From efdf2c3931f9d5a38ad300de79780509c29c611f Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Thu, 8 Aug 2013 00:06:58 -0600 Subject: [PATCH] Handle NTLM helper returning OK without user= value Prevent crash by treating this case as an error and failed authentication Detected by Coverity Scan. Issue 1020656. --- src/auth/ntlm/UserRequest.cc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/auth/ntlm/UserRequest.cc b/src/auth/ntlm/UserRequest.cc index a7516be83a..01300609ec 100644 --- a/src/auth/ntlm/UserRequest.cc +++ b/src/auth/ntlm/UserRequest.cc @@ -255,6 +255,13 @@ Auth::Ntlm::UserRequest::HandleReply(void *data, const HelperReply &reply) case HelperReply::Okay: { /* we're finished, release the helper */ const char *userLabel = reply.notes.findFirst("user"); + if (!userLabel) { + auth_user_request->user()->credentials(Auth::Failed); + safe_free(lm_request->server_blob); + lm_request->releaseAuthServer(); + debugs(29, DBG_CRITICAL, "ERROR: NTLM Authentication helper returned no username. Result: " << reply); + break; + } auth_user_request->user()->username(userLabel); auth_user_request->denyMessage("Login successful"); safe_free(lm_request->server_blob); -- 2.47.2