lib: Add error checks in dom_sid_string_buf

Also, avoid casts by using PRIxxx macros

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/libcli/security/dom_sid.c b/libcli/security/dom_sid.c
index b876fc8b780260373a693c857a204d7cd98dd3fe..d913f2d93fb00989797511e53e10baf112a5347f 100644 (file)
--- a/libcli/security/dom_sid.c
+++ b/libcli/security/dom_sid.c
@@ -431,7 +431,7 @@ bool dom_sid_is_valid_account_domain(const struct dom_sid *sid)
 */
 int dom_sid_string_buf(const struct dom_sid *sid, char *buf, int buflen)
 {
-       int i, ofs;
+       int i, ofs, ret;
        uint64_t ia;
 
        if (!sid) {
@@ -445,18 +445,32 @@ int dom_sid_string_buf(const struct dom_sid *sid, char *buf, int buflen)
                ((uint64_t)sid->id_auth[1] << 32) +
                ((uint64_t)sid->id_auth[0] << 40);
 
-       ofs = snprintf(buf, buflen, "S-%hhu-", (unsigned char)sid->sid_rev_num);
+       ret = snprintf(buf, buflen, "S-%"PRIu8"-", sid->sid_rev_num);
+       if (ret < 0) {
+               return ret;
+       }
+       ofs = ret;
+
        if (ia >= UINT32_MAX) {
-               ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "0x%llx",
-                               (unsigned long long)ia);
+               ret = snprintf(buf+ofs, MAX(buflen-ofs, 0), "0x%"PRIx64, ia);
        } else {
-               ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "%llu",
-                               (unsigned long long)ia);
+               ret = snprintf(buf+ofs, MAX(buflen-ofs, 0), "%"PRIu64, ia);
        }
+       if (ret < 0) {
+               return ret;
+       }
+       ofs += ret;
 
        for (i = 0; i < sid->num_auths; i++) {
-               ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "-%u",
-                               (unsigned int)sid->sub_auths[i]);
+               ret = snprintf(
+                       buf+ofs,
+                       MAX(buflen-ofs, 0),
+                       "-%"PRIu32,
+                       sid->sub_auths[i]);
+               if (ret < 0) {
+                       return ret;
+               }
+               ofs += ret;
        }
        return ofs;
 }
@@ -472,7 +486,7 @@ char *dom_sid_string(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
 
        len = dom_sid_string_buf(sid, buf, sizeof(buf));
 
-       if (len+1 > sizeof(buf)) {
+       if ((len < 0) || (len+1 > sizeof(buf))) {
                return talloc_strdup(mem_ctx, "(SID ERR)");
        }
 

diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index 07cfbd06b3363659504580ce7518062e63f7e383..bc95de223f472d37e5c26859394268d6d82fec3c 100644 (file)
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -638,7 +638,7 @@ _PUBLIC_ NTSTATUS authsam_update_user_info_dc(TALLOC_CTX *mem_ctx,
                int len;
 
                len = dom_sid_string_buf(sid, sid_buf, sizeof(sid_buf));
-               if (len+1 > sizeof(sid_buf)) {
+               if ((len < 0) || (len+1 > sizeof(sid_buf))) {
                        return NT_STATUS_INVALID_SID;
                }
                snprintf(dn_str, sizeof(dn_str), "<SID=%s>", sid_buf);