s3-utils: fix format-truncation in smbpasswd

../source3/utils/smbpasswd.c: In function ‘process_root’:
../source3/utils/smbpasswd.c:414:37: error: ‘$’ directive output may be truncated writing 1 byte into a region of size between 0 and 255 [-Werror=format-truncation=]
   slprintf(buf, sizeof(buf) - 1, "%s$", user_name);
                                     ^
In file included from ../source3/include/includes.h:23,
                 from ../source3/utils/smbpasswd.c:19:
../lib/replace/../replace/replace.h:514:18: note: ‘snprintf’ output between 2 and 257 bytes into a destination of size 255
 #define slprintf snprintf
../source3/utils/smbpasswd.c:414:3: note: in expansion of macro ‘slprintf’
   slprintf(buf, sizeof(buf) - 1, "%s$", user_name);
   ^~~~~~~~
../source3/utils/smbpasswd.c:397:35: error: ‘$’ directive output may be truncated writing 1 byte into a region of size between 0 and 255 [-Werror=format-truncation=]
   slprintf(buf, sizeof(buf)-1, "%s$", user_name);
                                   ^
In file included from ../source3/include/includes.h:23,
                 from ../source3/utils/smbpasswd.c:19:
../lib/replace/../replace/replace.h:514:18: note: ‘snprintf’ output between 2 and 257 bytes into a destination of size 255
 #define slprintf snprintf
../source3/utils/smbpasswd.c:397:3: note: in expansion of macro ‘slprintf’
   slprintf(buf, sizeof(buf)-1, "%s$", user_name);
   ^~~~~~~~
cc1: some warnings being treated as errors

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13437

Pair-Programmed-With: Andreas Schneider <asn@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 9b6dc8f504c406ed8a044e5becca7e8f01da6c84)

1 files changed, 26 insertions, 23 deletions

diff --git a/source3/utils/smbpasswd.c b/source3/utils/smbpasswd.c
index fb7ad283995..88847be6432 100644
--- a/source3/utils/smbpasswd.c
+++ b/source3/utils/smbpasswd.c
@@ -368,36 +368,44 @@ static int process_root(int local_flags)
 
 	if (local_flags & LOCAL_TRUST_ACCOUNT) {
 		/* add the $ automatically */
-		static fstring buf;
+		size_t user_name_len = strlen(user_name);
 
-		/*
-		 * Remove any trailing '$' before we
-		 * generate the initial machine password.
-		 */
-
-		if (user_name[strlen(user_name)-1] == '$') {
-			user_name[strlen(user_name)-1] = 0;
+		if (user_name[user_name_len - 1] == '$') {
+			user_name_len--;
+		} else {
+			if (user_name_len + 2 > sizeof(user_name)) {
+				fprintf(stderr, "machine name too long\n");
+				exit(1);
+			}
+			user_name[user_name_len] = '$';
+			user_name[user_name_len + 1] = '\0';
 		}
 
 		if (local_flags & LOCAL_ADD_USER) {
 		        SAFE_FREE(new_passwd);
-			new_passwd = smb_xstrdup(user_name);
+
+			/*
+			 * Remove any trailing '$' before we
+			 * generate the initial machine password.
+			 */
+			new_passwd = smb_xstrndup(user_name, user_name_len);
 			if (!strlower_m(new_passwd)) {
 				fprintf(stderr, "strlower_m %s failed\n",
 					new_passwd);
 				exit(1);
 			}
 		}
-
-		/*
-		 * Now ensure the username ends in '$' for
-		 * the machine add.
-		 */
-
-		slprintf(buf, sizeof(buf)-1, "%s$", user_name);
-		strlcpy(user_name, buf, sizeof(user_name));
 	} else if (local_flags & LOCAL_INTERDOM_ACCOUNT) {
-		static fstring buf;
+		size_t user_name_len = strlen(user_name);
+
+		if (user_name[user_name_len - 1] != '$') {
+			if (user_name_len + 2 > sizeof(user_name)) {
+				fprintf(stderr, "machine name too long\n");
+				exit(1);
+			}
+			user_name[user_name_len] = '$';
+			user_name[user_name_len + 1] = '\0';
+		}
 
 		if ((local_flags & LOCAL_ADD_USER) && (new_passwd == NULL)) {
 			/*
@@ -409,11 +417,6 @@ static int process_root(int local_flags)
 				exit(1);
 			}
 		}
-
-		/* prepare uppercased and '$' terminated username */
-		slprintf(buf, sizeof(buf) - 1, "%s$", user_name);
-		strlcpy(user_name, buf, sizeof(user_name));
-
 	} else {
 
 		if (remote_machine != NULL) {