libcli/security: ace type is not enum not flags

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/libcli/security/sddl.c b/libcli/security/sddl.c
index 6e4cb1085e8890f5822d1544fd4b86e718545d9f..93ff97abe2130eda73940b0480f205ba038c4aaa 100644 (file)
--- a/libcli/security/sddl.c
+++ b/libcli/security/sddl.c
@@ -404,6 +404,7 @@ static bool sddl_decode_ace(TALLOC_CTX *mem_ctx, struct security_ace *ace, char
        uint32_t v;
        struct dom_sid *sid;
        bool ok;
+       size_t len;
 
        ZERO_STRUCTP(ace);
 
@@ -418,9 +419,16 @@ static bool sddl_decode_ace(TALLOC_CTX *mem_ctx, struct security_ace *ace, char
        }
 
        /* parse ace type */
-       if (!sddl_map_flags(ace_types, tok[0], &v, NULL, false)) {
+       ok = sddl_map_flag(ace_types, tok[0], &len, &v);
+       if (!ok) {
+               DBG_WARNING("Unknown ACE type - %s\n", tok[0]);
                return false;
        }
+       if (tok[0][len] != '\0') {
+               DBG_WARNING("Garbage after ACE type - %s\n", tok[0]);
+               return false;
+       }
+
        ace->type = v;
 
        /* ace flags */