[PATCH 03/12] dsdb: Do not attempt to return beyond the end of the password history array

abartlet at samba.org abartlet at samba.org
Sun Sep 7 17:30:29 MDT 2014


From: Andrew Bartlett <abartlet at samba.org>

Found by AddressSanitizer

Change-Id: I82e35aea60726053c79510ba8ed3eedfaf553eb7
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
---
 source4/dsdb/common/util.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index 409191d..a892f2d 100644
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -570,7 +570,7 @@ NTSTATUS samdb_result_passwords_from_history(TALLOC_CTX *mem_ctx,
 	if (nt_pwd) {
 		unsigned int num_nt;
 		num_nt = samdb_result_hashes(mem_ctx, msg, "ntPwdHistory", &ntPwdHash);
-		if (num_nt < idx) {
+		if (num_nt <= idx) {
 			*nt_pwd = NULL;
 		} else {
 			*nt_pwd = &ntPwdHash[idx];
@@ -583,7 +583,7 @@ NTSTATUS samdb_result_passwords_from_history(TALLOC_CTX *mem_ctx,
 		if (lpcfg_lanman_auth(lp_ctx)) {
 			unsigned int num_lm;
 			num_lm = samdb_result_hashes(mem_ctx, msg, "lmPwdHistory", &lmPwdHash);
-			if (num_lm < idx) {
+			if (num_lm <= idx) {
 				*lm_pwd = NULL;
 			} else {
 				*lm_pwd = &lmPwdHash[idx];
-- 
2.1.0



More information about the samba-technical mailing list