CVE-2016-0771: librpc: add ndr_dnsp_string_list_copy() helper function

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11128
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11686

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/librpc/ndr/ndr_dnsp.c b/librpc/ndr/ndr_dnsp.c
index fcb623ad82228ba38bed340bc00fea00843e4359..82b5fb5d55ee9fde213168440818976e74327015 100644 (file)
--- a/librpc/ndr/ndr_dnsp.c
+++ b/librpc/ndr/ndr_dnsp.c
@@ -225,3 +225,27 @@ enum ndr_err_code ndr_push_dnsp_string_list(struct ndr_push *ndr, int ndr_flags,
        }
        return NDR_ERR_SUCCESS;
 }
+
+enum ndr_err_code ndr_dnsp_string_list_copy(TALLOC_CTX *mem_ctx,
+                                           const struct dnsp_string_list *src,
+                                           struct dnsp_string_list *dst)
+{
+       size_t i;
+
+       dst->count = 0;
+       dst->str = talloc_zero_array(mem_ctx, const char *, src->count);
+       if (dst->str == NULL) {
+               return NDR_ERR_ALLOC;
+       }
+
+       for (i = 0; i < src->count; i++) {
+               dst->str[i] = talloc_strdup(dst->str, src->str[i]);
+               if (dst->str[i] == NULL) {
+                       TALLOC_FREE(dst->str);
+                       return NDR_ERR_ALLOC;
+               }
+       }
+
+       dst->count = src->count;
+       return NDR_ERR_SUCCESS;
+}

diff --git a/librpc/ndr/ndr_dnsp.h b/librpc/ndr/ndr_dnsp.h
index 67f952ccb389dbbb6c5ffa4fccff1d95e9122c89..0d566336c352bc1af0dfbbcdd9c96d38f9deee37 100644 (file)
--- a/librpc/ndr/ndr_dnsp.h
+++ b/librpc/ndr/ndr_dnsp.h
@@ -27,3 +27,7 @@ void ndr_print_dnsp_string(struct ndr_print *ndr, const char *name,
                                  const char *dns_string);
 enum ndr_err_code ndr_pull_dnsp_string(struct ndr_pull *ndr, int ndr_flags, const char **string);
 enum ndr_err_code ndr_push_dnsp_string(struct ndr_push *ndr, int ndr_flags, const char *string);
+
+enum ndr_err_code ndr_dnsp_string_list_copy(TALLOC_CTX *mem_ctx,
+                                           const struct dnsp_string_list *src,
+                                           struct dnsp_string_list *dst);