s3-utils: fix format-truncation in smbpasswd

../source3/utils/smbpasswd.c: In function ‘process_root’:
../source3/utils/smbpasswd.c:414:37: error: ‘$’ directive output may be truncated writing 1 byte into a region of size between 0 and 255 [-Werror=format-truncation=]
   slprintf(buf, sizeof(buf) - 1, "%s$", user_name);
                                     ^
In file included from ../source3/include/includes.h:23,
                 from ../source3/utils/smbpasswd.c:19:
../lib/replace/../replace/replace.h:514:18: note: ‘snprintf’ output between 2 and 257 bytes into a destination of size 255
 #define slprintf snprintf
../source3/utils/smbpasswd.c:414:3: note: in expansion of macro ‘slprintf’
   slprintf(buf, sizeof(buf) - 1, "%s$", user_name);
   ^~~~~~~~
../source3/utils/smbpasswd.c:397:35: error: ‘$’ directive output may be truncated writing 1 byte into a region of size between 0 and 255 [-Werror=format-truncation=]
   slprintf(buf, sizeof(buf)-1, "%s$", user_name);
                                   ^
In file included from ../source3/include/includes.h:23,
                 from ../source3/utils/smbpasswd.c:19:
../lib/replace/../replace/replace.h:514:18: note: ‘snprintf’ output between 2 and 257 bytes into a destination of size 255
 #define slprintf snprintf
../source3/utils/smbpasswd.c:397:3: note: in expansion of macro ‘slprintf’
   slprintf(buf, sizeof(buf)-1, "%s$", user_name);
   ^~~~~~~~
cc1: some warnings being treated as errors

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13437

Pair-Programmed-With: Andreas Schneider <asn@samba.org>

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>

diff --git a/source3/utils/smbpasswd.c b/source3/utils/smbpasswd.c
index 3136de6a23dd44ed05f5757c68a64e5914ebb53e..04f34aa9b695e49eed87476d406a1507be9cf4db 100644 (file)
--- a/source3/utils/smbpasswd.c
+++ b/source3/utils/smbpasswd.c
@@ -368,36 +368,44 @@ static int process_root(int local_flags)
 
        if (local_flags & LOCAL_TRUST_ACCOUNT) {
                /* add the $ automatically */
-               static fstring buf;
+               size_t user_name_len = strlen(user_name);
 
-               /*
-                * Remove any trailing '$' before we
-                * generate the initial machine password.
-                */
-
-               if (user_name[strlen(user_name)-1] == '$') {
-                       user_name[strlen(user_name)-1] = 0;
+               if (user_name[user_name_len - 1] == '$') {
+                       user_name_len--;
+               } else {
+                       if (user_name_len + 2 > sizeof(user_name)) {
+                               fprintf(stderr, "machine name too long\n");
+                               exit(1);
+                       }
+                       user_name[user_name_len] = '$';
+                       user_name[user_name_len + 1] = '\0';
                }
 
                if (local_flags & LOCAL_ADD_USER) {
                        SAFE_FREE(new_passwd);
-                       new_passwd = smb_xstrdup(user_name);
+
+                       /*
+                        * Remove any trailing '$' before we
+                        * generate the initial machine password.
+                        */
+                       new_passwd = smb_xstrndup(user_name, user_name_len);
                        if (!strlower_m(new_passwd)) {
                                fprintf(stderr, "strlower_m %s failed\n",
                                        new_passwd);
                                exit(1);
                        }
                }
-
-               /*
-                * Now ensure the username ends in '$' for
-                * the machine add.
-                */
-
-               slprintf(buf, sizeof(buf)-1, "%s$", user_name);
-               strlcpy(user_name, buf, sizeof(user_name));
        } else if (local_flags & LOCAL_INTERDOM_ACCOUNT) {
-               static fstring buf;
+               size_t user_name_len = strlen(user_name);
+
+               if (user_name[user_name_len - 1] != '$') {
+                       if (user_name_len + 2 > sizeof(user_name)) {
+                               fprintf(stderr, "machine name too long\n");
+                               exit(1);
+                       }
+                       user_name[user_name_len] = '$';
+                       user_name[user_name_len + 1] = '\0';
+               }
 
                if ((local_flags & LOCAL_ADD_USER) && (new_passwd == NULL)) {
                        /*
@@ -409,11 +417,6 @@ static int process_root(int local_flags)
                                exit(1);
                        }
                }
-
-               /* prepare uppercased and '$' terminated username */
-               slprintf(buf, sizeof(buf) - 1, "%s$", user_name);
-               strlcpy(user_name, buf, sizeof(user_name));
-
        } else {
 
                if (remote_machine != NULL) {