Check internal context in init_context mechglue call on error. #385
Conversation
|
I need a better understanding of the bug here. I didn't think it was possible to create a mechglue context with a NULL internal_ctx_id. |
|
On Tue, 2016-01-05 at 09:36 -0800, Greg Hudson wrote:
This is all I have for now: |
|
Simo and I believe we worked out what must have happened: on a second call to gss_init_sec_context(), SPNEGO gets an error and deletes its SPNEGO context, but the mechglue preserves the union context with a NULL internal_ctx_id pointer. I would like to see gss_init_sec_context() delete and null out the union context in this circumstance. gss_accept_sec_context() might need a similar change. |
If the mechanism clears out the context on error, the mechglue must do the same to avoid crashes if the application calls other functions with this invalid union context. Signed-off-by: Simo Sorce <simo@redhat.com>
simo5
force-pushed
the
spnego_inq_context
branch
from
c9bdd86
to
aa8ffc1
Compare
simo5
changed the title
|
Changed as requested, code now checks for internal_ctx_id on errors and clears the whole union context. Accept_sec_context already clears it all unconditioanlly on errors. |
|
Pushed to master as 3beb564 |
Seen crashes in the wild without this check as some code seem to end up
calling gss_inquire_context via the spnego mech before while the internal
context is still NULL.
Signed-off-by: Simo Sorce simo@redhat.com