Address the string_sub problem by changing len = 0 to mean "no expand".

Went through and checked all string_subs I could to ensure they're being
used correctly.
Jeremy.
(This used to be commit 17cae0d683be404be69554cd0e84117bdcc56c87)

diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c
index 9997507757106ab1396c6d2606292e51f44ee450..f9f250c26ae2b1dc09e13386fae5776bdc3ad3a4 100644 (file)
--- a/source3/auth/auth_domain.c
+++ b/source3/auth/auth_domain.c
@@ -69,7 +69,7 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli,
                fstrcpy(remote_machine, server);
        }
 
-       standard_sub_basic(current_user_info.smb_name, remote_machine);
+       standard_sub_basic(current_user_info.smb_name, remote_machine, sizeof(remote_machine));
        strupper(remote_machine);
 
        if(!resolve_name( remote_machine, &dest_ip, 0x20)) {

diff --git a/source3/auth/auth_server.c b/source3/auth/auth_server.c
index 919cc8d3d8f64de9a64df6722d3198be300c5798..23faedc0bac91bde554256783aa6306b8fa46971 100644 (file)
--- a/source3/auth/auth_server.c
+++ b/source3/auth/auth_server.c
@@ -49,7 +49,7 @@ static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
        p = pserver;
 
         while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
-               standard_sub_basic(current_user_info.smb_name, desthost);
+               standard_sub_basic(current_user_info.smb_name, desthost, sizeof(desthost));
                strupper(desthost);
 
                if(!resolve_name( desthost, &dest_ip, 0x20)) {

diff --git a/source3/auth/pampass.c b/source3/auth/pampass.c
index 211e8bce1570f6d9b7324eaede8098fdcff64c7a..1a3e55dd44f48fba59bf23b4385e8cadd1cd55b7 100644 (file)
--- a/source3/auth/pampass.c
+++ b/source3/auth/pampass.c
@@ -186,7 +186,7 @@ static void special_char_sub(char *buf)
 
 static void pwd_sub(char *buf, const char *username, const char *oldpass, const char *newpass)
 {
-       pstring_sub(buf, "%u", username);
+       fstring_sub(buf, "%u", username);
        all_string_sub(buf, "%o", oldpass, sizeof(fstring));
        all_string_sub(buf, "%n", newpass, sizeof(fstring));
 }

diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c
index 439263dd23a7b9388087637cb137403954ee7d6c..dbd382a9424938cee15ae0c778b0a80a467d9326 100644 (file)
--- a/source3/lib/substitute.c
+++ b/source3/lib/substitute.c
@@ -160,9 +160,11 @@ static char *automount_server(const char *user_name)
 
 /****************************************************************************
  Do some standard substitutions in a string.
+ len is the length in bytes of the space allowed in string str. If zero means
+ don't allow expansions.
 ****************************************************************************/
 
-void standard_sub_basic(const char *smb_name, char *str)
+void standard_sub_basic(const char *smb_name, char *str,size_t len)
 {
        char *p, *s;
        fstring pidstr;
@@ -171,7 +173,10 @@ void standard_sub_basic(const char *smb_name, char *str)
        for (s=str; (p=strchr_m(s, '%'));s=p) {
                fstring tmp_str;
 
-               int l = sizeof(pstring) - (int)(p-str);
+               int l = (int)len - (int)(p-str);
+
+               if (l < 0)
+                       l = 0;
                
                switch (*(p+1)) {
                case 'U' : 
@@ -192,26 +197,43 @@ void standard_sub_basic(const char *smb_name, char *str)
                        strupper(tmp_str);
                        string_sub(p,"%D", tmp_str,l);
                        break;
-               case 'I' : string_sub(p,"%I", client_addr(),l); break;
+               case 'I' :
+                       string_sub(p,"%I", client_addr(),l);
+                       break;
                case 'L' : 
-                       if (*local_machine) {
+                       if (*local_machine)
                                string_sub(p,"%L", local_machine,l); 
-                       } else {
+                       else
                                string_sub(p,"%L", global_myname,l); 
-                       }
                        break;
-               case 'M' : string_sub(p,"%M", client_name(),l); break;
-               case 'R' : string_sub(p,"%R", remote_proto,l); break;
-               case 'T' : string_sub(p,"%T", timestring(False),l); break;
-               case 'a' : string_sub(p,"%a", remote_arch,l); break;
+               case 'M' :
+                       string_sub(p,"%M", client_name(),l);
+                       break;
+               case 'R' :
+                       string_sub(p,"%R", remote_proto,l);
+                       break;
+               case 'T' :
+                       string_sub(p,"%T", timestring(False),l);
+                       break;
+               case 'a' :
+                       string_sub(p,"%a", remote_arch,l);
+                       break;
                case 'd' :
                        slprintf(pidstr,sizeof(pidstr)-1, "%d",(int)sys_getpid());
                        string_sub(p,"%d", pidstr,l);
                        break;
-               case 'h' : string_sub(p,"%h", myhostname(),l); break;
-               case 'm' : string_sub(p,"%m", remote_machine,l); break;
-               case 'v' : string_sub(p,"%v", VERSION,l); break;
-               case '$' : p += expand_env_var(p,l); break; /* Expand environment variables */
+               case 'h' :
+                       string_sub(p,"%h", myhostname(),l);
+                       break;
+               case 'm' :
+                       string_sub(p,"%m", remote_machine,l);
+                       break;
+               case 'v' :
+                       string_sub(p,"%v", VERSION,l);
+                       break;
+               case '$' :
+                       p += expand_env_var(p,l);
+                       break; /* Expand environment variables */
                case '\0': 
                        p++; 
                        break; /* don't run off the end of the string */
@@ -228,30 +250,32 @@ void standard_sub_basic(const char *smb_name, char *str)
 
 static void standard_sub_advanced(int snum, const char *user, 
                                  const char *connectpath, gid_t gid, 
-                                 const char *smb_name, char *str)
+                                 const char *smb_name, char *str, size_t len)
 {
        char *p, *s, *home;
 
        for (s=str; (p=strchr_m(s, '%'));s=p) {
-               int l = sizeof(pstring) - (int)(p-str);
-               
+               int l = (int)len - (int)(p-str);
+       
+               if (l < 0)
+                       l = 0;
+       
                switch (*(p+1)) {
-               case 'N' : string_sub(p,"%N", automount_server(user),l); break;
+               case 'N' :
+                       string_sub(p,"%N", automount_server(user),l);
+                       break;
                case 'H':
-                       if ((home = get_user_home_dir(user))) {
+                       if ((home = get_user_home_dir(user)))
                                string_sub(p,"%H",home, l);
-                       } else {
+                       else
                                p += 2;
-                       }
                        break;
                case 'P': 
                        string_sub(p,"%P", connectpath, l); 
                        break;
-                       
                case 'S': 
                        string_sub(p,"%S", lp_servicename(snum), l); 
                        break;
-                       
                case 'g': 
                        string_sub(p,"%g", gidtoname(gid), l); 
                        break;
@@ -278,7 +302,7 @@ static void standard_sub_advanced(int snum, const char *user,
                }
        }
 
-       standard_sub_basic(smb_name, str);
+       standard_sub_basic(smb_name, str, len);
 }
 
 const char *standard_sub_specified(TALLOC_CTX *mem_ctx, const char *input_string,
@@ -328,8 +352,7 @@ const char *standard_sub_specified(TALLOC_CTX *mem_ctx, const char *input_string
                }
        }
 
-       standard_sub_basic(username, input_pstring);
-       
+       standard_sub_basic(username, input_pstring, sizeof(pstring));
        return talloc_strdup(mem_ctx, input_pstring);
 }
 
@@ -337,16 +360,17 @@ const char *standard_sub_specified(TALLOC_CTX *mem_ctx, const char *input_string
  Do some standard substitutions in a string.
 ****************************************************************************/
 
-void standard_sub_conn(connection_struct *conn, char *str)
+void standard_sub_conn(connection_struct *conn, char *str, size_t len)
 {
-       standard_sub_advanced(SNUM(conn), conn->user, conn->connectpath, conn->gid, current_user_info.smb_name, str);
+       standard_sub_advanced(SNUM(conn), conn->user, conn->connectpath,
+                       conn->gid, current_user_info.smb_name, str, len);
 }
 
 /****************************************************************************
  Like standard_sub but by snum.
 ****************************************************************************/
 
-void standard_sub_snum(int snum, char *str)
+void standard_sub_snum(int snum, char *str, size_t len)
 {
        extern struct current_user current_user;
        static uid_t cached_uid = -1;
@@ -359,6 +383,6 @@ void standard_sub_snum(int snum, char *str)
                cached_uid = current_user.uid;
        }
 
-       standard_sub_advanced(snum, cached_user, "", -1, current_user_info.smb_name, str);
+       standard_sub_advanced(snum, cached_user, "", -1,
+               current_user_info.smb_name, str, len);
 }
-

diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index eac3ebe929b519902e1edf9c27c0e3d436e74835..9b4282c6e013820a5737068b88a7a10b41fc0d4e 100644 (file)
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -650,23 +650,30 @@ This routine looks for pattern in s and replaces it with
 insert. It may do multiple replacements.
 
 any of " ; ' $ or ` in the insert string are replaced with _
-if len==0 then no length check is performed
+if len==0 then the string cannot be extended. This is different from the old
+use of len==0 which was for no length checks to be done.
 ****************************************************************************/
+
 void string_sub(char *s,const char *pattern,const char *insert, size_t len)
 {
        char *p;
        ssize_t ls,lp,li, i;
 
-       if (!insert || !pattern || !s) return;
+       if (!insert || !pattern || !s)
+               return;
 
        ls = (ssize_t)strlen(s);
        lp = (ssize_t)strlen(pattern);
        li = (ssize_t)strlen(insert);
 
-       if (!*pattern) return;
+       if (!*pattern)
+               return;
+
+       if (len == 0)
+               len = ls;
        
        while (lp <= ls && (p = strstr(s,pattern))) {
-               if (len && (ls + (li-lp) >= len)) {
+               if (ls + (li-lp) >= len) {
                        DEBUG(0,("ERROR: string overflow by %d in string_sub(%.50s, %d)\n", 
                                 (int)(ls + (li-lp) - len),
                                 pattern, (int)len));
@@ -709,23 +716,30 @@ void pstring_sub(char *s,const char *pattern,const char *insert)
 /****************************************************************************
 similar to string_sub() but allows for any character to be substituted. 
 Use with caution!
-if len==0 then no length check is performed
+if len==0 then the string cannot be extended. This is different from the old
+use of len==0 which was for no length checks to be done.
 ****************************************************************************/
+
 void all_string_sub(char *s,const char *pattern,const char *insert, size_t len)
 {
        char *p;
        ssize_t ls,lp,li;
 
-       if (!insert || !pattern || !s) return;
+       if (!insert || !pattern || !s)
+               return;
 
        ls = (ssize_t)strlen(s);
        lp = (ssize_t)strlen(pattern);
        li = (ssize_t)strlen(insert);
 
-       if (!*pattern) return;
+       if (!*pattern)
+               return;
+       
+       if (len == 0)
+               len = ls;
        
        while (lp <= ls && (p = strstr(s,pattern))) {
-               if (len && (ls + (li-lp) >= len)) {
+               if (ls + (li-lp) >= len) {
                        DEBUG(0,("ERROR: string overflow by %d in all_string_sub(%.50s, %d)\n", 
                                 (int)(ls + (li-lp) - len),
                                 pattern, (int)len));
@@ -743,10 +757,8 @@ void all_string_sub(char *s,const char *pattern,const char *insert, size_t len)
 /****************************************************************************
 similar to all_string_sub but for unicode strings.
 return a new allocate unicode string.
-len is the number of bytes, not chars
   similar to string_sub() but allows for any character to be substituted.
   Use with caution!
-  if len==0 then no length check is performed
 ****************************************************************************/
 
 smb_ucs2_t *all_string_sub_w(const smb_ucs2_t *s, const smb_ucs2_t *pattern,

diff --git a/source3/msdfs/msdfs.c b/source3/msdfs/msdfs.c
index 1af848b55ae7d69b09e7e97a42eebf442e4e73ec..3e66c1c10ca0eca36f3709d8e9cdf94edf6c76d7 100644 (file)
--- a/source3/msdfs/msdfs.c
+++ b/source3/msdfs/msdfs.c
@@ -80,13 +80,12 @@ static BOOL parse_dfs_path(char* pathname, struct dfs_path* pdp)
  Fake up a connection struct for the VFS layer.
 *********************************************************/
 
-static BOOL create_conn_struct( connection_struct *conn, int snum,
-                               char *path)
+static BOOL create_conn_struct( connection_struct *conn, int snum, char *path)
 {
        ZERO_STRUCTP(conn);
        conn->service = snum;
        conn->connectpath = path;
-       pstring_sub(conn->connectpath, "%S", lp_servicename(snum));
+       pstring_sub(conn->connectpath , "%S", lp_servicename(snum));
 
        if (!smbd_vfs_init(conn)) {
                DEBUG(0,("create_conn_struct: smbd_vfs_init failed.\n"));
@@ -335,6 +334,7 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn,
 
        struct connection_struct conns;
        struct connection_struct* conn = &conns;
+       pstring conn_path;
        int snum;
 
        BOOL self_referral = False;
@@ -371,7 +371,8 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn,
                        return False;
        }
        
-       if (!create_conn_struct(conn, snum, lp_pathname(snum)))
+       pstrcpy(conn_path, lp_pathname(snum));
+       if (!create_conn_struct(conn, snum, conn_path))
                return False;
        
        if (!lp_msdfs_root(SNUM(conn))) {
@@ -701,10 +702,12 @@ BOOL create_junction(char* pathname, struct junction_map* jn)
 /**********************************************************************
  Forms a valid Unix pathname from the junction 
  **********************************************************************/
+
 static BOOL junction_to_local_path(struct junction_map* jn, char* path,
                                   int max_pathlen, connection_struct *conn)
 {
        int snum;
+       pstring conn_path;
 
        if(!path || !jn)
                return False;
@@ -718,7 +721,8 @@ static BOOL junction_to_local_path(struct junction_map* jn, char* path,
        strlower(jn->volume_name);
        safe_strcat(path, jn->volume_name, max_pathlen-1);
 
-       if (!create_conn_struct(conn, snum, lp_pathname(snum)))
+       pstrcpy(conn_path, lp_pathname(snum));
+       if (!create_conn_struct(conn, snum, conn_path))
                return False;
 
        return True;

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 5051d67d34b1805c9c22c9c6cb38547363e7c45e..e8f5d84d3cc70d9201ea584a657d06bc86844299 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -1409,7 +1409,7 @@ static char *lp_string(const char *s)
 
        trim_string(ret, "\"", "\"");
 
-       standard_sub_basic(current_user_info.smb_name,ret);
+       standard_sub_basic(current_user_info.smb_name,ret,len+100);
        return (ret);
 }
 
@@ -2263,7 +2263,7 @@ BOOL lp_file_list_changed(void)
                time_t mod_time;
 
                pstrcpy(n2, f->name);
-               standard_sub_basic(current_user_info.smb_name, n2);
+               standard_sub_basic(current_user_info.smb_name, n2,sizeof(n2));
 
                DEBUGADD(6, ("file %s -> %s  last mod_time: %s\n",
                             f->name, n2, ctime(&f->modtime)));
@@ -2296,7 +2296,7 @@ static BOOL handle_netbios_name(char *pszParmValue, char **ptr)
 
        pstrcpy(netbios_name, pszParmValue);
 
-       standard_sub_basic(current_user_info.smb_name, netbios_name);
+       standard_sub_basic(current_user_info.smb_name, netbios_name,sizeof(netbios_name));
        strupper(netbios_name);
 
        pstrcpy(global_myname, netbios_name);
@@ -2378,7 +2378,7 @@ static BOOL handle_source_env(char *pszParmValue, char **ptr)
 
        pstrcpy(fname, pszParmValue);
 
-       standard_sub_basic(current_user_info.smb_name, fname);
+       standard_sub_basic(current_user_info.smb_name, fname,sizeof(fname));
 
        string_set(ptr, pszParmValue);
 
@@ -2436,7 +2436,7 @@ static BOOL handle_include(char *pszParmValue, char **ptr)
        pstring fname;
        pstrcpy(fname, pszParmValue);
 
-       standard_sub_basic(current_user_info.smb_name, fname);
+       standard_sub_basic(current_user_info.smb_name, fname,sizeof(fname));
 
        add_to_file_list(pszParmValue, fname);
 
@@ -3518,7 +3518,7 @@ BOOL lp_load(const char *pszFname, BOOL global_only, BOOL save_defaults,
        param_opt_struct *data, *pdata;
 
        pstrcpy(n2, pszFname);
-       standard_sub_basic(current_user_info.smb_name, n2);
+       standard_sub_basic(current_user_info.smb_name, n2,sizeof(n2));
 
        add_to_file_list(pszFname, n2);
 
@@ -3653,7 +3653,7 @@ int lp_servicenumber(const char *pszServiceName)
                         * service names
                         */
                        fstrcpy(serviceName, ServicePtrs[iService]->szService);
-                       standard_sub_basic(current_user_info.smb_name, serviceName);
+                       standard_sub_basic(current_user_info.smb_name, serviceName,sizeof(serviceName));
                        if (strequal(serviceName, pszServiceName))
                                break;
                }

diff --git a/source3/printing/lpq_parse.c b/source3/printing/lpq_parse.c
index 9d8b1cc2aa3d2b4bf9f61d1f5b71e76c050273bf..5deb85425ee233483c23365ea51dd66a2683b5e7 100644 (file)
--- a/source3/printing/lpq_parse.c
+++ b/source3/printing/lpq_parse.c
@@ -314,7 +314,7 @@ static BOOL parse_lpq_aix(char *line,print_queue_struct *buf,BOOL first)
   int count=0;
 
   /* handle the case of "(standard input)" as a filename */
-  pstring_sub(line,"standard input","STDIN");
+  string_sub(line,"standard input","STDIN",0);
   all_string_sub(line,"(","\"",0);
   all_string_sub(line,")","\"",0);
 
@@ -431,7 +431,7 @@ static BOOL parse_lpq_hpux(char * line, print_queue_struct *buf, BOOL first)
     }
     if (!header_line_ok) return (False); /* incorrect header line */
     /* handle the case of "(standard input)" as a filename */
-    pstring_sub(line,"standard input","STDIN");
+    string_sub(line,"standard input","STDIN",0);
     all_string_sub(line,"(","\"",0);
     all_string_sub(line,")","\"",0);
     
@@ -469,7 +469,7 @@ static BOOL parse_lpq_hpux(char * line, print_queue_struct *buf, BOOL first)
     else if (base_prio) base_prio_reset=False;
     
     /* handle the dash in the job id */
-    pstring_sub(line,"-"," ");
+    string_sub(line,"-"," ",0);
     
     for (count=0; count<12 && next_token(&line,tok[count],NULL,sizeof(tok[count])); count++) ;
       
@@ -593,14 +593,14 @@ static BOOL parse_lpq_qnx(char *line,print_queue_struct *buf,BOOL first)
   DEBUG(4,("antes [%s]\n", line));
 
   /* handle the case of "-- standard input --" as a filename */
-  pstring_sub(line,"standard input","STDIN");
+  string_sub(line,"standard input","STDIN",0);
   DEBUG(4,("despues [%s]\n", line));
   all_string_sub(line,"-- ","\"",0);
   all_string_sub(line," --","\"",0);
   DEBUG(4,("despues 1 [%s]\n", line));
 
-  pstring_sub(line,"[job #","");
-  pstring_sub(line,"]","");
+  string_sub(line,"[job #","",0);
+  string_sub(line,"]","",0);
   DEBUG(4,("despues 2 [%s]\n", line));
 
   
@@ -656,7 +656,7 @@ static BOOL parse_lpq_plp(char *line,print_queue_struct *buf,BOOL first)
   int count=0;
 
   /* handle the case of "(standard input)" as a filename */
-  pstring_sub(line,"stdin","STDIN");
+  string_sub(line,"stdin","STDIN",0);
   all_string_sub(line,"(","\"",0);
   all_string_sub(line,")","\"",0);
   
@@ -726,7 +726,7 @@ static BOOL parse_lpq_softq(char *line,print_queue_struct *buf,BOOL first)
   int count=0;
 
   /* mung all the ":"s to spaces*/
-  pstring_sub(line,":"," ");
+  string_sub(line,":"," ",0);
   
   for (count=0; count<10 && next_token(&line,tok[count],NULL,sizeof(tok[count])); count++) ;
 

diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c
index e1517c5dcb88a41172b30c9bdcfdd7169d9bbe68..a32521c721b42bcc2372e969d6a77afe59ba334f 100644 (file)
--- a/source3/printing/print_generic.c
+++ b/source3/printing/print_generic.c
@@ -78,7 +78,7 @@ static int print_run_command(int snum,char *command, int *outfd, ...)
        p = PRINTERNAME(snum);
   
        pstring_sub(syscmd, "%p", p);
-       standard_sub_snum(snum,syscmd);
+       standard_sub_snum(snum,syscmd,sizeof(syscmd));
 
        ret = smbrun(syscmd,outfd);
 

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 7e793c1e1da045cbbbe4de00cd5baffe1d3377a8..9b17bdb7ee58ee7bf9bbd5b0897876a04a3fcc77 100644 (file)
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -5051,7 +5051,7 @@ static BOOL add_printer_hook(NT_PRINTER_INFO_LEVEL *printer)
                        get_called_name());
        /* change \ to \\ for the shell */
        all_string_sub(driverlocation,"\\","\\\\",sizeof(pstring));
-       standard_sub_basic(current_user_info.smb_name, remote_machine);
+       standard_sub_basic(current_user_info.smb_name, remote_machine,sizeof(remote_machine));
        
        slprintf(command, sizeof(command)-1, "%s \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\"",
                        cmd, printer->info_2->printername, printer->info_2->sharename,

diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index e8fe603ed87b4e8422e874310f2fb46ab6118efa..b5f6bd2f0776bfe1b51590d643e38886f1bfc3cf 100644 (file)
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -41,7 +41,7 @@ static void init_srv_share_info_1(pipes_struct *p, SRV_SHARE_INFO_1 *sh1, int sn
 
        pstrcpy(net_name, lp_servicename(snum));
        pstrcpy(remark, lp_comment(snum));
-       standard_sub_conn(p->conn, remark);
+       standard_sub_conn(p->conn, remark,sizeof(remark));
        len_net_name = strlen(net_name);
 
        /* work out the share type */
@@ -73,7 +73,7 @@ static void init_srv_share_info_2(pipes_struct *p, SRV_SHARE_INFO_2 *sh2, int sn
 
        pstrcpy(net_name, lp_servicename(snum));
        pstrcpy(remark, lp_comment(snum));
-       standard_sub_conn(p->conn, remark);
+       standard_sub_conn(p->conn, remark,sizeof(remark));
        pstrcpy(path, "C:");
        pstrcat(path, lp_pathname(snum));
 
@@ -357,7 +357,7 @@ static void init_srv_share_info_501(pipes_struct *p, SRV_SHARE_INFO_501 *sh501,
 
        pstrcpy(net_name, lp_servicename(snum));
        pstrcpy(remark, lp_comment(snum));
-       standard_sub_conn(p->conn, remark);
+       standard_sub_conn(p->conn, remark, sizeof(remark));
 
        len_net_name = strlen(net_name);
 
@@ -396,7 +396,7 @@ static void init_srv_share_info_502(pipes_struct *p, SRV_SHARE_INFO_502 *sh502,
 
        pstrcpy(net_name, lp_servicename(snum));
        pstrcpy(remark, lp_comment(snum));
-       standard_sub_conn(p->conn, remark);
+       standard_sub_conn(p->conn, remark,sizeof(remark));
        pstrcpy(path, "C:");
        pstrcat(path, lp_pathname(snum));
 

diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 3eca6695d22b0d2b99126af82f3d18c291a83664..217bb6a61335eb5fe5f4223739d18daaf139e45c 100644 (file)
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -71,7 +71,7 @@ static int CopyExpanded(connection_struct *conn,
 
        StrnCpy(buf,src,sizeof(buf)/2);
        pstring_sub(buf,"%S",lp_servicename(snum));
-       standard_sub_conn(conn,buf);
+       standard_sub_conn(conn,buf,sizeof(buf));
        l = push_ascii(*dst,buf,*n-1, STR_TERMINATE);
        (*dst) += l;
        (*n) -= l;
@@ -94,7 +94,7 @@ static int StrlenExpanded(connection_struct *conn, int snum, char* s)
        if (!s) return(0);
        StrnCpy(buf,s,sizeof(buf)/2);
        pstring_sub(buf,"%S",lp_servicename(snum));
-       standard_sub_conn(conn,buf);
+       standard_sub_conn(conn,buf,sizeof(buf));
        return strlen(buf) + 1;
 }
 
@@ -104,7 +104,7 @@ static char* Expand(connection_struct *conn, int snum, char* s)
        if (!s) return(NULL);
        StrnCpy(buf,s,sizeof(buf)/2);
        pstring_sub(buf,"%S",lp_servicename(snum));
-       standard_sub_conn(conn,buf);
+       standard_sub_conn(conn,buf,sizeof(buf));
        return &buf[0];
 }
 
@@ -2451,7 +2451,7 @@ static BOOL api_RNetServerGetInfo(connection_struct *conn,uint16 vuid, char *par
        SIVAL(p,6,0);
       } else {
        SIVAL(p,6,PTR_DIFF(p2,*rdata));
-       standard_sub_conn(conn,comment);
+       standard_sub_conn(conn,comment,sizeof(comment));
        StrnCpy(p2,comment,MAX(mdrcnt - struct_len,0));
        p2 = skip_string(p2,1);
       }
@@ -2860,7 +2860,7 @@ static BOOL api_RNetUserGetInfo(connection_struct *conn,uint16 vuid, char *param
                        SSVALS(p,104,-1);       /* num_logons */
                        SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
                        pstrcpy(p2,"\\\\%L");
-                       standard_sub_conn(conn, p2);
+                       standard_sub_conn(conn, p2,0);
                        p2 = skip_string(p2,1);
                        SSVAL(p,110,49);        /* country_code */
                        SSVAL(p,112,860);       /* code page */

diff --git a/source3/smbd/message.c b/source3/smbd/message.c
index c2eb16c99e24eff000d46b760541d50c3a1d4157..ba646f12aa0be6b09f7250b3b40d8b4222df4111 100644 (file)
--- a/source3/smbd/message.c
+++ b/source3/smbd/message.c
@@ -85,7 +85,7 @@ static void msg_deliver(void)
       pstrcpy(s,lp_msg_command());
       pstring_sub(s,"%f",alpha_strcpy(alpha_msgfrom,msgfrom,NULL,sizeof(alpha_msgfrom)));
       pstring_sub(s,"%t",alpha_strcpy(alpha_msgto,msgto,NULL,sizeof(alpha_msgto)));
-      standard_sub_basic(current_user_info.smb_name, s);
+      standard_sub_basic(current_user_info.smb_name, s, sizeof(s));
       pstring_sub(s,"%s",name);
       smbrun(s,NULL);
     }

diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 590e4cedfc8f02822b7b413bcbca3be992b00934..0fec7b24a947b5f1c7b115abbbfe141f441abc15 100644 (file)
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -518,7 +518,7 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser,
        {
                pstring s;
                pstrcpy(s,lp_pathname(snum));
-               standard_sub_conn(conn,s);
+               standard_sub_conn(conn,s,sizeof(s));
                string_set(&conn->connectpath,s);
                DEBUG(3,("Connect path is %s\n",s));
        }
@@ -584,7 +584,7 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser,
                int ret;
                pstring cmd;
                pstrcpy(cmd,lp_rootpreexec(SNUM(conn)));
-               standard_sub_conn(conn,cmd);
+               standard_sub_conn(conn,cmd,sizeof(cmd));
                DEBUG(5,("cmd=%s\n",cmd));
                ret = smbrun(cmd,NULL);
                if (ret != 0 && lp_rootpreexec_close(SNUM(conn))) {
@@ -613,7 +613,7 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser,
                int ret;
                pstring cmd;
                pstrcpy(cmd,lp_preexec(SNUM(conn)));
-               standard_sub_conn(conn,cmd);
+               standard_sub_conn(conn,cmd,sizeof(cmd));
                ret = smbrun(cmd,NULL);
                if (ret != 0 && lp_preexec_close(SNUM(conn))) {
                        DEBUG(1,("preexec gave %d - failing connection\n", ret));
@@ -859,7 +859,7 @@ void close_cnum(connection_struct *conn, uint16 vuid)
            change_to_user(conn, vuid))  {
                pstring cmd;
                pstrcpy(cmd,lp_postexec(SNUM(conn)));
-               standard_sub_conn(conn,cmd);
+               standard_sub_conn(conn,cmd,sizeof(cmd));
                smbrun(cmd,NULL);
                change_to_root_user();
        }
@@ -869,7 +869,7 @@ void close_cnum(connection_struct *conn, uint16 vuid)
        if (*lp_rootpostexec(SNUM(conn)))  {
                pstring cmd;
                pstrcpy(cmd,lp_rootpostexec(SNUM(conn)));
-               standard_sub_conn(conn,cmd);
+               standard_sub_conn(conn,cmd,sizeof(cmd));
                smbrun(cmd,NULL);
        }