svn commit: samba r21151 - in branches: SAMBA_3_0/source/modules SAMBA_3_0/source/nsswitch SAMBA_3_0_24/source/modules SAMBA_3_0_24/source/nsswitch

[jerry at samba.org]

Author: jerry
Date: 2007-02-05 15:16:30 +0000 (Mon, 05 Feb 2007)
New Revision: 21151

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=21151

Log:
applying patches for CVE-2007-045[34]
Modified:
   branches/SAMBA_3_0/source/modules/vfs_afsacl.c
   branches/SAMBA_3_0/source/nsswitch/winbind_nss_solaris.c
   branches/SAMBA_3_0_24/source/modules/vfs_afsacl.c
   branches/SAMBA_3_0_24/source/nsswitch/winbind_nss_solaris.c


Changeset:
Modified: branches/SAMBA_3_0/source/modules/vfs_afsacl.c
===================================================================
--- branches/SAMBA_3_0/source/modules/vfs_afsacl.c	2007-02-05 15:07:44 UTC (rev 21150)
+++ branches/SAMBA_3_0/source/modules/vfs_afsacl.c	2007-02-05 15:16:30 UTC (rev 21151)
@@ -901,7 +901,7 @@
 	ZERO_STRUCT(dir_acl);
 	ZERO_STRUCT(file_acl);
 
-	pstr_sprintf(name, fsp->fsp_name);
+	pstrcpy(name, fsp->fsp_name);
 
 	if (!fsp->is_directory) {
 		/* We need to get the name of the directory containing the

Modified: branches/SAMBA_3_0/source/nsswitch/winbind_nss_solaris.c
===================================================================
--- branches/SAMBA_3_0/source/nsswitch/winbind_nss_solaris.c	2007-02-05 15:07:44 UTC (rev 21150)
+++ branches/SAMBA_3_0/source/nsswitch/winbind_nss_solaris.c	2007-02-05 15:16:30 UTC (rev 21151)
@@ -493,7 +493,8 @@
 	af = AF_INET6;
 #endif
 
-	strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name)) ;
+	strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+	request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
 	if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
 		== NSS_STATUS_SUCCESS ) {
@@ -515,7 +516,8 @@
 	ZERO_STRUCT(response);
 	ZERO_STRUCT(request);
 	
-	strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name));
+	strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+	request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
 	if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
 		== NSS_STATUS_SUCCESS ) {

Modified: branches/SAMBA_3_0_24/source/modules/vfs_afsacl.c
===================================================================
--- branches/SAMBA_3_0_24/source/modules/vfs_afsacl.c	2007-02-05 15:07:44 UTC (rev 21150)
+++ branches/SAMBA_3_0_24/source/modules/vfs_afsacl.c	2007-02-05 15:16:30 UTC (rev 21151)
@@ -901,7 +901,7 @@
 	ZERO_STRUCT(dir_acl);
 	ZERO_STRUCT(file_acl);
 
-	pstr_sprintf(name, fsp->fsp_name);
+	pstrcpy(name, fsp->fsp_name);
 
 	if (!fsp->is_directory) {
 		/* We need to get the name of the directory containing the

Modified: branches/SAMBA_3_0_24/source/nsswitch/winbind_nss_solaris.c
===================================================================
--- branches/SAMBA_3_0_24/source/nsswitch/winbind_nss_solaris.c	2007-02-05 15:07:44 UTC (rev 21150)
+++ branches/SAMBA_3_0_24/source/nsswitch/winbind_nss_solaris.c	2007-02-05 15:16:30 UTC (rev 21151)
@@ -493,7 +493,8 @@
 	af = AF_INET6;
 #endif
 
-	strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name)) ;
+	strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+	request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
 	if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
 		== NSS_STATUS_SUCCESS ) {
@@ -515,7 +516,8 @@
 	ZERO_STRUCT(response);
 	ZERO_STRUCT(request);
 	
-	strncpy(request.data.winsreq, argp->key.name, strlen(argp->key.name));
+	strncpy(request.data.winsreq, argp->key.name, sizeof(request.data.winsreq) - 1);
+	request.data.winsreq[sizeof(request.data.winsreq) - 1] = '\0';
 
 	if( (ret = winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response))
 		== NSS_STATUS_SUCCESS ) {