torture: Provide enough space for test EA name in raw.eas test
authorAndrew Bartlett <abartlet@samba.org>
Tue, 2 Sep 2014 02:38:11 +0000 (14:38 +1200)
committerAndrew Bartlett <abartlet@samba.org>
Thu, 11 Sep 2014 06:50:16 +0000 (08:50 +0200)
The issue is that previously bad_ea_name[5] was the last element on
the array, and so when we later did a strlen() on it, we read past the
end of the stack array.  We need bad_ea_name[5] to be the second-last
element, followed by the \0 placed there by the strlcpy().

Found by AddressSanitizer

Change-Id: I871c08200aa2591c612dfa44da92b83132f83d88
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Kamen Mazdrashki <kamenim@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Sep 11 08:50:16 CEST 2014 on sn-devel-104

source4/torture/raw/eas.c

index 95a55d1ecf5805e0d1075568f4768e1177a1d590..15bfb2f072ec66c0aadb726537b45817dcb73483 100644 (file)
@@ -51,7 +51,7 @@ static bool test_eas(struct smbcli_state *cli, struct torture_context *tctx)
        union smb_open io;
        const char *fname = BASEDIR "\\ea.txt";
        bool ret = true;
-       char bad_ea_name[6];
+       char bad_ea_name[7];
        int i;
        int fnum = -1;