must add one to the extra_data size to transfer the 0 string terminator.

This was causing "wbinfo --sequence" to access past the end of malloced
memory.
(This used to be commit 4125c582aaf86ee5d92b0c800266543a390aefce)

diff --git a/source3/nsswitch/winbindd_misc.c b/source3/nsswitch/winbindd_misc.c
index 45f2d42f980ae6b51cb91837b5d85c0558bebf13..c2e744c0a7ea51ec3dcd8c386c9750346c24b430 100644 (file)
--- a/source3/nsswitch/winbindd_misc.c
+++ b/source3/nsswitch/winbindd_misc.c
@@ -182,7 +182,8 @@ enum winbindd_result winbindd_show_sequence(struct winbindd_cli_state *state)
        }
 
        state->response.extra_data = extra_data;
-       state->response.length += strlen(extra_data);
+       /* must add one to length to copy the 0 for string termination */
+       state->response.length += strlen(extra_data) + 1;
 
        return WINBINDD_OK;
 }