ldb: Explain why this use of talloc_memdup() is safe

[obnox/samba/samba-obnox.git] / lib / ldb / common / ldb_dn.c

diff --git a/lib/ldb/common/ldb_dn.c b/lib/ldb/common/ldb_dn.c
index dfd3b5844cf04dedd7555017ec158c2ab7f0f1b5..a912fdb2a7337f68c21f00b7ea31ab39e06a1130 100644 (file)
--- a/lib/ldb/common/ldb_dn.c
+++ b/lib/ldb/common/ldb_dn.c
@@ -586,6 +586,12 @@ static bool ldb_dn_explode(struct ldb_dn *dn)
 
                                p++;
                                *d++ = '\0';
+
+                               /*
+                                * This talloc_memdup() is OK with the
+                                * +1 because *d has been set to '\0'
+                                * just above
+                                */
                                dn->components[dn->comp_num].value.data = \
                                        (uint8_t *)talloc_memdup(dn->components, dt, l + 1);
                                dn->components[dn->comp_num].value.length = l;
@@ -708,6 +714,11 @@ static bool ldb_dn_explode(struct ldb_dn *dn)
        }
 
        *d++ = '\0';
+       /*
+        * This talloc_memdup() is OK with the
+        * +1 because *d has been set to '\0'
+        * just above.
+        */
        dn->components[dn->comp_num].value.length = l;
        dn->components[dn->comp_num].value.data =
                (uint8_t *)talloc_memdup(dn->components, dt, l + 1);
@@ -1907,11 +1918,23 @@ int ldb_dn_set_component(struct ldb_dn *dn, int num,
        }
 
        v.length = val.length;
-       v.data = (uint8_t *)talloc_memdup(dn, val.data, v.length+1);
+
+       /*
+        * This is like talloc_memdup(dn, v.data, v.length + 1), but
+        * avoids the over-read
+        */
+       v.data = (uint8_t *)talloc_size(dn, v.length+1);
        if ( ! v.data) {
                talloc_free(n);
                return LDB_ERR_OTHER;
        }
+       memcpy(v.data, val.data, val.length);
+
+       /*
+        * Enforce NUL termination outside the stated length, as is
+        * traditional in LDB
+        */
+       v.data[v.length] = '\0';
 
        talloc_free(dn->components[num].name);
        talloc_free(dn->components[num].value.data);