Attachment 855772 Details for Bug 1058025 – Tested fix

[patch] Tested fix

0001-Fix-potential-segfault-on-free.patch (text/plain), 1.80 KB, created by Simo Sorce on 2014-01-26 20:19:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simo Sorce

Created: 2014-01-26 20:19:22 UTC

Size: 1.80 KB

patch

obsolete

>From 59b62175823b626d940098902d0ea817b392eecf Mon Sep 17 00:00:00 2001
>From: Simo Sorce <simo@redhat.com>
>Date: Sun, 26 Jan 2014 13:49:04 -0500
>Subject: [PATCH] Fix potential segfault on free.
>
>Unfortunately iconv_close() does not follow good practices and blindignly
>dereferences data, even if the passed in pointer is NULL.
>
>So check before calling.
>---
> src/gss_sec_ctx.c |  4 ++--
> src/ntlm.c        | 13 +++++++++----
> 2 files changed, 11 insertions(+), 6 deletions(-)
>
>diff --git a/src/gss_sec_ctx.c b/src/gss_sec_ctx.c
>index df25daa0c0ca19d16ac0aa829d092efc8fd6cf51..d55e9c699d1dc5a2f7671816c6078b0162e84041 100644
>--- a/src/gss_sec_ctx.c
>+++ b/src/gss_sec_ctx.c
>@@ -63,6 +63,8 @@ uint32_t gssntlm_init_sec_context(uint32_t *minor_status,
>     uint8_t sec_req;
>     bool key_exch;
> 
>+    ctx = (struct gssntlm_ctx *)(*context_handle);
>+
>     /* reset return values */
>     *minor_status = 0;
>     if (actual_mech_type) *actual_mech_type = NULL;
>@@ -105,8 +107,6 @@ uint32_t gssntlm_init_sec_context(uint32_t *minor_status,
>         }
>     }
> 
>-    ctx = (struct gssntlm_ctx *)(*context_handle);
>-
>     if (ctx == NULL) {
> 
>         /* first call */
>diff --git a/src/ntlm.c b/src/ntlm.c
>index af6d57aa25523a4c806801b4eea4ad1eb1c9960a..b0729f148c26524d86def74d6b0c01384fe88568 100644
>--- a/src/ntlm.c
>+++ b/src/ntlm.c
>@@ -193,12 +193,17 @@ int ntlm_free_ctx(struct ntlm_ctx **ctx)
> 
>     if (!ctx || !*ctx) return 0;
> 
>-    ret = iconv_close((*ctx)->from_oem);
>-    if (ret) ret = errno;
>+    if ((*ctx)->from_oem) {
>+        ret = iconv_close((*ctx)->from_oem);
>+        if (ret) goto done;
>+    }
> 
>-    ret = iconv_close((*ctx)->to_oem);
>-    if (ret) ret = errno;
>+    if ((*ctx)->to_oem) {
>+        ret = iconv_close((*ctx)->to_oem);
>+    }
> 
>+done:
>+    if (ret) ret = errno;
>     safefree(*ctx);
>     return ret;
> }
>-- 
>1.8.5.3
>

Actions: View | Diff

Attachments on bug 1058025: 855752 | 855772