From 8899397ab78ea09b8d7dbb20347dd12c93eb15ee Mon Sep 17 00:00:00 2001 From: Nalin Dahyabhai Date: Tue, 9 Jul 2013 14:13:16 -0400 Subject: Make the PKINIT NSS path also check for NULL certs When called to free identity information, do what the OpenSSL-based version does, and error out if the identity information is NULL. --- src/plugins/preauth/pkinit/pkinit_crypto_nss.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/plugins') diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c index 1b2172c22..56a21702d 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c @@ -2985,7 +2985,12 @@ crypto_free_cert_info(krb5_context context, pkinit_req_crypto_context req_cryptoctx, pkinit_identity_crypto_context id_cryptoctx) { - return 0; /* Maybe should we nuke the id_certs list here? */ + /* Mimic the OpenSSL-based implementation's check first. */ + if (id_cryptoctx == NULL) + return EINVAL; + + /* Maybe should we nuke the id_certs list here? */ + return 0; } /* Count how many candidate "self" certificates and keys we have. We could as -- cgit