Fix segfault in init context.

The init context function was improperly initializing the ctx variable (too
late) when some early error conditions can happen. Therefore passing to the
delete context function a random memory address it would then try to free.
This wuld cause a SEGFAULT in most cases.

Additionally unfortunately iconv_close() does not follow good practices and
blindignly dereferences data, even if the passed in pointer is NULL.
So add a check before calling.

2 files changed, 11 insertions, 6 deletions

diff --git a/src/gss_sec_ctx.c b/src/gss_sec_ctx.c
index df25daa..d55e9c6 100644
--- a/src/gss_sec_ctx.c
+++ b/src/gss_sec_ctx.c
@@ -63,6 +63,8 @@ uint32_t gssntlm_init_sec_context(uint32_t *minor_status,
     uint8_t sec_req;
     bool key_exch;
 
+    ctx = (struct gssntlm_ctx *)(*context_handle);
+
     /* reset return values */
     *minor_status = 0;
     if (actual_mech_type) *actual_mech_type = NULL;
@@ -105,8 +107,6 @@ uint32_t gssntlm_init_sec_context(uint32_t *minor_status,
         }
     }
 
-    ctx = (struct gssntlm_ctx *)(*context_handle);
-
     if (ctx == NULL) {
 
         /* first call */
diff --git a/src/ntlm.c b/src/ntlm.c
index af6d57a..b0729f1 100644
--- a/src/ntlm.c
+++ b/src/ntlm.c
@@ -193,12 +193,17 @@ int ntlm_free_ctx(struct ntlm_ctx **ctx)
 
     if (!ctx || !*ctx) return 0;
 
-    ret = iconv_close((*ctx)->from_oem);
-    if (ret) ret = errno;
+    if ((*ctx)->from_oem) {
+        ret = iconv_close((*ctx)->from_oem);
+        if (ret) goto done;
+    }
 
-    ret = iconv_close((*ctx)->to_oem);
-    if (ret) ret = errno;
+    if ((*ctx)->to_oem) {
+        ret = iconv_close((*ctx)->to_oem);
+    }
 
+done:
+    if (ret) ret = errno;
     safefree(*ctx);
     return ret;
 }