From 2b0737732884831d246b622b9b06ae29b236af9f Mon Sep 17 00:00:00 2001
From: David Maloney <DMaloney@rapid7.com>
Date: Tue, 2 Jun 2015 12:44:49 -0500
Subject: [PATCH] fix copy error
use strncpy not memcpy to transfer the re-encoded
name and description into our account object.
also use sizeof for precise copy size. eliminates lingering
errors
MSP-12356
---
c/meterpreter/source/extensions/priv/server/ntds_jet.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/c/meterpreter/source/extensions/priv/server/ntds_jet.c b/c/meterpreter/source/extensions/priv/server/ntds_jet.c
index ca9c8fb2..8ae682c3 100755
--- a/c/meterpreter/source/extensions/priv/server/ntds_jet.c
+++ b/c/meterpreter/source/extensions/priv/server/ntds_jet.c
@@ -225,7 +225,7 @@ JET_ERR read_user(struct jetState *ntdsState, struct ntdsColumns *accountColumns
if (readStatus != JET_errSuccess){
return readStatus;
}
- memcpy(&userAccount->accountName, wchar_to_utf8(accountName), 20);
+ strncpy(userAccount->accountName, wchar_to_utf8(accountName), sizeof(userAccount->accountName));
// Grab the Account Description here
wchar_t accountDescription[1024] = { 0x00 };
readStatus = JetRetrieveColumn(ntdsState->jetSession, ntdsState->jetTable, accountColumns->accountDescription.columnid, &accountDescription, sizeof(accountDescription), &columnSize, 0, NULL);
@@ -235,7 +235,7 @@ JET_ERR read_user(struct jetState *ntdsState, struct ntdsColumns *accountColumns
else if (readStatus != JET_errSuccess){
return readStatus;
}
- memcpy(&userAccount->accountDescription, wchar_to_utf8(accountDescription), 1024);
+ strncpy(userAccount->accountDescription, wchar_to_utf8(accountDescription), sizeof(userAccount->accountDescription));
// Grab the UserAccountControl flags here
readStatus = JetRetrieveColumn(ntdsState->jetSession, ntdsState->jetTable, accountColumns->accountControl.columnid, &accountControl, sizeof(accountControl), &columnSize, 0, NULL);
if (readStatus != JET_errSuccess){