samba base64 encode vulnerability

[infamous41md () hotpop com]

a question about exploiting the samba vuln.

    if (*s == '=') n -= 1;

    /* fix up length */
    decoded.length = n;

    memcpy(s, decoded.data, decoded.length);

if n == 0 before it is decremented, then it will wrap around to ~0 and the memcpy will eventually SEGFAULT.  but can 
you exploit it still?

-- 
-sean-- 
-sean