From: Egor Mikhailov Date: Fri, 5 Jun 2026 16:10:19 +0000 (+0400) Subject: s4:kdc: fix NULL pointer dereference of client entry X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;ds=inline;p=thirdparty%2Fsamba.git s4:kdc: fix NULL pointer dereference of client entry Client can be NULL if the principal is not found in the DB, but it is later dereferenced inside mit_samba_check_client_access(). If client is NULL, we should return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN early, as we cannot check policies without the client database entry. Pair-Programmed-With: Dmitry Mikhalchenko Signed-off-by: Egor Mikhailov Reviewed-by: Anoop C S Reviewed-by: Andreas Schneider Autobuild-User(master): Anoop C S Autobuild-Date(master): Wed Aug 5 13:54:56 UTC 2026 on atb-devel-224 --- diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c index 56bd0dd5f89..a3dcc093aec 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -102,7 +102,7 @@ krb5_error_code kdb_samba_db_check_policy_as(krb5_context context, /* Prefer canonicalised name from client entry */ client_princ = client ? client->princ : kdcreq->client; - if (client_princ == NULL || ks_is_kadmin(context, client_princ)) { + if (client == NULL || client_princ == NULL || ks_is_kadmin(context, client_princ)) { return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; }