If validateascii is passed a string containing only non-zero 7bit
authorNeilBrown <neilb@suse.de>
Tue, 26 Feb 2008 18:57:39 +0000 (13:57 -0500)
committerSteve Dickson <steved@redhat.com>
Tue, 26 Feb 2008 18:57:39 +0000 (13:57 -0500)
values, then the loop with exit with i == len, and the following
test will access beyond the end of the array.

So add an extra test to fix this.

Found by Marcus Meissner <meissner@novell.com>.

Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
utils/idmapd/idmapd.c

index 355c6e1..6b5971c 100644 (file)
@@ -848,7 +848,7 @@ validateascii(char *string, u_int32_t len)
                        return (-1);
        }
 
-       if (string[i] != '\0')
+       if ((i >= len) || string[i] != '\0')
                return (-1);
 
        return (i + 1);