From: Egor Mikhailov <mikhailovev@sgu.ru>
Date: Thu, 18 Jun 2026 05:35:47 +0000 (+0400)
Subject: S4/dfs_server: fix potential underflow in get_dcs_insite
X-Git-Tag: talloc-2.5.0~391
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=73e19436204ba9fbefddc0e151ac4024d122e433;p=thirdparty%2Fsamba.git

S4/dfs_server: fix potential underflow in get_dcs_insite

get_dcs_insite unconditionally truncates the last character of sAMAccountName
by index len - 1. If sAMAccountName is empty, this leads to an underflow (index -1)
and memory corruption.

This fix ensures sAMAccountName length is validated before truncation.

Pair-Programmed-With: Sergey Zhidkih <rx1513@altlinux.org>
Signed-off-by: Egor Mikhailov <mikhailovev@sgu.ru>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jun 23 09:15:50 UTC 2026 on atb-devel-224
---

diff --git a/dfs_server/dfs_server_ad.c b/dfs_server/dfs_server_ad.c
index 0e601992e4a..1a02184f73e 100644
--- a/dfs_server/dfs_server_ad.c
+++ b/dfs_server/dfs_server_ad.c
@@ -262,6 +262,8 @@ static NTSTATUS get_dcs_insite(TALLOC_CTX *ctx, struct ldb_context *ldb,
 			}
 		} else {
 			char *tmp;
+			size_t len;
+
 			const char *aname = ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL);
 			if (aname == NULL) {
 				DEBUG(2,(__location__ ": sAMAccountName missing on %s\n",
@@ -276,9 +278,18 @@ static NTSTATUS get_dcs_insite(TALLOC_CTX *ctx, struct ldb_context *ldb,
 				return NT_STATUS_NO_MEMORY;
 			}
 
+			len = strlen(tmp);
+			if (len == 0) {
+				DBG_NOTICE("sAMAccountName is empty on %s\n",
+					ldb_dn_get_linearized(dn));
+				TALLOC_FREE(r);
+				return NT_STATUS_INTERNAL_ERROR;
+			}
+
 			/* Netbios name is also the sAMAccountName for
 			   computer but without the final $ */
-			tmp[strlen(tmp) - 1] = '\0';
+			tmp[len - 1] = '\0';
+
 			list->names[list->count] = tmp;
 		}
 		list->count++;