s3-svcctl: fix memcpy in _svcctl_EnumServicesStatusW().

Make sure we are not copying more than what we have as valid data.

Fix from Jeremy. Thanks a lot for watching this so closely!

Guenther

diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index 0b0ef83bee97c73613477149a0d15a02c3a164ac..d73f73f9eccfaad16075f80f144077f544f42e17 100644 (file)
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -464,9 +464,8 @@ WERROR _svcctl_EnumServicesStatusW(pipes_struct *p,
                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                        return ntstatus_to_werror(ndr_map_error2ntstatus(ndr_err));
                }
-
                blob = ndr_push_blob(ndr);
-               memcpy(r->out.service, blob.data, r->in.offered);
+               memcpy(r->out.service, blob.data, MIN(blob.length, r->in.offered));
        }
 
        *r->out.needed                  = (buffer_size > r->in.offered) ? buffer_size : r->in.offered;