fix 'Invalid read of size 1' in reply_search

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index c796c00ff19d36ed3222f68b9dc7b14b2648e8cb..c43713555bf3d425a03dccce82ac2a6ed9c43f69 100644 (file)
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -1607,7 +1607,7 @@ void reply_search(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
        char *path = NULL;
-       const char *mask = NULL;
+       char *mask = NULL;
        char *directory = NULL;
        struct smb_filename *smb_fname = NULL;
        char *fname = NULL;
@@ -1688,11 +1688,11 @@ void reply_search(struct smb_request *req)
 
                p = strrchr_m(directory,'/');
                if ((p != NULL) && (*directory != '/')) {
-                       mask = p + 1;
+                       mask = talloc_strdup(ctx, p + 1);
                        directory = talloc_strndup(ctx, directory,
                                                   PTR_DIFF(p, directory));
                } else {
-                       mask = directory;
+                       mask = talloc_strdup(ctx, directory);
                        directory = talloc_strdup(ctx,".");
                }
 
@@ -1741,7 +1741,7 @@ void reply_search(struct smb_request *req)
                        goto out;
                }
 
-               mask = dptr_wcard(sconn, dptr_num);
+               mask = talloc_strdup(ctx, dptr_wcard(sconn, dptr_num));
                if (!mask) {
                        goto SearchEmpty;
                }
@@ -1880,6 +1880,7 @@ void reply_search(struct smb_request *req)
                maxentries ));
  out:
        TALLOC_FREE(directory);
+       TALLOC_FREE(mask);
        TALLOC_FREE(smb_fname);
        END_PROFILE(SMBsearch);
        return;