s4:dsdb: check if domain is not empty

domain[strlen(domain)-1] leads to UB if strlen(domain) == 0,
so we add check that domain is not empty before accessing
the last symbol.

Pair-Programmed-With: Dmitriy Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jun 12 11:41:01 UTC 2026 on atb-devel-224

diff --git a/source4/dsdb/samdb/ldb_modules/netlogon.c b/source4/dsdb/samdb/ldb_modules/netlogon.c
index 479b3a6deec7655001de1a611a809ce22ce64f66..c3d417e1cad59a6392d9a9e21af50cdf2612bccf 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/netlogon.c
+++ b/source4/dsdb/samdb/ldb_modules/netlogon.c
@@ -81,7 +81,7 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
        NTSTATUS status;
 
        /* the domain parameter could have an optional trailing "." */
-       if (domain && domain[strlen(domain)-1] == '.') {
+       if (domain && domain[0] != '\0' && domain[strlen(domain)-1] == '.') {
                domain = talloc_strndup(mem_ctx, domain, strlen(domain)-1);
                NT_STATUS_HAVE_NO_MEMORY(domain);
        }