diff options
| author | Gregor Beck <gbeck@sernet.de> | 2011-07-05 11:55:34 +0200 |
|---|---|---|
| committer | Michael Adam <obnox@samba.org> | 2011-08-15 17:15:14 +0200 |
| commit | 8a36e721407dd8eb3b1df71fbbbc7a6e3c804e48 (patch) | |
| tree | 61ba36ee8fec2fef5a430afa235abd4bb0f15b11 /source3/lib/util_tdb.c | |
| parent | 39f9c854ae258424deea7fcc004077404149dfe5 (diff) | |
| download | samba-8a36e721407dd8eb3b1df71fbbbc7a6e3c804e48.tar.gz | |
s3: avoid reading past the end of buffer in tdb_unpack 'f' if zero termination is missing
Signed-off-by: Michael Adam <obnox@samba.org>
Diffstat (limited to 'source3/lib/util_tdb.c')
| -rw-r--r-- | source3/lib/util_tdb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source3/lib/util_tdb.c b/source3/lib/util_tdb.c index 65e46119b4f..fb586f45d2f 100644 --- a/source3/lib/util_tdb.c +++ b/source3/lib/util_tdb.c @@ -417,7 +417,7 @@ int tdb_unpack(const uint8 *buf, int bufsize, const char *fmt, ...) break; case 'f': /* null-terminated string */ s = va_arg(ap,char *); - len = strlen((const char *)buf) + 1; + len = strnlen((const char *)buf, bufsize) + 1; if (bufsize < len || len > sizeof(fstring)) goto no_space; memcpy(s, buf, len); |