The branch, v3-5-test has been updated
via dd38f15... talloc: Fix write behind memory block
from c289e6e... WHATSNEW: Update changes since 3.5.0pre1.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-5-test
- Log -----------------------------------------------------------------
commit dd38f159860bc3d7a454992ce56ea3500e81aed4
Author: Kamen Mazdrashki <[email protected]>
Date: Sat Dec 5 21:44:15 2009 +0200
talloc: Fix write behind memory block
If ALWASY_REALLOC is defined and we are to 'shrink' memory block,
memcpy() will write outside memory just allocated.
Signed-off-by: Andrew Tridgell <[email protected]>
(cherry picked from commit 8efabcc8a5dcd83deed8ef8e17826a1d347e6d83)
-----------------------------------------------------------------------
Summary of changes:
lib/talloc/talloc.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
Changeset truncated at 500 lines:
diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c
index 7beda4b..f7b1ac3 100644
--- a/lib/talloc/talloc.c
+++ b/lib/talloc/talloc.c
@@ -1184,7 +1184,7 @@ void *_talloc_realloc(const void *context, void *ptr,
size_t size, const char *n
#if ALWAYS_REALLOC
new_ptr = malloc(size + TC_HDR_SIZE);
if (new_ptr) {
- memcpy(new_ptr, tc, tc->size + TC_HDR_SIZE);
+ memcpy(new_ptr, tc, MIN(tc->size, size) + TC_HDR_SIZE);
free(tc);
}
#else
--
Samba Shared Repository
