Changeset 228 for branches/samba-3.2.x/source/lib/charcnv.c

Timestamp:

May 26, 2009, 9:44:50 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.6

File:

• branches/samba-3.2.x/source/lib/charcnv.c (modified) (4 diffs)

branches/samba-3.2.x/source/lib/charcnv.c

@@ -1184 +1184 @@
         *ppdest = NULL;
 
+        if (!src_len) {
+                return 0;
+        }
+
         if (flags & STR_TERMINATE) {
                 if (src_len == (size_t)-1) {
@@ -1201 +1205 @@
                         smb_panic(msg);
                 }
-        }
+        } else {
+                /* Can't have an unlimited length
+                 * non STR_TERMINATE'd.
+                 */
+                if (src_len == (size_t)-1) {
+                        errno = EINVAL;
+                        return 0;
+                }
+        }
+
+        /* src_len != -1 here. */
 
         if (!convert_string_allocate(ctx, CH_DOS, CH_UNIX, src, src_len, &dest,
-                &dest_len, True))
+                &dest_len, True)) {
                 dest_len = 0;
+        }
 
         if (dest_len && dest) {
                 /* Did we already process the terminating zero ? */
                 if (dest[dest_len-1] != 0) {
-                        dest[dest_len-1] = 0;
+                        size_t size = talloc_get_size(dest);
+                        /* Have we got space to append the '\0' ? */
+                        if (size <= dest_len) {
+                                /* No, realloc. */
+                                dest = TALLOC_REALLOC_ARRAY(ctx, dest, char,
+                                                dest_len+1);
+                                if (!dest) {
+                                        /* talloc fail. */
+                                        dest_len = (size_t)-1;
+                                        return 0;
+                                }
+                        }
+                        /* Yay - space ! */
+                        dest[dest_len] = '\0';
+                        dest_len++;
                 }
         } else if (dest) {
@@ -1558 +1587 @@
                         smb_panic("Bad src length in pull_ucs2_base_talloc\n");
                 }
-        }
+        } else {
+                /* Can't have an unlimited length
+                 * non STR_TERMINATE'd.
+                 */
+                if (src_len == (size_t)-1) {
+                        errno = EINVAL;
+                        return 0;
+                }
+        }
+
+        /* src_len != -1 here. */
 
         /* ucs2 is always a multiple of 2 bytes */
-        if (src_len != (size_t)-1) {
-                src_len &= ~1;
-        }
+        src_len &= ~1;
 
         dest_len = convert_string_talloc(ctx,
@@ -1575 +1612 @@
                 dest_len = 0;
         }
-
-        if (src_len == (size_t)-1)
-                src_len = dest_len*2;
 
         if (dest_len) {