> -----Original Message-----
> From: Rich Megginson [mailto:[email protected]]
> Sent: Friday, June 12, 2009 11:13 PM
> To: Xu, Qiang (FXSGSC)
> Cc: [email protected]; Howard Chu
> Subject: Re: SASL authentication
>
> This is a very dangerous use of strncpy - strncpy does not null
> terminate the buffer- if you want to use strncpy, you must
> ensure that the string is properly null terminated.
Actually, the code snippet is part of a function:
=======================================================
static AbaInitStatus
aba_ldap_init_sasl_p(LDAP **ldapSearchHandle, bool_t testFlag,
char* username, char* password,
SM_Session_Information_Type *sessionInformation)
{
int ldapStatus = LDAP_SUCCESS;
AbaInitStatus status = ABA_OK;
LDAP *ldapHandle = (LDAP *)NULL;
...
LDAPControl **responseControls = NULL;
char primaryIP[PRIMARY_HOSTNAME+1] = {0};
...
/* convert primary server hostname to IP address */
if (is_it_an_IP_address(primaryServerHost) == FALSE)
{
strncpy(primaryIP, primaryServerHost, PRIMARY_HOSTNAME);
if (get_ip_from_hostname(primaryServerHost, primaryIP))
{
LOGINFO("primary server IP address is %s", primaryIP);
}
else
{
LOGERROR("get_ip_from_hostname() failed for primary server,
still using hostname!");
strncpy(primaryIP, primaryServerHost, PRIMARY_HOSTNAME);
}
}
else
{
LOGINFO("primary server is already in IP address form");
strncpy(primaryIP, primaryServerHost, PRIMARY_HOSTNAME);
}
...
if ((ldapHandle = prldap_init(primaryIP,
primaryServerPort, 1 )) == NULL)
{
LOGERROR("Failed to do prldap_init for Primary Server...");
return(ABA_LDAP_INIT_CALL_FAILED);
}
else
{
LOGINFO("prldap_init SUCCESSFUL to [%s:%d]",
primaryIP, primaryServerPort);
}
...
ldapStatus = ldap_sasl_interactive_bind_ext_s(ldapHandle, "", sasl_mech,
NULL,
NULL, sasl_flags,
example_sasl_interact, NULL, &responseControls);
if (responseControls != NULL)
{
LOGINFO("SASL binding finished, will destroy responseControls");
ldap_controls_free(responseControls);
responseControls = NULL;
}
LOGINFO("SASL LDAP BIND with GSSAPI: Value of ldapStatus %d", ldapStatus);
...
}
=======================================================
As you can see, the char array primaryIP[] is a local variable, and it would be
initialized to 0 blocks every time the function is called. Therefore, strncpy()
here is safe. :-)
Thanks for reminding, Rich!
Xu Qiang
_______________________________________________
dev-tech-ldap mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-ldap
