>From 6206f80523da866145f52bb2577b80ea2bbea9a0 Mon Sep 17 00:00:00 2001 From: Matthew Newton Date: Thu, 8 Jan 2015 15:11:15 +0000 Subject: [PATCH] Make sure response->extra_data.data is always cleared out Otherwise a bad read can sometimes cause the function to return -1 with an invalid pointer in extra_data.data, which is attempted to be freed by the caller (e.g. libwbclient/wbc_pam.c wbcAuthenticateUserEx()) by calling winbindd_free_response(). --- nsswitch/wb_common.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/nsswitch/wb_common.c b/nsswitch/wb_common.c index 44bfaf4..3b67df0 100644 --- a/nsswitch/wb_common.c +++ b/nsswitch/wb_common.c @@ -552,6 +552,13 @@ static int winbindd_read_reply(struct winbindd_response *response) result1 = winbind_read_sock(response, sizeof(struct winbindd_response)); + + /* We actually send the pointer value of the extra_data field from + the server. This has no meaning in the client's address space + so we clear it out. */ + + response->extra_data.data = NULL; + if (result1 == -1) { return -1; } @@ -560,12 +567,6 @@ static int winbindd_read_reply(struct winbindd_response *response) return -1; } - /* We actually send the pointer value of the extra_data field from - the server. This has no meaning in the client's address space - so we clear it out. */ - - response->extra_data.data = NULL; - /* Read variable length response */ if (response->length > sizeof(struct winbindd_response)) { -- 1.7.10.4