From 04fd77087c2f1f4bbe82d13876ee40b2aaa6b69d Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 15 Mar 2013 13:00:55 +1100 Subject: [PATCH] auth/ntlmssp: Avoid use-after-free of user_info after logon failure at log level 5 Reviewed-by: Jeremy Allison (cherry picked from commit 1dcd75df4941d7032a66d3fbb86ac76964444a3f) --- auth/ntlmssp/ntlmssp_server.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/auth/ntlmssp/ntlmssp_server.c b/auth/ntlmssp/ntlmssp_server.c index d9bea1c..442bd5d 100644 --- a/auth/ntlmssp/ntlmssp_server.c +++ b/auth/ntlmssp/ntlmssp_server.c @@ -449,11 +449,11 @@ static NTSTATUS ntlmssp_server_check_password(struct gensec_security *gensec_sec &gensec_ntlmssp->server_returned_info, user_session_key, lm_session_key); } - talloc_free(user_info); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(5, (__location__ ": Checking NTLMSSP password for %s\\%s failed: %s\n", user_info->client.domain_name, user_info->client.account_name, nt_errstr(nt_status))); } + TALLOC_FREE(user_info); NT_STATUS_NOT_OK_RETURN(nt_status); -- 1.7.11.7