From: Nalin Dahyabhai <nalin@redhat.com>
Date: Mon, 14 Jan 2013 18:57:54 +0000 (-0500)
Subject: Don't fail if a candidate certificate has no SANs
X-Git-Tag: krb5-1.12-alpha1~176
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2a39ca97af97ddd508262eab33e5a0fa6abc4b00;p=thirdparty%2Fkrb5.git

Don't fail if a candidate certificate has no SANs

When we're doing certificate matching and we're asked for the list of
SAN values for a certifiate, and it contains none, don't return an
error, as that will eventually cause the module to just return an error.
Instead, just return an empty list of SAN values so that processing will
continue on to check if other certificates match.
---

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
index 26901986b6..1aae6147ff 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
@@ -3161,12 +3161,8 @@ crypto_cert_get_matching_data(krb5_context context,
     md->ku_bits = cert_get_ku_bits(context, cert_handle->cert);
     md->eku_bits = cert_get_eku_bits(context, cert_handle->cert, PR_FALSE);
     if (cert_retrieve_cert_sans(context, cert_handle->cert,
-                                &md->sans, &md->sans, NULL) != 0) {
-        free(md->subject_dn);
-        free(md->issuer_dn);
-        free(md);
-        return ENOMEM;
-    }
+                                &md->sans, &md->sans, NULL) != 0)
+        md->sans = NULL;
     *ret_data = md;
     return 0;
 }