From 80f30889e9c947e6ddf31efd5d07d32d1a806209 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Mon, 11 Oct 2010 22:31:14 +0200
Subject: s4 dns: Fix a data corruption in the dns_string parsing

---
 librpc/ndr/ndr_dns.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/librpc/ndr/ndr_dns.c b/librpc/ndr/ndr_dns.c
index 638220af4e..70d4581f58 100644
--- a/librpc/ndr/ndr_dns.c
+++ b/librpc/ndr/ndr_dns.c
@@ -112,28 +112,24 @@ _PUBLIC_ enum ndr_err_code ndr_pull_dns_string(struct ndr_pull *ndr, int ndr_fla
 		return NDR_ERR_SUCCESS;
 	}
 
-	name = NULL;
+	name = talloc_strdup(ndr->current_mem_ctx, "");
 
 	/* break up name into a list of components */
 	for (num_components=0;num_components<MAX_COMPONENTS;num_components++) {
 		uint8_t *component = NULL;
 		NDR_CHECK(ndr_pull_component(ndr, &component, &offset, &max_offset));
 		if (component == NULL) break;
-		if (name) {
+		if (num_components > 0) {
 			name = talloc_asprintf_append_buffer(name, ".%s", component);
-			NDR_ERR_HAVE_NO_MEMORY(name);
 		} else {
-			name = (char *)component;
+			name = talloc_asprintf_append_buffer(name, "%s", component);
 		}
+		NDR_ERR_HAVE_NO_MEMORY(name);
 	}
 	if (num_components == MAX_COMPONENTS) {
 		return ndr_pull_error(ndr, NDR_ERR_STRING,
 				      "BAD DNS NAME too many components");
 	}
-	if (num_components == 0) {
-		name = talloc_strdup(ndr, "");
-		NDR_ERR_HAVE_NO_MEMORY(name);
-	}
 
 	(*s) = name;
 	ndr->offset = max_offset;
-- 
cgit