[SCM] Samba Shared Repository - branch master updated

[Jeremy Allison]

The branch, master has been updated
       via  e9a804c9bdb s3:param:py_param - allocate buffer for nt_name and comment
      from  9f57a3194a4 loadparam: add option "acl flag inherited canonicalization"

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit e9a804c9bdbcc68263857d8abb366fa08a820bb8
Author: Andrew Walker <awalker at ixsystems.com>
Date:   Wed May 26 09:04:07 2021 -0400

    s3:param:py_param - allocate buffer for nt_name and comment
    
    nt_name and comment are allocated via talloc_strdup(). Length
    is not guaranteed to be sizeof(fstring) and so rather than use
    fstrcpy into a possibly NULL buffer, free original string, then
    talloc_strdup() the one provided to us.
    
    Signed-off-by: Andrew Walker <awalker at ixsystems.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Thu May 27 22:07:45 UTC 2021 on sn-devel-184

-----------------------------------------------------------------------

Summary of changes:
 source3/passdb/py_passdb.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/passdb/py_passdb.c b/source3/passdb/py_passdb.c
index 8988959bfc7..f6fd50215f2 100644
--- a/source3/passdb/py_passdb.c
+++ b/source3/passdb/py_passdb.c
@@ -1359,12 +1359,19 @@ static int py_groupmap_set_nt_name(PyObject *obj, PyObject *value, void *closure
 	GROUP_MAP *group_map = (GROUP_MAP *)pytalloc_get_ptr(obj);
 
 	PY_CHECK_TYPE(&PyUnicode_Type, value, return -1;);
+	if (group_map->nt_name != NULL) {
+		TALLOC_FREE(group_map->nt_name);
+	}
 	if (value == Py_None) {
-		fstrcpy(group_map->nt_name, NULL);
+		group_map->nt_name = talloc_strdup(group_map, "");
 	} else {
-		fstrcpy(group_map->nt_name, PyUnicode_AsUTF8(value));
+		group_map->nt_name = talloc_strdup(group_map,
+						   PyUnicode_AsUTF8(value));
+	}
+	TALLOC_FREE(frame);
+	if (group_map->nt_name == NULL) {
+		return -1;
 	}
-	talloc_free(frame);
 	return 0;
 }
 
@@ -1389,12 +1396,19 @@ static int py_groupmap_set_comment(PyObject *obj, PyObject *value, void *closure
 	GROUP_MAP *group_map = (GROUP_MAP *)pytalloc_get_ptr(obj);
 
 	PY_CHECK_TYPE(&PyUnicode_Type, value, return -1;);
+	if (group_map->comment != NULL) {
+		TALLOC_FREE(group_map->comment);
+	}
 	if (value == Py_None) {
-		fstrcpy(group_map->comment, NULL);
+		group_map->comment = talloc_strdup(group_map, "");
 	} else {
-		fstrcpy(group_map->comment, PyUnicode_AsUTF8(value));
+		group_map->comment = talloc_strdup(group_map,
+						   PyUnicode_AsUTF8(value));
+	}
+	TALLOC_FREE(frame);
+	if (group_map->comment == NULL) {
+		return -1;
 	}
-	talloc_free(frame);
 	return 0;
 }
 


-- 
Samba Shared Repository