diff options
| author | Stephen Gallagher <sgallagh@redhat.com> | 2011-10-25 15:19:02 -0400 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2011-10-25 16:18:41 -0400 |
| commit | 7923209b738b591fc01ccfee2cfca4ecfb7cd6dd (patch) | |
| tree | 9cd7b46e0cfdedc14d1b667810986b5e8b844634 | |
| parent | f4e521c0fe91f0f46391898542a76169d3554cf8 (diff) | |
| download | sssd-7923209b738b591fc01ccfee2cfca4ecfb7cd6dd.tar.gz sssd-7923209b738b591fc01ccfee2cfca4ecfb7cd6dd.tar.xz sssd-7923209b738b591fc01ccfee2cfca4ecfb7cd6dd.zip | |
RESPONDER: Fix segfault in sss_packet_send()
There are several places (all error-handling) where sss_cmd_done()
is called with no response packet created. As a short-term
solution, we need to check whether the packet is NULL and simply
return EINVAL. client_send() (the consumer) will then forcibly
disconnect the client (which will return PAM_SYSTEM_ERR to the
client).
| -rw-r--r-- | src/responder/common/responder_packet.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c index d308ecd43..5132d955b 100644 --- a/src/responder/common/responder_packet.c +++ b/src/responder/common/responder_packet.c @@ -217,6 +217,11 @@ int sss_packet_send(struct sss_packet *packet, int fd) size_t len; void *buf; + if (!packet) { + /* No packet object to write to? */ + return EINVAL; + } + buf = packet->buffer + packet->iop; len = *packet->len - packet->iop; |