The branch, master has been updated
via 0c5214e Ensure convert_string_XXX is always called with a valid
converted_size pointer.
from 1e50f9a charconv: Fix the slow-path character conversions
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 0c5214e2eb6249914230f092fe35dfa49da24c34
Author: Jeremy Allison <[email protected]>
Date: Tue Mar 29 11:16:26 2011 -0700
Ensure convert_string_XXX is always called with a valid converted_size
pointer.
Preparation for cleaning up this API.
Autobuild-User: Jeremy Allison <[email protected]>
Autobuild-Date: Tue Mar 29 21:01:49 CEST 2011 on sn-devel-104
-----------------------------------------------------------------------
Summary of changes:
libcli/auth/ntlm_check.c | 3 ++-
librpc/ndr/ndr_drsuapi.c | 3 ++-
source4/dsdb/schema/schema_syntax.c | 6 ++++--
source4/lib/registry/patchfile_dotreg.c | 3 ++-
source4/lib/registry/util.c | 3 ++-
source4/libcli/raw/rawfileinfo.c | 4 +++-
source4/libcli/smb2/request.c | 3 ++-
source4/libnet/libnet_samdump.c | 3 ++-
source4/rpc_server/samr/samr_password.c | 7 +++++--
source4/smb_server/smb/request.c | 6 ++++--
source4/torture/rpc/samlogon.c | 4 ++--
11 files changed, 30 insertions(+), 15 deletions(-)
Changeset truncated at 500 lines:
diff --git a/libcli/auth/ntlm_check.c b/libcli/auth/ntlm_check.c
index 9cbd495..9520d32 100644
--- a/libcli/auth/ntlm_check.c
+++ b/libcli/auth/ntlm_check.c
@@ -314,6 +314,7 @@ NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,
struct samr_Password client_lm;
char *unix_pw = NULL;
bool lm_ok;
+ size_t converted_size = 0;
DEBUG(4,("ntlm_password_check: checking plaintext passwords for
user %s\n",
username));
@@ -322,7 +323,7 @@ NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,
if (lm_response->length &&
(convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX,
lm_response->data,
lm_response->length,
- (void *)&unix_pw, NULL))) {
+ (void *)&unix_pw, &converted_size)))
{
if (E_deshash(unix_pw, client_lm.hash)) {
lm_ok = true;
} else {
diff --git a/librpc/ndr/ndr_drsuapi.c b/librpc/ndr/ndr_drsuapi.c
index 35216ff..852153a 100644
--- a/librpc/ndr/ndr_drsuapi.c
+++ b/librpc/ndr/ndr_drsuapi.c
@@ -102,6 +102,7 @@ static void _print_drsuapi_DsAttributeValue_str(struct
ndr_print *ndr, const cha
const struct
drsuapi_DsAttributeValue *r)
{
char *str;
+ size_t converted_size = 0;
ndr_print_struct(ndr, name, "drsuapi_DsAttributeValue");
ndr->depth++;
@@ -109,7 +110,7 @@ static void _print_drsuapi_DsAttributeValue_str(struct
ndr_print *ndr, const cha
CH_UTF16, CH_UNIX,
r->blob->data,
r->blob->length,
- (void **)&str, NULL)) {
+ (void **)&str, &converted_size)) {
ndr_print_string(ndr, "string", "INVALID CONVERSION");
} else {
ndr_print_string(ndr, "string", str);
diff --git a/source4/dsdb/schema/schema_syntax.c
b/source4/dsdb/schema/schema_syntax.c
index 88badc7..8be87df 100644
--- a/source4/dsdb/schema/schema_syntax.c
+++ b/source4/dsdb/schema/schema_syntax.c
@@ -1470,6 +1470,7 @@ static WERROR dsdb_syntax_UNICODE_drsuapi_to_ldb(const
struct dsdb_syntax_ctx *c
W_ERROR_HAVE_NO_MEMORY(out->values);
for (i=0; i < out->num_values; i++) {
+ size_t converted_size = 0;
char *str;
if (in->value_ctr.values[i].blob == NULL) {
@@ -1484,7 +1485,7 @@ static WERROR dsdb_syntax_UNICODE_drsuapi_to_ldb(const
struct dsdb_syntax_ctx *c
CH_UTF16, CH_UNIX,
in->value_ctr.values[i].blob->data,
in->value_ctr.values[i].blob->length,
- (void **)&str, NULL)) {
+ (void **)&str, &converted_size)) {
return WERR_FOOBAR;
}
@@ -2227,6 +2228,7 @@ static WERROR
dsdb_syntax_PRESENTATION_ADDRESS_drsuapi_to_ldb(const struct dsdb_
for (i=0; i < out->num_values; i++) {
size_t len;
+ size_t converted_size = 0;
char *str;
if (in->value_ctr.values[i].blob == NULL) {
@@ -2246,7 +2248,7 @@ static WERROR
dsdb_syntax_PRESENTATION_ADDRESS_drsuapi_to_ldb(const struct dsdb_
if (!convert_string_talloc(out->values, CH_UTF16, CH_UNIX,
in->value_ctr.values[i].blob->data+4,
in->value_ctr.values[i].blob->length-4,
- (void **)&str, NULL)) {
+ (void **)&str, &converted_size)) {
return WERR_FOOBAR;
}
diff --git a/source4/lib/registry/patchfile_dotreg.c
b/source4/lib/registry/patchfile_dotreg.c
index 073c12e..c4409dc 100644
--- a/source4/lib/registry/patchfile_dotreg.c
+++ b/source4/lib/registry/patchfile_dotreg.c
@@ -70,6 +70,7 @@ static char *dotreg_data_blob_hex_string(TALLOC_CTX *mem_ctx,
const DATA_BLOB *b
static char *reg_val_dotreg_string(TALLOC_CTX *mem_ctx, uint32_t type,
const DATA_BLOB data)
{
+ size_t converted_size = 0;
char *ret = NULL;
if (data.length == 0)
@@ -80,7 +81,7 @@ static char *reg_val_dotreg_string(TALLOC_CTX *mem_ctx,
uint32_t type,
case REG_SZ:
convert_string_talloc(mem_ctx,
CH_UTF16, CH_UNIX, data.data,
data.length,
- (void **)&ret, NULL);
+ (void **)&ret, &converted_size);
break;
case REG_DWORD:
case REG_DWORD_BIG_ENDIAN:
diff --git a/source4/lib/registry/util.c b/source4/lib/registry/util.c
index 3bbfaf2..1197adb 100644
--- a/source4/lib/registry/util.c
+++ b/source4/lib/registry/util.c
@@ -26,6 +26,7 @@
_PUBLIC_ char *reg_val_data_string(TALLOC_CTX *mem_ctx, uint32_t type,
const DATA_BLOB data)
{
+ size_t converted_size = 0;
char *ret = NULL;
if (data.length == 0)
@@ -37,7 +38,7 @@ _PUBLIC_ char *reg_val_data_string(TALLOC_CTX *mem_ctx,
uint32_t type,
convert_string_talloc(mem_ctx,
CH_UTF16, CH_UNIX,
data.data, data.length,
- (void **)&ret, NULL);
+ (void **)&ret, &converted_size);
break;
case REG_DWORD:
case REG_DWORD_BIG_ENDIAN:
diff --git a/source4/libcli/raw/rawfileinfo.c b/source4/libcli/raw/rawfileinfo.c
index 5efa4dd..50a6731 100644
--- a/source4/libcli/raw/rawfileinfo.c
+++ b/source4/libcli/raw/rawfileinfo.c
@@ -51,6 +51,8 @@ NTSTATUS smbcli_parse_stream_info(DATA_BLOB blob, TALLOC_CTX
*mem_ctx,
uint32_t nlen, len;
bool ret;
void *vstr;
+ size_t converted_size = 0;
+
io->streams =
talloc_realloc(mem_ctx, io->streams, struct
stream_struct, n+1);
if (!io->streams) {
@@ -64,7 +66,7 @@ NTSTATUS smbcli_parse_stream_info(DATA_BLOB blob, TALLOC_CTX
*mem_ctx,
}
ret = convert_string_talloc(io->streams,
CH_UTF16, CH_UNIX,
- blob.data+ofs+24, nlen, &vstr,
NULL);
+ blob.data+ofs+24, nlen, &vstr,
&converted_size);
if (!ret) {
return NT_STATUS_ILLEGAL_CHARACTER;
}
diff --git a/source4/libcli/smb2/request.c b/source4/libcli/smb2/request.c
index bf96d05..729b003 100644
--- a/source4/libcli/smb2/request.c
+++ b/source4/libcli/smb2/request.c
@@ -686,6 +686,7 @@ NTSTATUS smb2_pull_o16s16_string(struct smb2_request_buffer
*buf, TALLOC_CTX *me
DATA_BLOB blob;
NTSTATUS status;
void *vstr;
+ size_t converted_size = 0;
bool ret;
status = smb2_pull_o16s16_blob(buf, mem_ctx, ptr, &blob);
@@ -705,7 +706,7 @@ NTSTATUS smb2_pull_o16s16_string(struct smb2_request_buffer
*buf, TALLOC_CTX *me
}
ret = convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
- blob.data, blob.length, &vstr, NULL);
+ blob.data, blob.length, &vstr,
&converted_size);
data_blob_free(&blob);
(*str) = (char *)vstr;
if (!ret) {
diff --git a/source4/libnet/libnet_samdump.c b/source4/libnet/libnet_samdump.c
index 90ec8d6..326d804 100644
--- a/source4/libnet/libnet_samdump.c
+++ b/source4/libnet/libnet_samdump.c
@@ -181,13 +181,14 @@ NTSTATUS libnet_SamDump(struct libnet_context *ctx,
TALLOC_CTX *mem_ctx,
for (t=samdump_state->trusted_domains; t; t=t->next) {
char *secret_name = talloc_asprintf(mem_ctx, "G$$%s", t->name);
for (s=samdump_state->secrets; s; s=s->next) {
+ size_t converted_size = 0;
char *secret_string;
if (strcasecmp_m(s->name, secret_name) != 0) {
continue;
}
if (!convert_string_talloc_handle(mem_ctx,
lpcfg_iconv_handle(ctx->lp_ctx), CH_UTF16, CH_UNIX,
s->secret.data,
s->secret.length,
- (void **)&secret_string,
NULL)) {
+ (void **)&secret_string,
&converted_size)) {
r->out.error_string = talloc_asprintf(mem_ctx,
"Could
not convert secret for domain %s to a string",
t->name);
diff --git a/source4/rpc_server/samr/samr_password.c
b/source4/rpc_server/samr/samr_password.c
index 873c0d8..8963b04 100644
--- a/source4/rpc_server/samr/samr_password.c
+++ b/source4/rpc_server/samr/samr_password.c
@@ -181,6 +181,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct
dcesrv_call_state *dce_call,
uint8_t new_lm_hash[16];
struct samr_Password lm_verifier;
size_t unicode_pw_len;
+ size_t converted_size = 0;
if (pwbuf == NULL) {
return NT_STATUS_INVALID_PARAMETER;
@@ -238,7 +239,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct
dcesrv_call_state *dce_call,
CH_DOS, CH_UNIX,
(const char *)new_password.data,
new_password.length,
- (void **)&new_pass, NULL)) {
+ (void **)&new_pass, &converted_size)) {
DEBUG(3,("samr: failed to convert incoming password buffer to
unix charset\n"));
return NT_STATUS_WRONG_PASSWORD;
}
@@ -397,11 +398,13 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct
dcesrv_call_state *dce_call,
* this) */
if (lm_pwd && r->in.lm_verifier != NULL) {
char *new_pass;
+ size_t converted_size = 0;
+
if (!convert_string_talloc_handle(mem_ctx,
lpcfg_iconv_handle(dce_call->conn->dce_ctx->lp_ctx),
CH_UTF16, CH_UNIX,
(const char *)new_password.data,
new_password.length,
- (void **)&new_pass, NULL)) {
+ (void **)&new_pass, &converted_size))
{
E_deshash(new_pass, new_lm_hash);
E_old_pw_hash(new_nt_hash, lm_pwd->hash,
lm_verifier.hash);
if (memcmp(lm_verifier.hash, r->in.lm_verifier->hash,
16) != 0) {
diff --git a/source4/smb_server/smb/request.c b/source4/smb_server/smb/request.c
index 59a34a0..d478963 100644
--- a/source4/smb_server/smb/request.c
+++ b/source4/smb_server/smb/request.c
@@ -483,6 +483,7 @@ static size_t req_pull_ucs2(struct request_bufinfo
*bufinfo, const char **dest,
int src_len, src_len2, alignment=0;
bool ret;
char *dest2;
+ size_t converted_size = 0;
if (!(flags & STR_NOALIGN) && ucs2_align(bufinfo->align_base, src,
flags)) {
src++;
@@ -512,7 +513,7 @@ static size_t req_pull_ucs2(struct request_bufinfo
*bufinfo, const char **dest,
return src_len2 + alignment;
}
- ret = convert_string_talloc(bufinfo->mem_ctx, CH_UTF16, CH_UNIX, src,
src_len2, (void **)&dest2, NULL);
+ ret = convert_string_talloc(bufinfo->mem_ctx, CH_UTF16, CH_UNIX, src,
src_len2, (void **)&dest2, &converted_size);
if (!ret) {
*dest = NULL;
@@ -541,6 +542,7 @@ static size_t req_pull_ascii(struct request_bufinfo
*bufinfo, const char **dest,
int src_len, src_len2;
bool ret;
char *dest2;
+ size_t converted_size = 0;
if (flags & STR_NO_RANGE_CHECK) {
src_len = byte_len;
@@ -561,7 +563,7 @@ static size_t req_pull_ascii(struct request_bufinfo
*bufinfo, const char **dest,
src_len2++;
}
- ret = convert_string_talloc(bufinfo->mem_ctx, CH_DOS, CH_UNIX, src,
src_len2, (void **)&dest2, NULL);
+ ret = convert_string_talloc(bufinfo->mem_ctx, CH_DOS, CH_UNIX, src,
src_len2, (void **)&dest2, &converted_size);
if (!ret) {
*dest = NULL;
diff --git a/source4/torture/rpc/samlogon.c b/source4/torture/rpc/samlogon.c
index e624f00..5650d20 100644
--- a/source4/torture/rpc/samlogon.c
+++ b/source4/torture/rpc/samlogon.c
@@ -1169,7 +1169,7 @@ static bool test_plaintext(struct samlogon_state
*samlogon_state, enum ntlm_brea
char *password;
char *dospw;
smb_ucs2_t *unicodepw;
-
+ size_t converted_size = 0;
uint8_t user_session_key[16];
uint8_t lm_key[16];
uint8_t lm_hash[16];
@@ -1192,7 +1192,7 @@ static bool test_plaintext(struct samlogon_state
*samlogon_state, enum ntlm_brea
if (!convert_string_talloc(samlogon_state->mem_ctx,
CH_UNIX, CH_DOS,
password, strlen(password)+1,
- (void**)&dospw, NULL)) {
+ (void**)&dospw, &converted_size)) {
DEBUG(0, ("convert_string_talloc failed!\n"));
exit(1);
}
--
Samba Shared Repository
