From 10f8979e6b7457ddda29bb24abf0bf20b2128d43 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Sat, 3 Aug 2013 19:23:53 +1200 Subject: [PATCH] Polish: handle NTLM helper returning OK without user= value Prevent crash by treating this case as an error and failed authentication Detected by Coverity Scan. Issue 1020656. --- src/auth/ntlm/UserRequest.cc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/auth/ntlm/UserRequest.cc b/src/auth/ntlm/UserRequest.cc index a7516be83a..01300609ec 100644 --- a/src/auth/ntlm/UserRequest.cc +++ b/src/auth/ntlm/UserRequest.cc @@ -255,6 +255,13 @@ Auth::Ntlm::UserRequest::HandleReply(void *data, const HelperReply &reply) case HelperReply::Okay: { /* we're finished, release the helper */ const char *userLabel = reply.notes.findFirst("user"); + if (!userLabel) { + auth_user_request->user()->credentials(Auth::Failed); + safe_free(lm_request->server_blob); + lm_request->releaseAuthServer(); + debugs(29, DBG_CRITICAL, "ERROR: NTLM Authentication helper returned no username. Result: " << reply); + break; + } auth_user_request->user()->username(userLabel); auth_user_request->denyMessage("Login successful"); safe_free(lm_request->server_blob); -- 2.47.3