Do not modify IPA_DOMAIN when setting Kerberos realm

1 files changed, 20 insertions, 6 deletions

diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 368117204..2ef674e74 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -281,11 +281,17 @@ int ipa_get_id_options(struct ipa_options *ipa_opts,
     /* set krb realm */
     if (NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_KRB5_REALM)) {
         realm = dp_opt_get_string(ipa_opts->basic, IPA_DOMAIN);
-        for (i = 0; realm[i]; i++) {
-            realm[i] = toupper(realm[i]);
+        value = talloc_strdup(tmpctx, realm);
+        if (value == NULL) {
+            DEBUG(1, ("talloc_strdup failed.\n"));
+            ret = ENOMEM;
+            goto done;
+        }
+        for (i = 0; value[i]; i++) {
+            value[i] = toupper(value[i]);
         }
         ret = dp_opt_set_string(ipa_opts->id->basic,
-                                SDAP_KRB5_REALM, realm);
+                                SDAP_KRB5_REALM, value);
         if (ret != EOK) {
             goto done;
         }
@@ -369,6 +375,7 @@ int ipa_get_auth_options(struct ipa_options *ipa_opts,
                          struct dp_option **_opts)
 {
     char *value;
+    char *copy = NULL;
     int ret;
     int i;
 
@@ -401,10 +408,16 @@ int ipa_get_auth_options(struct ipa_options *ipa_opts,
             ret = ENOMEM;
             goto done;
         }
-        for (i = 0; value[i]; i++) {
-            value[i] = toupper(value[i]);
+        copy = talloc_strdup(ipa_opts->auth, value);
+        if (copy == NULL) {
+            DEBUG(1, ("talloc_strdup failed.\n"));
+            ret = ENOMEM;
+            goto done;
+        }
+        for (i = 0; copy[i]; i++) {
+            copy[i] = toupper(copy[i]);
         }
-        ret = dp_opt_set_string(ipa_opts->auth, KRB5_REALM, value);
+        ret = dp_opt_set_string(ipa_opts->auth, KRB5_REALM, copy);
         if (ret != EOK) {
             goto done;
         }
@@ -417,6 +430,7 @@ int ipa_get_auth_options(struct ipa_options *ipa_opts,
     ret = EOK;
 
 done:
+    talloc_free(copy);
     if (ret != EOK) {
         talloc_zfree(ipa_opts->auth);
     }