From: Andreas Schneider <asn@samba.org>
Date: Wed, 7 Jan 2015 16:12:54 +0000 (+0100)
Subject: s3-libads: Fix a possible segfault in kerberos_fetch_pac().
X-Git-Tag: samba-4.2.0rc4~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eaeeb5132658717644bc1008c71d33cfc3e04629;p=thirdparty%2Fsamba.git

s3-libads: Fix a possible segfault in kerberos_fetch_pac().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11037

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit a13e29cc4345d85ab6fe4482119386b87e4e8673)
---

diff --git a/source3/libads/authdata.c b/source3/libads/authdata.c
index 18a2e4fccc2..d3a0992c804 100644
--- a/source3/libads/authdata.c
+++ b/source3/libads/authdata.c
@@ -61,7 +61,7 @@ static NTSTATUS kerberos_fetch_pac(struct auth4_context *auth_ctx,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	if (pac_blob) {
+	if (pac_blob != NULL) {
 		status = kerberos_decode_pac(tmp_ctx,
 					     *pac_blob,
 					     NULL,
@@ -73,22 +73,22 @@ static NTSTATUS kerberos_fetch_pac(struct auth4_context *auth_ctx,
 		if (!NT_STATUS_IS_OK(status)) {
 			goto done;
 		}
-	}
 
-	pac_data_ctr = talloc(mem_ctx, struct PAC_DATA_CTR);
-	if (pac_data_ctr == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto done;
-	}
+		pac_data_ctr = talloc(mem_ctx, struct PAC_DATA_CTR);
+		if (pac_data_ctr == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto done;
+		}
 
-	talloc_set_name_const(pac_data_ctr, "struct PAC_DATA_CTR");
+		talloc_set_name_const(pac_data_ctr, "struct PAC_DATA_CTR");
 
-	pac_data_ctr->pac_data = talloc_steal(pac_data_ctr, pac_data);
-	pac_data_ctr->pac_blob = data_blob_talloc(pac_data_ctr,
-						  pac_blob->data,
-						  pac_blob->length);
+		pac_data_ctr->pac_data = talloc_steal(pac_data_ctr, pac_data);
+		pac_data_ctr->pac_blob = data_blob_talloc(pac_data_ctr,
+							  pac_blob->data,
+							  pac_blob->length);
 
-	auth_ctx->private_data = talloc_steal(auth_ctx, pac_data_ctr);
+		auth_ctx->private_data = talloc_steal(auth_ctx, pac_data_ctr);
+	}
 
 	*session_info = talloc_zero(mem_ctx, struct auth_session_info);
 	if (!*session_info) {