diff options
| author | Günther Deschner <gd@samba.org> | 2006-12-15 16:45:39 +0000 |
|---|---|---|
| committer | Günther Deschner <gd@samba.org> | 2006-12-15 16:45:39 +0000 |
| commit | 455d94f16e7cadf5e8d4f55d3b6e75e0403cf964 (patch) | |
| tree | 26bd8e4741370a9e0aeb582b1cdfd3589a26e6dd | |
| parent | faa81fb85929134d062df6a702a6d21493683bc9 (diff) | |
| download | samba-455d94f16e7cadf5e8d4f55d3b6e75e0403cf964.tar.gz samba-455d94f16e7cadf5e8d4f55d3b6e75e0403cf964.tar.xz samba-455d94f16e7cadf5e8d4f55d3b6e75e0403cf964.zip | |
r20186: Fix winbind crash bug in WINBIND_GETGROUPS.
response_extra_sent() expects to free a malloced
extra_data.data while the add_XX_to_array functions all return talloced
memory now. Jeremy, please check.
Guenther
| -rw-r--r-- | source/nsswitch/winbindd_group.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/source/nsswitch/winbindd_group.c b/source/nsswitch/winbindd_group.c index 612147043e6..deee07413c4 100644 --- a/source/nsswitch/winbindd_group.c +++ b/source/nsswitch/winbindd_group.c @@ -1217,7 +1217,7 @@ static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid) (struct getgroups_state *)private_data; if (success) { - if (!add_gid_to_array_unique(NULL, gid, + if (!add_gid_to_array_unique(s->state->mem_ctx, gid, &s->token_gids, &s->num_token_gids)) { return; @@ -1239,7 +1239,8 @@ static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid) } s->state->response.data.num_entries = s->num_token_gids; - s->state->response.extra_data.data = s->token_gids; + /* s->token_gids are talloced */ + s->state->response.extra_data.data = smb_xmemdup(s->token_gids, s->num_token_gids * sizeof(gid_t)); s->state->response.length += s->num_token_gids * sizeof(gid_t); request_ok(s->state); } |