From: Andreas Schneider <asn@samba.org>
Date: Tue, 15 May 2018 15:55:22 +0000 (+0200)
Subject: s4:ntvfs: Fix string copy of share_name
X-Git-Tag: ldb-1.4.0~123
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=609ef35c12900bbd5ecaa557f7b5d71b5784a103;p=thirdparty%2Fsamba.git

s4:ntvfs: Fix string copy of share_name

../source4/ntvfs/ipc/rap_server.c:70:3: error: ‘strncpy’ specified bound 13 equals destination size [-Werror=stringop-truncation]
   strncpy((char *)r->out.info[j].info1.share_name,
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    snames[i],
    ~~~~~~~~~~
    sizeof(r->out.info[0].info1.share_name));
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
---

diff --git a/source4/ntvfs/ipc/rap_server.c b/source4/ntvfs/ipc/rap_server.c
index 3a133f568da..fc2d3aa611d 100644
--- a/source4/ntvfs/ipc/rap_server.c
+++ b/source4/ntvfs/ipc/rap_server.c
@@ -63,13 +63,18 @@ NTSTATUS rap_netshareenum(TALLOC_CTX *mem_ctx,
 				   union rap_share_info, r->out.available);
 
 	for (i = 0, j = 0; i < r->out.available; i++) {
+		size_t sname_len;
+
 		if (!NT_STATUS_IS_OK(share_get_config(mem_ctx, sctx, snames[i], &scfg))) {
 			DEBUG(3, ("WARNING: Service [%s] disappeared after enumeration!\n", snames[i]));
 			continue;
 		}
-		strncpy((char *)r->out.info[j].info1.share_name,
+		/* Make sure we have NUL-termination */
+		sname_len = MIN(strlen(snames[i]),
+				sizeof(r->out.info[j].info1.share_name));
+		strlcpy((char *)r->out.info[j].info1.share_name,
 			snames[i],
-			sizeof(r->out.info[0].info1.share_name));
+			sname_len);
 		r->out.info[i].info1.reserved1 = 0;
 		r->out.info[i].info1.share_type = dcesrv_common_get_share_type(mem_ctx, NULL, scfg);
 		r->out.info[i].info1.comment = share_string_option(mem_ctx, scfg, SHARE_COMMENT, "");