s4:auth: Have claims_data_encoded_claims_set() return a reference to the encoded...

Having the lifetime of the encoded claims be tied in a predictable
fashion to a caller‐controlled memory context is less prone to error.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/auth/session.c b/source4/auth/session.c
index 818fdf583dff3bf53e7de8a0b22037cf6d31bc86..8f98f75c65267826c6f6b8f2a486457c2b144fea 100644 (file)
--- a/source4/auth/session.c
+++ b/source4/auth/session.c
@@ -612,9 +612,13 @@ NTSTATUS claims_data_from_claims_set(TALLOC_CTX *claims_data_ctx,
  * From a ‘claims_data’ structure, return an encoded claims blob that can be put
  * into a PAC.
  */
-NTSTATUS claims_data_encoded_claims_set(struct claims_data *claims_data,
+NTSTATUS claims_data_encoded_claims_set(TALLOC_CTX *mem_ctx,
+                                       struct claims_data *claims_data,
                                        DATA_BLOB *encoded_claims_set_out)
 {
+       uint8_t *data = NULL;
+       size_t len;
+
        if (encoded_claims_set_out == NULL) {
                return NT_STATUS_INVALID_PARAMETER;
        }
@@ -643,7 +647,15 @@ NTSTATUS claims_data_encoded_claims_set(struct claims_data *claims_data,
                claims_data->flags |= CLAIMS_DATA_ENCODED_CLAIMS_PRESENT;
        }
 
-       *encoded_claims_set_out = claims_data->encoded_claims_set;
+       if (claims_data->encoded_claims_set.data != NULL) {
+               data = talloc_reference(mem_ctx, claims_data->encoded_claims_set.data);
+               if (data == NULL) {
+                       return NT_STATUS_NO_MEMORY;
+               }
+       }
+       len = claims_data->encoded_claims_set.length;
+
+       *encoded_claims_set_out = data_blob_const(data, len);
        return NT_STATUS_OK;
 }
 

diff --git a/source4/auth/session.h b/source4/auth/session.h
index 391fcc34bf75e8cb59c9a776504a267e8ca2323c..3258c807137d177792e49d8c4adc2ca30af81c1c 100644 (file)
--- a/source4/auth/session.h
+++ b/source4/auth/session.h
@@ -136,7 +136,8 @@ NTSTATUS claims_data_from_claims_set(TALLOC_CTX *claims_data_ctx,
  * From a ‘claims_data’ structure, return an encoded claims blob that can be put
  * into a PAC.
  */
-NTSTATUS claims_data_encoded_claims_set(struct claims_data *claims_data,
+NTSTATUS claims_data_encoded_claims_set(TALLOC_CTX *mem_ctx,
+                                       struct claims_data *claims_data,
                                        DATA_BLOB *encoded_claims_set_out);
 
 /*