[SCM] Samba Shared Repository - branch v3-5-test updated

[Jeremy Allison]

The branch, v3-5-test has been updated
       via  dd38f15... talloc: Fix write behind memory block
      from  c289e6e... WHATSNEW: Update changes since 3.5.0pre1.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-5-test


- Log -----------------------------------------------------------------
commit dd38f159860bc3d7a454992ce56ea3500e81aed4
Author: Kamen Mazdrashki <kamen.mazdrashki at postpath.com>
Date:   Sat Dec 5 21:44:15 2009 +0200

    talloc: Fix write behind memory block
    
    If ALWASY_REALLOC is defined and we are to 'shrink' memory block,
    memcpy() will write outside memory just allocated.
    
    Signed-off-by: Andrew Tridgell <tridge at samba.org>
    (cherry picked from commit 8efabcc8a5dcd83deed8ef8e17826a1d347e6d83)

-----------------------------------------------------------------------

Summary of changes:
 lib/talloc/talloc.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)


Changeset truncated at 500 lines:

diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c
index 7beda4b..f7b1ac3 100644
--- a/lib/talloc/talloc.c
+++ b/lib/talloc/talloc.c
@@ -1184,7 +1184,7 @@ void *_talloc_realloc(const void *context, void *ptr, size_t size, const char *n
 #if ALWAYS_REALLOC
 	new_ptr = malloc(size + TC_HDR_SIZE);
 	if (new_ptr) {
-		memcpy(new_ptr, tc, tc->size + TC_HDR_SIZE);
+		memcpy(new_ptr, tc, MIN(tc->size, size) + TC_HDR_SIZE);
 		free(tc);
 	}
 #else


-- 
Samba Shared Repository