Use ldb_dn_from_ldb_val to avoid possible over-run of the value.

The ldb_val is length-limited, and while normally NULL terminated,
this avoids the chance that this particular value might not be, as
well as avoiding a cast.

Andrew Bartlett

4 files changed, 8 insertions, 8 deletions

diff --git a/source4/lib/ldb/common/attrib_handlers.c b/source4/lib/ldb/common/attrib_handlers.c
index fb57e2dadc..5ec86b5b8f 100644
--- a/source4/lib/ldb/common/attrib_handlers.c
+++ b/source4/lib/ldb/common/attrib_handlers.c
@@ -240,7 +240,7 @@ int ldb_canonicalise_dn(struct ldb_context *ldb, void *mem_ctx,
 	out->length = 0;
 	out->data = NULL;
 
-	dn = ldb_dn_new(ldb, mem_ctx, (char *)in->data);
+	dn = ldb_dn_from_ldb_val(ldb, mem_ctx, in);
 	if ( ! ldb_dn_validate(dn)) {
 		return LDB_ERR_INVALID_DN_SYNTAX;
 	}
@@ -268,10 +268,10 @@ int ldb_comparison_dn(struct ldb_context *ldb, void *mem_ctx,
 	struct ldb_dn *dn1 = NULL, *dn2 = NULL;
 	int ret;
 
-	dn1 = ldb_dn_new(ldb, mem_ctx, (char *)v1->data);
+	dn1 = ldb_dn_from_ldb_val(ldb, mem_ctx, v1);
 	if ( ! ldb_dn_validate(dn1)) return -1;
 
-	dn2 = ldb_dn_new(ldb, mem_ctx, (char *)v2->data);
+	dn2 = ldb_dn_from_ldb_val(ldb, mem_ctx, v2);
 	if ( ! ldb_dn_validate(dn2)) {
 		talloc_free(dn1);
 		return -1;
diff --git a/source4/lib/ldb/common/ldb_ldif.c b/source4/lib/ldb/common/ldb_ldif.c
index fb93e17c6c..538ff8feaa 100644
--- a/source4/lib/ldb/common/ldb_ldif.c
+++ b/source4/lib/ldb/common/ldb_ldif.c
@@ -562,11 +562,11 @@ struct ldb_ldif *ldb_ldif_read(struct ldb_context *ldb,
 		goto failed;
 	}
 
-	msg->dn = ldb_dn_new(msg, ldb, (char *)value.data);
+	msg->dn = ldb_dn_from_ldb_val(msg, ldb, &value);
 
 	if ( ! ldb_dn_validate(msg->dn)) {
 		ldb_debug(ldb, LDB_DEBUG_ERROR, "Error: Unable to parse dn '%s'\n", 
-				  value.data);
+			  (char *)value.data);
 		goto failed;
 	}
 
diff --git a/source4/lib/ldb/common/ldb_match.c b/source4/lib/ldb/common/ldb_match.c
index 64d0e54761..4cde739d67 100644
--- a/source4/lib/ldb/common/ldb_match.c
+++ b/source4/lib/ldb/common/ldb_match.c
@@ -147,7 +147,7 @@ static int ldb_match_equality(struct ldb_context *ldb,
 	int ret;
 
 	if (ldb_attr_dn(tree->u.equality.attr) == 0) {
-		valuedn = ldb_dn_new(ldb, ldb, (char *)tree->u.equality.value.data);
+		valuedn = ldb_dn_from_ldb_val(ldb, ldb, &tree->u.equality.value);
 		if (valuedn == NULL) {
 			return 0;
 		}
diff --git a/source4/lib/ldb/ldb_map/ldb_map.c b/source4/lib/ldb/ldb_map/ldb_map.c
index fafbb63b0a..72d8378a07 100644
--- a/source4/lib/ldb/ldb_map/ldb_map.c
+++ b/source4/lib/ldb/ldb_map/ldb_map.c
@@ -626,7 +626,7 @@ static struct ldb_val ldb_dn_convert_local(struct ldb_module *module, void *mem_
 	struct ldb_dn *dn, *newdn;
 	struct ldb_val newval;
 
-	dn = ldb_dn_new(mem_ctx, module->ldb, (char *)val->data);
+	dn = ldb_dn_from_ldb_val(mem_ctx, module->ldb, val);
 	if (! ldb_dn_validate(dn)) {
 		newval.length = 0;
 		newval.data = NULL;
@@ -652,7 +652,7 @@ static struct ldb_val ldb_dn_convert_remote(struct ldb_module *module, void *mem
 	struct ldb_dn *dn, *newdn;
 	struct ldb_val newval;
 
-	dn = ldb_dn_new(mem_ctx, module->ldb, (char *)val->data);
+	dn = ldb_dn_from_ldb_val(mem_ctx, module->ldb, val);
 	if (! ldb_dn_validate(dn)) {
 		newval.length = 0;
 		newval.data = NULL;