Use ldb_dn_from_ldb_val to avoid possible over-run of the value.

The ldb_val is length-limited, and while normally NULL terminated,
this avoids the chance that this particular value might not be, as
well as avoiding a cast.

Andrew Bartlett

diff --git a/source4/dsdb/samdb/ldb_modules/linked_attributes.c b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
index bafd7e5ecf72e06dc9c8e56370e42537ad660480..a54a7d64726b26c677b374b86a40869bfd9d10b6 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/linked_attributes.c
+++ b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
@@ -79,13 +79,13 @@ static struct la_context *linked_attributes_init(struct ldb_module *module,
 /* Common routine to handle reading the attributes and creating a
  * series of modify requests */
 static int la_store_op(struct la_context *ac,
-                       enum la_op op, char *dn,
+                      enum la_op op, struct ldb_val *dn,
                        const char *name, const char *value)
 {
        struct la_op_store *os, *tmp;
        struct ldb_dn *op_dn;
 
-       op_dn = ldb_dn_new(ac, ac->module->ldb, dn);
+       op_dn = ldb_dn_from_ldb_val(ac, ac->module->ldb, dn);
        if (!op_dn) {
                return LDB_ERR_OPERATIONS_ERROR;
        }
@@ -233,7 +233,7 @@ static int linked_attributes_add(struct ldb_module *module, struct ldb_request *
 
                for (j = 0; j < el->num_values; j++) {
                        ret = la_store_op(ac, LA_OP_ADD,
-                                         (char *)el->values[j].data,
+                                         &el->values[j],
                                          attr_name, attr_val);
                        if (ret != LDB_SUCCESS) {
                                return ret;
@@ -327,7 +327,7 @@ static int la_mod_search_callback(struct ldb_request *req, struct ldb_reply *are
                        /* make sure we manage each value */
                        for (j = 0; j < search_el->num_values; j++) {
                                ret = la_store_op(ac, LA_OP_DEL,
-                                         (char *)search_el->values[j].data,
+                                                 &search_el->values[j],
                                                  attr_name, dn);
                                if (ret != LDB_SUCCESS) {
                                        talloc_free(ares);
@@ -445,7 +445,7 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
                        /* For each value being added, we need to setup the adds */
                        for (j = 0; j < el->num_values; j++) {
                                ret = la_store_op(ac, LA_OP_ADD,
-                                         (char *)el->values[j].data,
+                                                 &el->values[j],
                                                  attr_name, attr_val);
                                if (ret != LDB_SUCCESS) {
                                        return ret;
@@ -459,7 +459,7 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
                                /* For each value being deleted, we need to setup the delete */
                                for (j = 0; j < el->num_values; j++) {
                                        ret = la_store_op(ac, LA_OP_DEL,
-                                                 (char *)el->values[j].data,
+                                                         &el->values[j],
                                                          attr_name, attr_val);
                                        if (ret != LDB_SUCCESS) {
                                                return ret;
@@ -701,7 +701,7 @@ static int la_op_search_callback(struct ldb_request *req,
                        }
                        for (j = 0; j < el->num_values; j++) {
                                ret = la_store_op(ac, LA_OP_DEL,
-                                         (char *)el->values[j].data,
+                                                 &el->values[j],
                                                  attr_name, deldn);
                                if (ret != LDB_SUCCESS) {
                                        talloc_free(ares);
@@ -710,7 +710,7 @@ static int la_op_search_callback(struct ldb_request *req,
                                }
                                if (!adddn) continue;
                                ret = la_store_op(ac, LA_OP_ADD,
-                                         (char *)el->values[j].data,
+                                                 &el->values[j],
                                                  attr_name, adddn);
                                if (ret != LDB_SUCCESS) {
                                        talloc_free(ares);

diff --git a/source4/dsdb/samdb/ldb_modules/normalise.c b/source4/dsdb/samdb/ldb_modules/normalise.c
index 70513bd644cc189f554c8c893e9fce90f99e96bf..2366bc785684aa2bba79085e3f60a9d9c444ffa5 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/normalise.c
+++ b/source4/dsdb/samdb/ldb_modules/normalise.c
@@ -120,7 +120,7 @@ static int normalize_search_callback(struct ldb_request *req, struct ldb_reply *
                        }
                        for (j = 0; j < msg->elements[i].num_values; j++) {
                                const char *dn_str;
-                               struct ldb_dn *dn = ldb_dn_new(ac, ac->module->ldb, (const char *)msg->elements[i].values[j].data);
+                               struct ldb_dn *dn = ldb_dn_from_ldb_val(ac, ac->module->ldb, &msg->elements[i].values[j]);
                                if (!dn) {
                                        return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
                                }

diff --git a/source4/lib/ldb/common/attrib_handlers.c b/source4/lib/ldb/common/attrib_handlers.c
index fb57e2dadc084fb74bf06d1dc7a9b1bc5fca42de..5ec86b5b8fbe7f09fd078e7efb62e07149f39cef 100644 (file)
--- a/source4/lib/ldb/common/attrib_handlers.c
+++ b/source4/lib/ldb/common/attrib_handlers.c
@@ -240,7 +240,7 @@ int ldb_canonicalise_dn(struct ldb_context *ldb, void *mem_ctx,
        out->length = 0;
        out->data = NULL;
 
-       dn = ldb_dn_new(ldb, mem_ctx, (char *)in->data);
+       dn = ldb_dn_from_ldb_val(ldb, mem_ctx, in);
        if ( ! ldb_dn_validate(dn)) {
                return LDB_ERR_INVALID_DN_SYNTAX;
        }
@@ -268,10 +268,10 @@ int ldb_comparison_dn(struct ldb_context *ldb, void *mem_ctx,
        struct ldb_dn *dn1 = NULL, *dn2 = NULL;
        int ret;
 
-       dn1 = ldb_dn_new(ldb, mem_ctx, (char *)v1->data);
+       dn1 = ldb_dn_from_ldb_val(ldb, mem_ctx, v1);
        if ( ! ldb_dn_validate(dn1)) return -1;
 
-       dn2 = ldb_dn_new(ldb, mem_ctx, (char *)v2->data);
+       dn2 = ldb_dn_from_ldb_val(ldb, mem_ctx, v2);
        if ( ! ldb_dn_validate(dn2)) {
                talloc_free(dn1);
                return -1;

diff --git a/source4/lib/ldb/common/ldb_ldif.c b/source4/lib/ldb/common/ldb_ldif.c
index fb93e17c6c04dc45a69e103d254c0aac07f82f14..538ff8feaabb2ecffd46a7579dd85585905788d3 100644 (file)
--- a/source4/lib/ldb/common/ldb_ldif.c
+++ b/source4/lib/ldb/common/ldb_ldif.c
@@ -562,11 +562,11 @@ struct ldb_ldif *ldb_ldif_read(struct ldb_context *ldb,
                goto failed;
        }
 
-       msg->dn = ldb_dn_new(msg, ldb, (char *)value.data);
+       msg->dn = ldb_dn_from_ldb_val(msg, ldb, &value);
 
        if ( ! ldb_dn_validate(msg->dn)) {
                ldb_debug(ldb, LDB_DEBUG_ERROR, "Error: Unable to parse dn '%s'\n", 
-                                 value.data);
+                         (char *)value.data);
                goto failed;
        }
 

diff --git a/source4/lib/ldb/common/ldb_match.c b/source4/lib/ldb/common/ldb_match.c
index 64d0e5476168586ab10b08b7ffdec75bf98e38e9..4cde739d672cc98a91755b8bbcbfeea153fc93c1 100644 (file)
--- a/source4/lib/ldb/common/ldb_match.c
+++ b/source4/lib/ldb/common/ldb_match.c
@@ -147,7 +147,7 @@ static int ldb_match_equality(struct ldb_context *ldb,
        int ret;
 
        if (ldb_attr_dn(tree->u.equality.attr) == 0) {
-               valuedn = ldb_dn_new(ldb, ldb, (char *)tree->u.equality.value.data);
+               valuedn = ldb_dn_from_ldb_val(ldb, ldb, &tree->u.equality.value);
                if (valuedn == NULL) {
                        return 0;
                }

diff --git a/source4/lib/ldb/ldb_map/ldb_map.c b/source4/lib/ldb/ldb_map/ldb_map.c
index fafbb63b0a7c55ca8ebd2818555f68c5985afe1a..72d8378a076c14f489c1e3c04cb8adb1f808c164 100644 (file)
--- a/source4/lib/ldb/ldb_map/ldb_map.c
+++ b/source4/lib/ldb/ldb_map/ldb_map.c
@@ -626,7 +626,7 @@ static struct ldb_val ldb_dn_convert_local(struct ldb_module *module, void *mem_
        struct ldb_dn *dn, *newdn;
        struct ldb_val newval;
 
-       dn = ldb_dn_new(mem_ctx, module->ldb, (char *)val->data);
+       dn = ldb_dn_from_ldb_val(mem_ctx, module->ldb, val);
        if (! ldb_dn_validate(dn)) {
                newval.length = 0;
                newval.data = NULL;
@@ -652,7 +652,7 @@ static struct ldb_val ldb_dn_convert_remote(struct ldb_module *module, void *mem
        struct ldb_dn *dn, *newdn;
        struct ldb_val newval;
 
-       dn = ldb_dn_new(mem_ctx, module->ldb, (char *)val->data);
+       dn = ldb_dn_from_ldb_val(mem_ctx, module->ldb, val);
        if (! ldb_dn_validate(dn)) {
                newval.length = 0;
                newval.data = NULL;

diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index 22d201e58eaa295955946d096db15393f318bc9e..fc2d623160dea81879a3e37ff6b10c7b515ab34f 100644 (file)
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -2451,7 +2451,7 @@ static NTSTATUS dcesrv_samr_QueryGroupMember(struct dcesrv_call_state *dce_call,
                        struct ldb_message **res2;
                        const char * const attrs2[2] = { "objectSid", NULL };
                        ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
-                                          ldb_dn_new(mem_ctx, a_state->sam_ctx, (const char *)el->values[i].data),
+                                          ldb_dn_from_ldb_val(mem_ctx, a_state->sam_ctx, &el->values[i]),
                                           &res2, attrs2);
                        if (ret != 1)
                                return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -2845,8 +2845,8 @@ static NTSTATUS dcesrv_samr_GetMembersInAlias(struct dcesrv_call_state *dce_call
                        struct ldb_message **msgs2;
                        const char * const attrs2[2] = { "objectSid", NULL };
                        ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
-                                          ldb_dn_new(mem_ctx, a_state->sam_ctx, (const char *)el->values[i].data),
-                                          &msgs2, attrs2);
+                                             ldb_dn_new(mem_ctx, a_state->sam_ctx, &el->values[i]),
+                                             &msgs2, attrs2);
                        if (ret != 1)
                                return NT_STATUS_INTERNAL_DB_CORRUPTION;