2 files changed, 55 insertions, 4 deletions
diff --git a/source3/lib/util.c b/source3/lib/util.c
index cf8d49c502..809071662d 100644
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -3124,3 +3124,26 @@ int this_is_smp(void)
 	return 0;
 #endif
 }
+
+/****************************************************************
+ Return a safe offset into a buffer, or NULL.
+****************************************************************/
+
+char *get_safe_offset(const char *buf_base, size_t buf_len, char *ptr, size_t off)
+{
+	const char *end_base = buf_base + buf_len;
+	const char *end_ptr = ptr + off;
+
+	if (!buf_base || !ptr) {
+		return NULL;
+	}
+
+	if (end_base < buf_base || end_ptr < ptr) {
+		return NULL; /* wrap. */
+	}
+
+	if (end_ptr < end_base) {
+		return ptr;
+	}
+	return NULL;
+}
diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index ccf0af8b62..032627db94 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -424,10 +424,10 @@ void string_replace( pstring s, char oldc, char newc )
 }
 
 /**
- Skip past some strings in a buffer.
-**/
+ *  Skip past some strings in a buffer - old version - no checks.
+ *  **/
 
-char *skip_string(char *buf,size_t n)
+char *push_skip_string(char *buf,size_t n)
 {
 	while (n--)
 		buf += strlen(buf) + 1;
@@ -435,6 +435,35 @@ char *skip_string(char *buf,size_t n)
 }
 
 /**
+ Skip past some strings in a buffer. Buffer may not be
+ null terminated. end_ptr points to the first byte after
+ then end of the buffer.
+**/
+
+char *skip_string(const char *base, size_t len, char *buf, size_t n)
+{
+	const char *end_ptr = base + len;
+
+	if (end_ptr < base || !base || !buf || buf >= end_ptr) {
+		return NULL;
+	}
+
+	while (n--) {
+		/* Skip the string */
+		while (*buf) {
+			buf++;
+			if (buf >= end_ptr) {
+				return NULL;
+			}
+		}
+		/* Skip the '\0' */
+		buf++;
+	}
+
+	return buf;
+}
+
+/**
  Count the number of characters in a string. Normally this will
  be the same as the number of bytes in a string for single byte strings,
  but will be different for multibyte.
@@ -2591,4 +2620,3 @@ size_t utf16_len_n(const void *src, size_t n)
 
 	return len;
 }
-