see https://bugzilla.samba.org/attachment.cgi?id=3678

patch:
--------

diff --git a/source/lib/charcnv.c b/source/lib/charcnv.c
index cea234f..eec7ae3 100644
--- a/source/lib/charcnv.c
+++ b/source/lib/charcnv.c
@@ -1209,7 +1209,21 @@ static size_t pull_ascii_base_talloc(TALLOC_CTX
*ctx,
        if (dest_len && dest) {
                /* Did we already process the terminating zero ? */
                if (dest[dest_len-1] != 0) {
-                       dest[dest_len-1] = 0;
+                       size_t size = talloc_get_size(dest);
+                       /* Have we got space to append the '\0' ? */
+                       if (size <= dest_len) {
+                               /* No, realloc. */
+                               dest = TALLOC_REALLOC_ARRAY(ctx, dest,
char,
+                                               dest_len+1);
+                               if (!dest) {
+                                       /* talloc fail. */
+                                       dest_len = (size_t)-1;
+                                       return 0;
+                               }
+                       }
+                       /* Yay - space ! */
+                       dest[dest_len] = '\0';
+                       dest_len++;
                }
        } else if (dest) {
                dest[0] = 0;

Reply via email to