From 338e52a4dea6058d8f0bab3cea02d85bfc99f631 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 10 Jul 2014 05:28:36 +0200 Subject: [PATCH 1/2] libwbclient: allow only one initial_blob/challenge_blob in wbcCredentialCache() Bug: https://bugzilla.samba.org/show_bug.cgi?id=10692 Signed-off-by: Stefan Metzmacher --- nsswitch/libwbclient/wbc_pam.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/nsswitch/libwbclient/wbc_pam.c b/nsswitch/libwbclient/wbc_pam.c index bfd10b7..11b59f6 100644 --- a/nsswitch/libwbclient/wbc_pam.c +++ b/nsswitch/libwbclient/wbc_pam.c @@ -1207,6 +1207,25 @@ wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params, goto fail; } + for (i=0; inum_blobs; i++) { + if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) { + if (initial_blob != NULL) { + status = WBC_ERR_INVALID_PARAM; + goto fail; + } + initial_blob = ¶ms->blobs[i]; + continue; + } + if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) { + if (challenge_blob != NULL) { + status = WBC_ERR_INVALID_PARAM; + goto fail; + } + challenge_blob = ¶ms->blobs[i]; + continue; + } + } + if (params->domain_name != NULL) { status = wbcRequestResponse(WINBINDD_INFO, NULL, &response); if (!WBC_ERROR_IS_OK(status)) { @@ -1224,15 +1243,6 @@ wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params, } request.data.ccache_ntlm_auth.uid = getuid(); - for (i=0; inum_blobs; i++) { - if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) { - initial_blob = ¶ms->blobs[i]; - } - if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) { - challenge_blob = ¶ms->blobs[i]; - } - } - request.data.ccache_ntlm_auth.initial_blob_len = 0; request.data.ccache_ntlm_auth.challenge_blob_len = 0; request.extra_len = 0; -- 1.9.1 From db7620fe1ae38cd3571331bde6ac05788034e91c Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 10 Jul 2014 05:28:36 +0200 Subject: [PATCH 2/2] libwbclient: reject unknown named blobs in wbcCredentialCache() Bug: https://bugzilla.samba.org/show_bug.cgi?id=10692 Signed-off-by: Stefan Metzmacher --- nsswitch/libwbclient/wbc_pam.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nsswitch/libwbclient/wbc_pam.c b/nsswitch/libwbclient/wbc_pam.c index 11b59f6..a16de97 100644 --- a/nsswitch/libwbclient/wbc_pam.c +++ b/nsswitch/libwbclient/wbc_pam.c @@ -1224,6 +1224,8 @@ wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params, challenge_blob = ¶ms->blobs[i]; continue; } + status = WBC_ERR_INVALID_PARAM; + goto fail; } if (params->domain_name != NULL) { -- 1.9.1