summaryrefslogtreecommitdiff
path: root/source4/lib/ldb
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2009-09-11 18:00:42 +1000
committerAndrew Tridgell <tridge@samba.org>2009-09-11 18:02:04 +1000
commit5b20af988c319f389e29db0a47d552c5f68aed58 (patch)
tree3ff6a7177fd0f9819977dbbfdf0e2150814046c5 /source4/lib/ldb
parent4e98f93775762de18b0dfc31080af5c443324c70 (diff)
downloadsamba-5b20af988c319f389e29db0a47d552c5f68aed58.tar.gz
samba-5b20af988c319f389e29db0a47d552c5f68aed58.tar.bz2
samba-5b20af988c319f389e29db0a47d552c5f68aed58.zip
s4-ldb: don't remove a message element beyond the end of the array
Diffstat (limited to 'source4/lib/ldb')
-rw-r--r--source4/lib/ldb/common/ldb_msg.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/source4/lib/ldb/common/ldb_msg.c b/source4/lib/ldb/common/ldb_msg.c
index 8d0fa313a0..702978a361 100644
--- a/source4/lib/ldb/common/ldb_msg.c
+++ b/source4/lib/ldb/common/ldb_msg.c
@@ -739,6 +739,10 @@ int ldb_msg_copy_attr(struct ldb_message *msg, const char *attr, const char *rep
void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el)
{
int n = (el - msg->elements);
+ if (n >= msg->num_elements) {
+ /* should we abort() here? */
+ return;
+ }
if (n != msg->num_elements-1) {
memmove(el, el+1, ((msg->num_elements-1) - n)*sizeof(*el));
}