gensec: Fix a use-after-free error in gensec_external

.length is 0, but the pointer we hand out will be != NULL but free'ed
in the tevent_req_received()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

diff --git a/auth/gensec/external.c b/auth/gensec/external.c
index 300ce6b5cb3e446ea7e28a0d0bc1d26637b0d019..db8a870170b61e2e1d7ab98aebfe9bf9e6d1f687 100644 (file)
--- a/auth/gensec/external.c
+++ b/auth/gensec/external.c
@@ -90,7 +90,11 @@ static NTSTATUS gensec_external_update_recv(struct tevent_req *req,
                return status;
        }
 
-       *out = state->out;
+       *out = (DATA_BLOB){
+               .data = talloc_move(out_mem_ctx, &state->out.data),
+               .length = state->out.length,
+       };
+
        tevent_req_received(req);
        return NT_STATUS_OK;
 }