S4/dfs_server: fix potential underflow in get_dcs_insite

get_dcs_insite unconditionally truncates the last character of sAMAccountName
by index len - 1. If sAMAccountName is empty, this leads to an underflow (index -1)
and memory corruption.

This fix ensures sAMAccountName length is validated before truncation.

Pair-Programmed-With: Sergey Zhidkih <rx1513@altlinux.org>
Signed-off-by: Egor Mikhailov <mikhailovev@sgu.ru>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jun 23 09:15:50 UTC 2026 on atb-devel-224

diff --git a/dfs_server/dfs_server_ad.c b/dfs_server/dfs_server_ad.c
index 0e601992e4a5b6ccded917210acd48d9d7aa9f1c..1a02184f73ed3575bbc01ab6b762a60a2c734649 100644 (file)
--- a/dfs_server/dfs_server_ad.c
+++ b/dfs_server/dfs_server_ad.c
@@ -262,6 +262,8 @@ static NTSTATUS get_dcs_insite(TALLOC_CTX *ctx, struct ldb_context *ldb,
                        }
                } else {
                        char *tmp;
+                       size_t len;
+
                        const char *aname = ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL);
                        if (aname == NULL) {
                                DEBUG(2,(__location__ ": sAMAccountName missing on %s\n",
@@ -276,9 +278,18 @@ static NTSTATUS get_dcs_insite(TALLOC_CTX *ctx, struct ldb_context *ldb,
                                return NT_STATUS_NO_MEMORY;
                        }
 
+                       len = strlen(tmp);
+                       if (len == 0) {
+                               DBG_NOTICE("sAMAccountName is empty on %s\n",
+                                       ldb_dn_get_linearized(dn));
+                               TALLOC_FREE(r);
+                               return NT_STATUS_INTERNAL_ERROR;
+                       }
+
                        /* Netbios name is also the sAMAccountName for
                           computer but without the final $ */
-                       tmp[strlen(tmp) - 1] = '\0';
+                       tmp[len - 1] = '\0';
+
                        list->names[list->count] = tmp;
                }
                list->count++;