CVE-2015-5330: ldb_dn_explode: copy strings by length, not terminators
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Wed, 25 Nov 2015 22:17:11 +0000 (11:17 +1300)
committerRalph Boehme <slow@samba.org>
Wed, 9 Dec 2015 16:19:53 +0000 (17:19 +0100)
commitf36cb71c330a52106e36028b3029d952257baf15
tree74e31164b53e6d8c891c3865d60b00860225f586
parent538d305de91e34a2938f5f219f18bf0e1918763f
CVE-2015-5330: ldb_dn_explode: copy strings by length, not terminators

That is, memdup(), not strdup(). The terminators might not be there.

But, we have to make sure we put the terminator on, because we tend to
assume the terminator is there in other places.

Use talloc_set_name_const() on the resulting chunk so talloc_report()
remains unchanged.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Stefan Metzmacher <metze@samba.org>
Pair-programmed-with: Ralph Boehme <slow@samba.org>
lib/ldb/common/ldb_dn.c