File ptclient-segfault-ldap.c.patch of Package cyrus-imapd

File ptclient-segfault-ldap.c.patch of Package cyrus-imapd (Revision 9721cfa582cd4292f1c94d52c66292bb)

Currently displaying revision 9721cfa582cd4292f1c94d52c66292bb , Show latest

--- cyrus-imapd-2.5/ptclient/ldap.c	2015-02-13 11:22:46.000000000 +0100
+++ cyrus-imapd-2.5-patched/ptclient/ldap.c	2015-05-09 17:06:43.145404847 +0200
@@ -631,55 +631,46 @@
 
 static int ptsmodule_standard_root_dn(char *domain, const char **result)
 {
-    /* number of dots */
-    int dots;
     /* the expected length of the result */
-    int root_dn_len;
 
     char *buf;
     char *part;
     char *ptr;
+    char *dc=",dc=";
+    char *dn;
+    dn =  xzmalloc(1024);
+    buf = xzmalloc(1024);
+    buf[0] = '\0'; // (?)
+    dn[0] = '\0'; // (?)
 
     syslog(LOG_DEBUG, "ptsmodule_standard_root_dn called for domain %s", domain);
 
-    for (dots = 0, buf=(char *)domain; *buf; buf++) {
-	if (*buf == '.') {
-	    dots++;
-	}
-    }
-
-    /* Each dot is to be replaced with ',dc=' (length 4), so add
-     * length 3 for each of them.
-     */
-    root_dn_len = strlen(domain) + (dots * 3);
+    strncpy(dn, domain, strlen(domain));
 
-    buf = xmalloc(root_dn_len);
-    buf[0] = '\0'; // (?)
-    /* AM: Above: Terminate the string by default, so strlen won't buffer-overflow later */
 
     /* AM: No need for another allocation/dup */
-    part = strtok_r(domain, ".", &ptr);
+    part = strtok_r(dn, ".", &ptr);
 
     while (part != NULL) {
-	syslog(LOG_DEBUG, "Root DN now %s", buf);
-	strcat(buf, ",dc=");
-	syslog(LOG_DEBUG, "Root DN now %s", buf);
-	strcat(buf, part);
-	syslog(LOG_DEBUG, "Root DN now %s", buf);
-	part = strtok_r(NULL, ".", &ptr);
+        syslog(LOG_DEBUG, "Root DN now %s", buf);
+        strncat(buf, dc, strlen(dc));
+        syslog(LOG_DEBUG, "Root DN now %s", buf);
+        strncat(buf, part, strlen(part));
+        syslog(LOG_DEBUG, "Root DN now %s", buf);
+        part = strtok_r(NULL, ".", &ptr);
     }
 
     syslog(LOG_DEBUG, "Root DN now %s", buf);
 
     if (buf[0] == ',')
-	memmove(buf, buf+1, strlen(buf));
+        memmove(buf, buf+1, strlen(buf));
 
     *result = xstrdup(buf);
 
     free(buf);
     free(part);
+    free(dn);
 /*    free(ptr);
-    free(root_dn_len);
 */
     syslog(LOG_DEBUG, "Root DN now %s", *result);