diff options
| author | Samuel Cabrero <scabrero@suse.de> | 2018-10-30 18:47:16 +0100 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2018-11-01 01:59:10 +0100 |
| commit | 8d14714cc5e4c2b439e973faf602afb2fc1e7488 (patch) | |
| tree | 0a9019112d6eb8dde0e9aca730b435e8c57f3815 /source3/winbindd/winbindd_rpc.c | |
| parent | 1b2de44ea8114cf2025e8b8c843131e2f2dbed27 (diff) | |
| download | samba-8d14714cc5e4c2b439e973faf602afb2fc1e7488.tar.gz | |
s3: winbind: Remove fstring from wb_acct_info struct
The group enumeration backend functions try to allocate an array of
wb_acct_info structs with a number of elements equal to the number of
groups. In domains with a large number of groups this allocation may
fail due to the size of the chunk.
Found while trying to enumerate the groups in a domain with more than
700k groups.
Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source3/winbindd/winbindd_rpc.c')
| -rw-r--r-- | source3/winbindd/winbindd_rpc.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/source3/winbindd/winbindd_rpc.c b/source3/winbindd/winbindd_rpc.c index f50fb8fa5db..6f7cb07f4e3 100644 --- a/source3/winbindd/winbindd_rpc.c +++ b/source3/winbindd/winbindd_rpc.c @@ -155,9 +155,13 @@ NTSTATUS rpc_enum_dom_groups(TALLOC_CTX *mem_ctx, for (g = 0; g < count; g++) { struct wb_acct_info *i = &info[num_info + g]; - fstrcpy(i->acct_name, + i->acct_name = talloc_strdup(info, sam_array->entries[g].name.string); - fstrcpy(i->acct_desc, ""); + if (i->acct_name == NULL) { + TALLOC_FREE(info); + return NT_STATUS_NO_MEMORY; + } + i->acct_desc = NULL; i->rid = sam_array->entries[g].idx; } @@ -217,9 +221,13 @@ NTSTATUS rpc_enum_local_groups(TALLOC_CTX *mem_ctx, for (g = 0; g < count; g++) { struct wb_acct_info *i = &info[num_info + g]; - fstrcpy(i->acct_name, + i->acct_name = talloc_strdup(info, sam_array->entries[g].name.string); - fstrcpy(i->acct_desc, ""); + if (i->acct_name == NULL) { + TALLOC_FREE(info); + return NT_STATUS_NO_MEMORY; + } + i->acct_desc = NULL; i->rid = sam_array->entries[g].idx; } |