From: Noel Power <noel.power@suse.com>
Date: Thu, 2 Jul 2026 08:45:40 +0000 (+0100)
Subject: s3:rpc_server: Fix undefined behavior from strchr
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=97387e947ffd8b73d2dcc6814c20018ba5ff3fb0;p=thirdparty%2Fsamba.git

s3:rpc_server: Fix undefined behavior from strchr

  o If no backslash was found in servername, variable asprinter will
    contain NULL value. It will then be passed to strchr call,
    resulting in undefined behavior.
  o Also rework code to remove const violation of handlename

Pair-Programmed-With: Dmitriy Mikhalchenko <tascad@altlinux.org>
Pair-Programmed-With: Noel Power <noel.power@suse.com>
Signed-off-by: Shishkov Nikita <shishkovna@sgu.ru>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Mon Jul 13 16:14:50 UTC 2026 on atb-devel-224
---

diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
index 6759feb868e..56d62b109c6 100644
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
@@ -538,9 +538,9 @@ static WERROR set_printer_hnd_name(TALLOC_CTX *mem_ctx,
 {
 	int snum;
 	int n_services=lp_numservices();
-	char *aprinter;
+	char *aprinter = NULL;
 	const char *printername;
-	const char *servername = NULL;
+	char *servername = NULL;
 	fstring sname;
 	bool found = false;
 	struct spoolss_PrinterInfo2 *info2 = NULL;
@@ -558,13 +558,31 @@ static WERROR set_printer_hnd_name(TALLOC_CTX *mem_ctx,
 	DEBUG(4,("Setting printer name=%s (len=%lu)\n", handlename,
 		(unsigned long)strlen(handlename)));
 
-	aprinter = discard_const_p(char, handlename);
+	aprinter = talloc_strdup(mem_ctx, handlename);
+	if (aprinter == NULL) {
+		result = WERR_NOT_ENOUGH_MEMORY;
+		goto out;
+	}
+
 	if ( *handlename == '\\' ) {
-		servername = canon_servername(handlename);
-		aprinter = discard_const_p(char, strchr_m(servername, '\\'));
-		if (aprinter != NULL) {
-			*aprinter = '\0';
-			aprinter++;
+		servername = talloc_strdup(mem_ctx,
+					   canon_servername(handlename));
+		if (servername == NULL) {
+			result = WERR_NOT_ENOUGH_MEMORY;
+			goto out;
+		}
+
+		p = strchr_m(servername, '\\');
+
+		if (p != NULL) {
+			TALLOC_FREE(aprinter);
+			*p = '\0';
+			p++;
+			aprinter = talloc_strdup(mem_ctx, p);
+			if (aprinter == NULL) {
+				result = WERR_NOT_ENOUGH_MEMORY;
+				goto out;
+			}
 		}
 		if (!is_myname_or_ipaddr(servername)) {
 			result = WERR_INVALID_PRINTER_NAME;
@@ -719,6 +737,8 @@ static WERROR set_printer_hnd_name(TALLOC_CTX *mem_ctx,
 
 	result = WERR_OK;
 out:
+	TALLOC_FREE(aprinter);
+	TALLOC_FREE(servername);
 	return result;
 }