Skip to content

Commit

Permalink
Check for null name_type in gss_display_name_ext
Browse files Browse the repository at this point in the history
It is possible for the input name's name_type to be GSS_C_NO_OID.
g_OID_equal() does not account for GSS_C_NO_OID, so we have to
manually check before use to prevent null pointer dereferences.

ticket: 8238 (new)
target_version: 1.13.3
tags: pullup
  • Loading branch information
DirectXMan12 authored and greghudson committed Aug 31, 2015
1 parent f9e79bf commit 3fdf09a
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion src/lib/gssapi/mechglue/g_dsp_name_ext.c
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ gss_display_name_ext (OM_uint32 *minor_status,
status = GSS_S_BAD_NAME;
else if (mech->gss_display_name_ext == NULL) {
if (mech->gss_display_name != NULL &&
union_name->name_type != GSS_C_NO_OID &&
g_OID_equal(display_as_name_type, union_name->name_type)) {
status = (*mech->gss_display_name)(minor_status,
union_name->mech_name,
Expand All @@ -114,7 +115,8 @@ gss_display_name_ext (OM_uint32 *minor_status,
return status;
}

if (!g_OID_equal(display_as_name_type, union_name->name_type))
if (union_name->name_type == GSS_C_NO_OID ||
!g_OID_equal(display_as_name_type, union_name->name_type))
return GSS_S_UNAVAILABLE;

if ((output_name_buffer->value =
Expand Down

0 comments on commit 3fdf09a

Please sign in to comment.