diff options
| author | Douglas Bagnall <douglas.bagnall@catalyst.net.nz> | 2021-03-06 16:05:15 +1300 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2021-04-07 02:17:34 +0000 |
| commit | 2b2f4f519454beb6f2a46705675a62274019fc09 (patch) | |
| tree | d98175e9b819127a95150431847a878a4be03375 /lib/ldb | |
| parent | ff1c3af603b47a7e8f9faad8d1c2e4a489559155 (diff) | |
| download | samba-2b2f4f519454beb6f2a46705675a62274019fc09.tar.gz | |
ldb: fix ldb_comparison_fold off-by-one overrun
We run one character over in comparing all the bytes in two ldb_vals.
In almost all circumstances both ldb_vals would have an allocated '\0'
in the overrun position, but it is best not to rely on that.
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'lib/ldb')
| -rw-r--r-- | lib/ldb/common/attrib_handlers.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/ldb/common/attrib_handlers.c b/lib/ldb/common/attrib_handlers.c index 81a74584bcb..9e5fa4d3d56 100644 --- a/lib/ldb/common/attrib_handlers.c +++ b/lib/ldb/common/attrib_handlers.c @@ -335,8 +335,8 @@ int ldb_comparison_fold(struct ldb_context *ldb, void *mem_ctx, if (toupper((unsigned char)*s1) != toupper((unsigned char)*s2)) break; if (*s1 == ' ') { - while (n1 && s1[0] == s1[1]) { s1++; n1--; } - while (n2 && s2[0] == s2[1]) { s2++; n2--; } + while (n1 > 1 && s1[0] == s1[1]) { s1++; n1--; } + while (n2 > 1 && s2[0] == s2[1]) { s2++; n2--; } } s1++; s2++; n1--; n2--; |