must add one to the extra_data size to transfer the 0 string terminator.
authorHerb Lewis <herb@samba.org>
Fri, 18 Oct 2002 23:52:05 +0000 (23:52 +0000)
committerHerb Lewis <herb@samba.org>
Fri, 18 Oct 2002 23:52:05 +0000 (23:52 +0000)
This was causing "wbinfo --sequence" to access past the end of malloced
memory.

source/nsswitch/winbindd_misc.c

index 45f2d42f980ae6b51cb91837b5d85c0558bebf13..c2e744c0a7ea51ec3dcd8c386c9750346c24b430 100644 (file)
@@ -182,7 +182,8 @@ enum winbindd_result winbindd_show_sequence(struct winbindd_cli_state *state)
        }
 
        state->response.extra_data = extra_data;
-       state->response.length += strlen(extra_data);
+       /* must add one to length to copy the 0 for string termination */
+       state->response.length += strlen(extra_data) + 1;
 
        return WINBINDD_OK;
 }