I'm trying to write a small C helper function to process MS-CHAP password change requests in FreeRADIUS.

The "quickest" (ha!) way of doing this seemed to be to hijack the libwbclient stuff.

When calling wbcChangeUserPasswordEx with WBC_CHANGE_PASSWORD_LEVEL_RESPONSE, it does the following, several times (lines 867-897 of nsswitch/libwbclient/wbc_pam.c):

 if (...data) {
   memcpy(dest->data, src->data, data->data_len);
   dest->data_len = src->data_len;
 }

...this is obviously wrong - the memcpy needs to happen after the "len" assignment, else dest->data_len == 0 and it never copies any data.

There are other bugs in this code, which can segfault the winbind child; I'll open these separately.