s3: avoid reading past the end of buffer in tdb_unpack 'P' if zero termination is...

Signed-off-by: Michael Adam <obnox@samba.org>

diff --git a/source3/lib/util_tdb.c b/source3/lib/util_tdb.c
index ade46bf18ec86b89ebbdb9b1d445c06af76e70e0..65e46119b4f7a4cc78ef26eb44e39d885013e04f 100644 (file)
--- a/source3/lib/util_tdb.c
+++ b/source3/lib/util_tdb.c
@@ -410,7 +410,9 @@ int tdb_unpack(const uint8 *buf, int bufsize, const char *fmt, ...)
                case 'P': /* null-terminated string */
                        /* Return malloc'ed string. */
                        ps = va_arg(ap,char **);
-                       len = strlen((const char *)buf) + 1;
+                       len = strnlen((const char *)buf, bufsize) + 1;
+                       if (bufsize < len)
+                               goto no_space;
                        *ps = SMB_STRDUP((const char *)buf);
                        break;
                case 'f': /* null-terminated string */