Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gssapi: improve handling of errors from gss_display_status #8832

Closed
wants to merge 1 commit into from

Conversation

danielgustafsson
Copy link
Member

@danielgustafsson danielgustafsson commented May 11, 2022

In case gss_display_status() returns an error, avoid trying to add
it to the buffer as the message may well be a NULL pointer. While
there, also initialize the status_string variable correctly.

Originally this fix comes from a discussion in issue #8816.

Closes: #xxxx
Reviewed-by: xxxx

In case gss_display_status() returns an error, avoid trying to add
it to the buffer as the message may well be a NULL pointer.  While
there, also initialize the status_string variable correctly.

Originally this fix comes from a discussion in issue curl#8816.

Closes: #xxxx
Reviewed-by: xxxx
@danielgustafsson danielgustafsson requested a review from jay May 11, 2022
jay
jay approved these changes May 12, 2022
Copy link
Member

@jay jay left a comment

status_string is also missing an initialization in socks_gssapi, you could amend for that or if not i will add it in a separate commit

diff --git a/lib/socks_gssapi.c b/lib/socks_gssapi.c
index 8ef2f8f..0895d94 100644
--- a/lib/socks_gssapi.c
+++ b/lib/socks_gssapi.c
@@ -51,7 +51,7 @@ static int check_gss_err(struct Curl_easy *data,
   if(GSS_ERROR(major_status)) {
     OM_uint32 maj_stat, min_stat;
     OM_uint32 msg_ctx = 0;
-    gss_buffer_desc status_string;
+    gss_buffer_desc status_string = GSS_C_EMPTY_BUFFER;
     char buf[1024];
     size_t len;
 

@danielgustafsson
Copy link
Member Author

@danielgustafsson danielgustafsson commented May 12, 2022

jay referenced this issue May 14, 2022
Explicitly initialize gss_buffer_desc strings such that a call to
freeing resources will succeed even if no data has been allocated
to it.

Reported-by: Jay Satiro <raysatiro@yahoo.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants