From: Volker Lendecke <vl@samba.org>
Date: Mon, 6 Jul 2026 11:34:11 +0000 (+0200)
Subject: gensec: Fix a use-after-free error in gensec_external
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=508a3bbff0aba23cb0a1a08aaa7f62dcd4cb84d6;p=thirdparty%2Fsamba.git

gensec: Fix a use-after-free error in gensec_external

.length is 0, but the pointer we hand out will be != NULL but free'ed
in the tevent_req_received()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
---

diff --git a/auth/gensec/external.c b/auth/gensec/external.c
index 300ce6b5cb3..db8a870170b 100644
--- a/auth/gensec/external.c
+++ b/auth/gensec/external.c
@@ -90,7 +90,11 @@ static NTSTATUS gensec_external_update_recv(struct tevent_req *req,
 		return status;
 	}
 
-	*out = state->out;
+	*out = (DATA_BLOB){
+		.data = talloc_move(out_mem_ctx, &state->out.data),
+		.length = state->out.length,
+	};
+
 	tevent_req_received(req);
 	return NT_STATUS_OK;
 }