s3/winbind: Ensure parse_domain_user() can't write beyond the end of domain[]

fail if we try to write beyond the fstring boundry

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15467
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 773cdab3da9b53352b0ee8af12639e5707bcea8f..b66adcb9569e2979b3ab7ea012609ad3e7a45a2e 100644 (file)
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -1560,6 +1560,12 @@ bool parse_domain_user(const char *domuser,
 
        p = strchr(domuser, *lp_winbind_separator());
        if (p != NULL) {
+               if (PTR_DIFF(p, domuser) >= sizeof(fstring)) {
+                       DBG_ERR("index %td exceeds len of dest string %zu\n",
+                               PTR_DIFF(p, domuser),
+                               (sizeof(fstring) - 1));
+                       return false;
+               }
                fstrcpy(user, p + 1);
                fstrcpy(domain, domuser);
                domain[PTR_DIFF(p, domuser)] = '\0';