].data,
+						  &el->values[j],
 						  attr_name, adddn);
 				if (ret != LDB_SUCCESS) {
 					talloc_free(ares);
diff --git a/source4/dsdb/samdb/ldb_modules/normalise.c b/source4/dsdb/samdb/ldb_modules/normalise.c
index 70513bd644..2366bc7856 100644
--- a/source4/dsdb/samdb/ldb_modules/normalise.c
+++ b/source4/dsdb/samdb/ldb_modules/normalise.c
@@ -120,7 +120,7 @@ static int normalize_search_callback(struct ldb_request *req, struct ldb_reply *
 			}
 			for (j = 0; j < msg->elements[i].num_values; j++) {
 				const char *dn_str;
-				struct ldb_dn *dn = ldb_dn_new(ac, ac->module->ldb, (const char *)msg->elements[i].values[j].data);
+				struct ldb_dn *dn = ldb_dn_from_ldb_val(ac, ac->module->ldb, &msg->elements[i].values[j]);
 				if (!dn) {
 					return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 				}