util/charset/convert_string: always set length
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Fri, 10 May 2019 03:35:32 +0000 (15:35 +1200)
committerAndrew Bartlett <abartlet@samba.org>
Wed, 15 May 2019 04:03:37 +0000 (04:03 +0000)
In failure cases the destination string pointer is set to NULL, but
the size is not changed. Some callers have not been checking the
return value and passing the destination pointer and uninitialised
length onto other functions. We can curse and blame those callers, but
let's also keep them safe.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
lib/util/charset/convert_string.c

index 196302a..4197065 100644 (file)
@@ -357,6 +357,9 @@ bool convert_string_talloc_handle(TALLOC_CTX *ctx, struct smb_iconv_handle *ic,
        void **dest = (void **)dst;
 
        *dest = NULL;
+       if (converted_size != NULL) {
+               *converted_size = 0;
+       }
 
        if (src == NULL || srclen == (size_t)-1) {
                errno = EINVAL;