nb_name_len does not increase size when nn_scope contains only a \0, …

…do the same on nb_name_encode to avoid a buffer overflow
rumpkernel · Dec 13, 2013 · 6c44bdb · 6c44bdb
1 parent 07001e9
commit 6c44bdb
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/smb/nb_name.c b/lib/smb/nb_name.c
@@ -182,7 +182,7 @@ nb_name_encode(struct nb_name *np, u_char *dst)
 		cp += 2;
 	}
 	*cp = 0;
-	if (np->nn_scope == NULL)
+	if (np->nn_scope == NULL || *np->nn_scope == 0)
 		return nb_encname_len(dst);
 	plen = cp++;
 	lblen = 0;