ipa-kdb: avoid ENOMEM when all SIDs are filtered out

When all SIDs in info3.sids structure were filtered out, we tried
to talloc_realloc to zero memory size. talloc_realloc then returned
NULL pointer and filter_login_info returned with ENOMEM.

The code now rather frees the SID array and set info3.sidcount to
correct value.

1 files changed, 14 insertions, 4 deletions

diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c
index ee1c6124f..7307071a0 100644
--- a/daemons/ipa-kdb/ipa_kdb_mspac.c
+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c
@@ -1288,11 +1288,21 @@ static krb5_error_code filter_logon_info(krb5_context context,
         } while (i < count);
 
         if (j != 0) {
-            info->info->info3.sids = talloc_realloc(memctx, info->info->info3.sids, struct netr_SidAttr, count-j);
-            info->info->info3.sidcount = count-j;
-            if (!info->info->info3.sids) {
+            count = count-j;
+            if (count == 0) {
+                /* All SIDs were filtered out */
                 info->info->info3.sidcount = 0;
-                return ENOMEM;
+                talloc_free(info->info->info3.sids);
+                info->info->info3.sids = NULL;
+            } else {
+                info->info->info3.sids = talloc_realloc(memctx,
+                                                        info->info->info3.sids,
+                                                        struct netr_SidAttr, count);
+                if (!info->info->info3.sids) {
+                    info->info->info3.sidcount = 0;
+                    return ENOMEM;
+                }
+                info->info->info3.sidcount = count;
             }
         }
     }