Previous fix was incorrect. len in string_sub and all_string_sub is

number of *bytes*. >= check was correct, the len=0 case needed changing
to len = ls + 1.
Jeremy.
(This used to be commit 06a4a6d30ade5ea4d123ae640393677c9a510763)

diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index c1d20ffd2c0a974a6af8a179ccec77a4851f0b64..67d3b2108ed9f07688ae943ba1267bb47a47124d 100644 (file)
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -667,10 +667,10 @@ void string_sub(char *s,const char *pattern, const char *insert, size_t len)
        li = (ssize_t)strlen(insert);
 
        if (len == 0)
-               len = ls;
+               len = ls + 1; /* len is number of *bytes* */
 
        while (lp <= ls && (p = strstr(s,pattern))) {
-               if (ls + (li-lp) > len) {
+               if (ls + (li-lp) >= len) {
                        DEBUG(0,("ERROR: string overflow by %d in string_sub(%.50s, %d)\n", 
                                 (int)(ls + (li-lp) - len),
                                 pattern, (int)len));
@@ -798,10 +798,10 @@ void all_string_sub(char *s,const char *pattern,const char *insert, size_t len)
                return;
        
        if (len == 0)
-               len = ls;
+               len = ls + 1; /* len is number of *bytes* */
        
        while (lp <= ls && (p = strstr(s,pattern))) {
-               if (ls + (li-lp) > len) {
+               if (ls + (li-lp) >= len) {
                        DEBUG(0,("ERROR: string overflow by %d in all_string_sub(%.50s, %d)\n", 
                                 (int)(ls + (li-lp) - len),
                                 pattern, (int)len));