Attachment 15875 Details for Bug 14327 – patch from master for v4.12 and v4.11

[patch] patch from master for v4.12 and v4.11

patch (text/plain), 1.46 KB, created by Guenther Deschner on 2020-03-30 14:06:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Guenther Deschner

Created: 2020-03-30 14:06:51 UTC

Size: 1.46 KB

patch

obsolete

>From a9463b204f8431e9aa142acb36f3c0d33c841623 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
>Date: Fri, 27 Mar 2020 10:13:11 +0100
>Subject: [PATCH] nsswitch: fix use-after-free causing segfault in
> _pam_delete_cred
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14327
>
>Guenther
>
>Signed-off-by: Guenther Deschner <gd@samba.org>
>Reviewed-by: Alexander Bokovoy <ab@samba.org>
>
>Autobuild-User(master): GÃ¼nther Deschner <gd@samba.org>
>Autobuild-Date(master): Mon Mar 30 13:01:20 UTC 2020 on sn-devel-184
>
>(cherry picked from commit 047b0d8ab534c7a10a8572fd9f21e2456fd30710)
>---
> nsswitch/pam_winbind.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c
>index 3ad70d3c4cd..7af03fe2bd0 100644
>--- a/nsswitch/pam_winbind.c
>+++ b/nsswitch/pam_winbind.c
>@@ -2609,7 +2609,6 @@ static int _pam_delete_cred(pam_handle_t *pamh, int flags,
> 		wbc_status = wbcCtxLogoffUserEx(ctx->wbc_ctx, &logoff, &error);
> 		retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
> 						     user, "wbcLogoffUser");
>-		wbcFreeMemory(error);
> 		wbcFreeMemory(logoff.blobs);
> 		logoff.blobs = NULL;
> 
>@@ -2629,6 +2628,7 @@ out:
> 		retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
> 		     user, "wbcLogoffUser");
> 	}
>+	wbcFreeMemory(error);
> 
> 	/*
> 	 * Delete the krb5 ccname variable from the PAM environment
>-- 
>2.25.1
>

Flags:

ab: review+
gd: ci-passed+

Actions: View

Attachments on bug 14327: 15875