s4-drs: ensure we fill in ncRoot_dn in getncchanges

Signed-off-by: Andrew Tridgell <tridge@samba.org>

diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index cb0a145639ca5d10ef87049e1613026bbad7e27e..24ff324992ad46ccbc212e390b5e7cb95e4959f4 100644 (file)
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -402,6 +402,13 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_
                        return WERR_NOMEM;
                }
                b_state->getncchanges_state = getnc_state;
+               getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
+       }
+
+       if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
+           ldb_dn_is_null(getnc_state->ncRoot_dn)) {
+               DEBUG(0,(__location__ ": Bad DN '%s'\n", ncRoot->dn));
+               return WERR_DS_DRA_INVALID_PARAMETER;
        }
 
        /* we need the session key for encrypting password attributes */