jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-22 17:00:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix aklog segfault

Browse Source 
In auth_to_cell(), we only strdup() into the linkedcell argument
if there is a linkedCell in the current cellconf.  However, in
main(), we free linkedcell if it is non-NULL, but it is allocated
on the stack and could contain garbage.  free() chokes on such
garbage, causing aklog to abort().
If we copy nothing into linkedcell, set it to NULL so that we
do not attempt to free the bogus pointer.

Change-Id: I92905a5f17021ce1bc41909f5ceb1b0344456d93
Reviewed-on: http://gerrit.openafs.org/2213
Reviewed-by: Jeffrey Altman <jaltman@openafs.org>
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Derrick Brashear <shadow@dementia.org>
This commit is contained in:
Ben Kaduk 2010-06-17 00:27:51 -04:00 committed by Derrick Brashear
parent 196d2c7f9e
commit f8981f18df
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/aklog/aklog.c
View File

@ -968,11 +968,15 @@ auth_to_cell(krb5_context context, char *cell, char *realm, char **linkedcell)
if ((status = get_cellconfig(cell, &cellconf, &local_cell)))
return(status);
if (linkedcell != NULL && cellconf.linkedCell != NULL) {
*linkedcell = strdup(cellconf.linkedCell);
if (*linkedcell == NULL) {
status = ENOMEM;
goto out;
if (linkedcell != NULL) {
if (cellconf.linkedCell != NULL) {
*linkedcell = strdup(cellconf.linkedCell);
if (*linkedcell == NULL) {
status = ENOMEM;
goto out;
}
} else {
*linkedcell = NULL;
}
}