diff options
| author | Andrew Tridgell <tridge@samba.org> | 2009-09-11 18:00:42 +1000 |
|---|---|---|
| committer | Andrew Tridgell <tridge@samba.org> | 2009-09-11 18:02:04 +1000 |
| commit | 5b20af988c319f389e29db0a47d552c5f68aed58 (patch) | |
| tree | 3ff6a7177fd0f9819977dbbfdf0e2150814046c5 /source4 | |
| parent | 4e98f93775762de18b0dfc31080af5c443324c70 (diff) | |
| download | samba-5b20af988c319f389e29db0a47d552c5f68aed58.tar.gz samba-5b20af988c319f389e29db0a47d552c5f68aed58.tar.bz2 samba-5b20af988c319f389e29db0a47d552c5f68aed58.zip | |
s4-ldb: don't remove a message element beyond the end of the array
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/lib/ldb/common/ldb_msg.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/source4/lib/ldb/common/ldb_msg.c b/source4/lib/ldb/common/ldb_msg.c index 8d0fa313a0..702978a361 100644 --- a/source4/lib/ldb/common/ldb_msg.c +++ b/source4/lib/ldb/common/ldb_msg.c @@ -739,6 +739,10 @@ int ldb_msg_copy_attr(struct ldb_message *msg, const char *attr, const char *rep void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el) { int n = (el - msg->elements); + if (n >= msg->num_elements) { + /* should we abort() here? */ + return; + } if (n != msg->num_elements-1) { memmove(el, el+1, ((msg->num_elements-1) - n)*sizeof(*el)); } |