nt5rc2 falling over because the LsaQueryInfoPolicy() response _must_

have the string max length = string length + 1.

if not, then it gets its knickers in a twist over whether the string
is NULL-terminated or not.

four days.

four days i spent on this one.
(This used to be commit 9795e5948c698115e34c28993cdb82ba31377f5d)

diff --git a/source3/lsarpcd/srv_lsa.c b/source3/lsarpcd/srv_lsa.c
index 7bc5841cfc9fae22a458ca89799019b4d792bacd..b1761219afcbb1685154793aed36f67ff107161b 100644 (file)
--- a/source3/lsarpcd/srv_lsa.c
+++ b/source3/lsarpcd/srv_lsa.c
@@ -88,14 +88,15 @@ static void make_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
        fstring sid_str;
        int domlen = strlen(dom_name);
 
+       d_q->uni_dom_str_len = (domlen+1) * 2;
        d_q->uni_dom_max_len = domlen * 2;
-       d_q->uni_dom_str_len = domlen * 2;
 
        d_q->buffer_dom_name = domlen  != 0    ? 1 : 0; /* domain buffer pointer */
        d_q->buffer_dom_sid  = dom_sid != NULL ? 1 : 0; /* domain sid pointer */
 
        /* this string is supposed to be character short */
        make_unistr2(&(d_q->uni_domain_name), dom_name, domlen);
+       d_q->uni_domain_name.uni_max_len++;
 
        sid_to_string(sid_str, dom_sid);
        make_dom_sid2(&(d_q->dom_sid), dom_sid);

diff --git a/source3/rpc_parse/parse_lsa.c b/source3/rpc_parse/parse_lsa.c
index 57c22e88cbd07d5784106521e6559d52c2a3e391..596b1cb0457cd130eef87f9b0fa788d138e4a130 100644 (file)
--- a/source3/rpc_parse/parse_lsa.c
+++ b/source3/rpc_parse/parse_lsa.c
@@ -105,6 +105,7 @@ static BOOL lsa_io_dom_r_ref(char *desc,  DOM_R_REF *r_r, prs_struct *ps, int de
                        {
                                slprintf(t, sizeof(t) - 1, "dom_ref[%d] ", i);
                                smb_io_unistr2(t, &(r_r->ref_dom[n].uni_dom_name), True, ps, depth); /* domain name unicode string */
+                               prs_align(ps);
                                n++;
                        }
 

diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c
index 7bc5841cfc9fae22a458ca89799019b4d792bacd..b1761219afcbb1685154793aed36f67ff107161b 100644 (file)
--- a/source3/rpc_server/srv_lsa.c
+++ b/source3/rpc_server/srv_lsa.c
@@ -88,14 +88,15 @@ static void make_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
        fstring sid_str;
        int domlen = strlen(dom_name);
 
+       d_q->uni_dom_str_len = (domlen+1) * 2;
        d_q->uni_dom_max_len = domlen * 2;
-       d_q->uni_dom_str_len = domlen * 2;
 
        d_q->buffer_dom_name = domlen  != 0    ? 1 : 0; /* domain buffer pointer */
        d_q->buffer_dom_sid  = dom_sid != NULL ? 1 : 0; /* domain sid pointer */
 
        /* this string is supposed to be character short */
        make_unistr2(&(d_q->uni_domain_name), dom_name, domlen);
+       d_q->uni_domain_name.uni_max_len++;
 
        sid_to_string(sid_str, dom_sid);
        make_dom_sid2(&(d_q->dom_sid), dom_sid);