Fix from Volker. Fix a segfault in base64_encode_data_blob

 We did not allocate enough memory for the \0 and a = at the end.
Jeremy.

diff --git a/source/lib/util_str.c b/source/lib/util_str.c
index 3059a1b6bdde3624a18b0a9224b5aa1c4873548b..c4d67c6b7c925a70e2cd21af19b0cc647692b7df 100644 (file)
--- a/source/lib/util_str.c
+++ b/source/lib/util_str.c
@@ -2308,7 +2308,9 @@ char * base64_encode_data_blob(DATA_BLOB data)
 
        out_cnt = 0;
        len = data.length;
-       output_len = data.length * 2;
+       output_len = data.length * 2 + 4; /* Account for closing bytes. 4 is
+                                          * random but should be enough for
+                                          * the = and \0 */
        result = (char *)SMB_MALLOC(output_len); /* get us plenty of space */
 
        while (len-- && out_cnt < (data.length * 2) - 5) {