From ae7799f3bd5630a73bfde643b9e02ef05d7d7251 Mon Sep 17 00:00:00 2001 From: Egor Mikhailov Date: Fri, 5 Jun 2026 20:10:19 +0400 Subject: [PATCH] s4:kdc: fix NULL pointer dereference of client entry Client can be NULL if the principal is not found in the DB, but it is later dereferenced inside mit_samba_check_client_access(). If client is NULL, we should return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN early, as we cannot check policies without the client database entry. Pair-Programmed-With: Dmitry Mikhalchenko Signed-off-by: Egor Mikhailov Reviewed-by: Anoop C S Reviewed-by: Andreas Schneider Autobuild-User(master): Anoop C S Autobuild-Date(master): Wed Aug 5 13:54:56 UTC 2026 on atb-devel-224 --- source4/kdc/mit-kdb/kdb_samba_policies.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c index 56bd0dd5f89..a3dcc093aec 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -102,7 +102,7 @@ krb5_error_code kdb_samba_db_check_policy_as(krb5_context context, /* Prefer canonicalised name from client entry */ client_princ = client ? client->princ : kdcreq->client; - if (client_princ == NULL || ks_is_kadmin(context, client_princ)) { + if (client == NULL || client_princ == NULL || ks_is_kadmin(context, client_princ)) { return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; } -- 2.47.3