Skip to content

Commit

Permalink
ldb_ldap: fix off-by-one increment in lldb_add_msg_attr
Browse files Browse the repository at this point in the history
Fix regression introduced by commit ce2bf5c

lldb_add_msg_attr() calls ldb_msg_add_empty() which, in turn, calls
calls _ldb_msg_add_el() which already increments msg->num_elements by one.

As a result, msg->num_elements is bigger than the actual number of
elements and any iteration over elements would step over elements array
boundary.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14413
Signed-off-by: Alexander Bokovoy <[email protected]>
Reviewed-by: Andreas Schneider <[email protected]>

Autobuild-User(master): Andreas Schneider <[email protected]>
Autobuild-Date(master): Fri Jun 19 08:35:33 UTC 2020 on sn-devel-184
  • Loading branch information
abbra authored and cryptomilk committed Jun 19, 2020
1 parent 36bd6ed commit 990a0fc
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions lib/ldb/ldb_ldap/ldb_ldap.c
Original file line number Diff line number Diff line change
Expand Up @@ -176,8 +176,6 @@ static int lldb_add_msg_attr(struct ldb_context *ldb,
el->num_values++;
}

msg->num_elements++;

return 0;
}

Expand Down

0 comments on commit 990a0fc

Please sign in to comment.