s4:kdc: fix NULL pointer dereference of client entry

Client can be NULL if the principal
is not found in the DB, but it is later dereferenced inside
mit_samba_check_client_access().

If client is NULL, we should return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN
early, as we cannot check policies without the client database entry.

Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Egor Mikhailov <mikhailovev@sgu.ru>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Wed Aug  5 13:54:56 UTC 2026 on atb-devel-224

diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
index 56bd0dd5f89423c637c7d868812dd814cea9893d..a3dcc093aec2cd72b0cba018acdcefc004eca2e1 100644 (file)
--- a/source4/kdc/mit-kdb/kdb_samba_policies.c
+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
@@ -102,7 +102,7 @@ krb5_error_code kdb_samba_db_check_policy_as(krb5_context context,
        /* Prefer canonicalised name from client entry */
        client_princ = client ? client->princ : kdcreq->client;
 
-       if (client_princ == NULL || ks_is_kadmin(context, client_princ)) {
+       if (client == NULL || client_princ == NULL || ks_is_kadmin(context, client_princ)) {
                return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
        }