dsdb: Do not attempt to return beyond the end of the password history array

Found by AddressSanitizer

Change-Id: I82e35aea60726053c79510ba8ed3eedfaf553eb7
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Matthieu Patou <mat@matws.net>
Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Mon Oct 13 08:28:15 CEST 2014 on sn-devel-104

diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index 409191d12b0f271ca730065129ca6a2ed5c16d6c..a892f2da0f9282827ba97466edc946cd8c9d9e8f 100644 (file)
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -570,7 +570,7 @@ NTSTATUS samdb_result_passwords_from_history(TALLOC_CTX *mem_ctx,
        if (nt_pwd) {
                unsigned int num_nt;
                num_nt = samdb_result_hashes(mem_ctx, msg, "ntPwdHistory", &ntPwdHash);
-               if (num_nt < idx) {
+               if (num_nt <= idx) {
                        *nt_pwd = NULL;
                } else {
                        *nt_pwd = &ntPwdHash[idx];
@@ -583,7 +583,7 @@ NTSTATUS samdb_result_passwords_from_history(TALLOC_CTX *mem_ctx,
                if (lpcfg_lanman_auth(lp_ctx)) {
                        unsigned int num_lm;
                        num_lm = samdb_result_hashes(mem_ctx, msg, "lmPwdHistory", &lmPwdHash);
-                       if (num_lm < idx) {
+                       if (num_lm <= idx) {
                                *lm_pwd = NULL;
                        } else {
                                *lm_pwd = &lmPwdHash[idx];