From: Bo Yang <boyang@samba.org>
Date: Sat, 24 Oct 2009 02:55:36 +0000 (+0800)
Subject: s3: Fix crash in pam_winbind, another reference to freed memory.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1791b1cc43ce744c73b473aff0e311acbdf0ee4e;p=thirdparty%2Fsamba.git

s3: Fix crash in pam_winbind, another reference to freed memory.

Fix bug #6840.

Signed-off-by: Bo Yang <boyang@samba.org>
---

diff --git a/source/nsswitch/pam_winbind.c b/source/nsswitch/pam_winbind.c
index 3d0c5ef90e5..74540817af0 100644
--- a/source/nsswitch/pam_winbind.c
+++ b/source/nsswitch/pam_winbind.c
@@ -1784,7 +1784,7 @@ static int winbind_auth_request(struct pwb_context *ctx,
 	if (logon.blobs) {
 		wbcFreeMemory(logon.blobs);
 	}
-	if (info && info->blobs) {
+	if (info && info->blobs && !p_info) {
 		wbcFreeMemory(info->blobs);
 	}
 	if (error && !p_error) {
@@ -3138,10 +3138,14 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 					free(username_ret);
 				}
 
-				wbcFreeMemory(info);
-				wbcFreeMemory(policy);
 			}
 
+			if (info && info->blobs) {
+				wbcFreeMemory(info->blobs);
+			}
+			wbcFreeMemory(info);
+			wbcFreeMemory(policy);
+
 			goto out;
 		}
 	} else {