s3: avoid reading past the end of buffer in tdb_unpack 'f' if zero termination is...

Signed-off-by: Michael Adam <obnox@samba.org>

diff --git a/source3/lib/util_tdb.c b/source3/lib/util_tdb.c
index 65e46119b4f7a4cc78ef26eb44e39d885013e04f..fb586f45d2f647ee13275e6a4710c32557c3cbdd 100644 (file)
--- a/source3/lib/util_tdb.c
+++ b/source3/lib/util_tdb.c
@@ -417,7 +417,7 @@ int tdb_unpack(const uint8 *buf, int bufsize, const char *fmt, ...)
                        break;
                case 'f': /* null-terminated string */
                        s = va_arg(ap,char *);
-                       len = strlen((const char *)buf) + 1;
+                       len = strnlen((const char *)buf, bufsize) + 1;
                        if (bufsize < len || len > sizeof(fstring))
                                goto no_space;
                        memcpy(s, buf, len);