From 4676e823e6ee9a5731872b31c5588c1b5932e0a3 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 10 Jun 2015 19:48:51 -0400 Subject: [PATCH] Tolerate null oid pointer in gss_release_oid() Under some circumstances, gss_inquire_name() can call gss_release_oid() with a null oid pointer, which currently causes a null dereference. The least invasive fix is for gss_release_oid() to check for the invalid null pointer and return an error, like other GSS-API functions do. ticket: 8201 (new) target_version: 1.13.3 tags: pullup --- src/lib/gssapi/mechglue/g_initialize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c index 2987164edc..b7e8a8daf8 100644 --- a/src/lib/gssapi/mechglue/g_initialize.c +++ b/src/lib/gssapi/mechglue/g_initialize.c @@ -168,7 +168,7 @@ gss_OID *oid; OM_uint32 major; gss_mech_info aMech; - if (minor_status == NULL) + if (minor_status == NULL || oid == NULL) return (GSS_S_CALL_INACCESSIBLE_WRITE); *minor_status = gssint_mechglue_initialize_library(); -- 2.47.2