From: Kurt Zeilenga <kurt@openldap.org>
Date: Mon, 26 Aug 2002 20:10:45 +0000 (+0000)
Subject: Prevent buffer overflow
X-Git-Tag: NO_SLAP_OP_BLOCKS~1168
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=9be4df6b7c5b54460417a086da64bc1ed16168b9;p=openldap

Prevent buffer overflow
---

diff --git a/servers/slapd/back-passwd/search.c b/servers/slapd/back-passwd/search.c
index f3cef18881..22d9fb5777 100644
--- a/servers/slapd/back-passwd/search.c
+++ b/servers/slapd/back-passwd/search.c
@@ -340,23 +340,30 @@ pw2entry( Backend *be, struct passwd *pw, const char **text )
 
 		s = strchr(vals[0].bv_val, '&');
 		if (s) {
-			char buf[256];
-			int i = s - vals[0].bv_val;
-			strncpy(buf, vals[0].bv_val, i);
-			s = buf+i;
-			strcpy(s, pw->pw_name);
-			*s = TOUPPER((unsigned char)*s);
-			strcat(s, vals[0].bv_val+i+1);
-			vals[0].bv_val = buf;
+			char buf[1024];
+
+			if( vals[0].bv_len + pwlen < sizeof(buf) ) {
+				int i = s - vals[0].bv_val;
+				strncpy(buf, vals[0].bv_val, i);
+				s = buf+i;
+				strcpy(s, pw->pw_name);
+				*s = TOUPPER((unsigned char)*s);
+				strcat(s, vals[0].bv_val+i+1);
+				vals[0].bv_val = buf;
+			}
 		}
 		vals[0].bv_len = strlen(vals[0].bv_val);
-		if ( strcmp( vals[0].bv_val, pw->pw_name ))
+
+		if ( vals[0].bv_len && strcasecmp( vals[0].bv_val, pw->pw_name )) {
 			attr_merge( e, ad_cn, vals );
+		}
+
 		if ( (s=strrchr(vals[0].bv_val, ' '))) {
 			vals[0].bv_val = s + 1;
 			vals[0].bv_len = strlen(vals[0].bv_val);
 			attr_merge(e, ad_sn, vals);
 		}
+nogecos:;
 	}
 #endif