CVE-2015-5330: ldb_dn_explode: copy strings by length, not terminators
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Wed, 25 Nov 2015 22:17:11 +0000 (11:17 +1300)
committerRalph Boehme <slow@samba.org>
Wed, 9 Dec 2015 16:17:05 +0000 (17:17 +0100)
commit83f1d39cd9ab9b8b548602f9ee806a994fca9d0c
treeb441b14863cbccaddf612420efb79f2431995639
parentf07626d0297ed6bd21623409e1ea1ae1138d23a8
CVE-2015-5330: ldb_dn_explode: copy strings by length, not terminators

That is, memdup(), not strdup(). The terminators might not be there.

But, we have to make sure we put the terminator on, because we tend to
assume the terminator is there in other places.

Use talloc_set_name_const() on the resulting chunk so talloc_report()
remains unchanged.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Stefan Metzmacher <metze@samba.org>
Pair-programmed-with: Ralph Boehme <slow@samba.org>
lib/ldb/common/ldb_dn.c