diff options
| author | Stephen Gallagher <sgallagh@redhat.com> | 2011-10-25 15:19:02 -0400 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2011-10-25 16:18:47 -0400 |
| commit | f5379d2cd137c4667ec3e0047ba9b96fe4edf161 (patch) | |
| tree | 2487f0adaee73ea9247b08b9d6d4255f64907e6f | |
| parent | 8d955c29b4f1f3694629175102cba9060d6f166a (diff) | |
| download | sssd_unused-f5379d2cd137c4667ec3e0047ba9b96fe4edf161.tar.gz sssd_unused-f5379d2cd137c4667ec3e0047ba9b96fe4edf161.tar.xz sssd_unused-f5379d2cd137c4667ec3e0047ba9b96fe4edf161.zip | |
RESPONDER: Fix segfault in sss_packet_send()
There are several places (all error-handling) where sss_cmd_done()
is called with no response packet created. As a short-term
solution, we need to check whether the packet is NULL and simply
return EINVAL. client_send() (the consumer) will then forcibly
disconnect the client (which will return PAM_SYSTEM_ERR to the
client).
| -rw-r--r-- | src/responder/common/responder_packet.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c index d308ecd4..5132d955 100644 --- a/src/responder/common/responder_packet.c +++ b/src/responder/common/responder_packet.c @@ -217,6 +217,11 @@ int sss_packet_send(struct sss_packet *packet, int fd) size_t len; void *buf; + if (!packet) { + /* No packet object to write to? */ + return EINVAL; + } + buf = packet->buffer + packet->iop; len = *packet->len - packet->iop; |