From 2a39ca97af97ddd508262eab33e5a0fa6abc4b00 Mon Sep 17 00:00:00 2001 From: Nalin Dahyabhai Date: Mon, 14 Jan 2013 13:57:54 -0500 Subject: Don't fail if a candidate certificate has no SANs When we're doing certificate matching and we're asked for the list of SAN values for a certifiate, and it contains none, don't return an error, as that will eventually cause the module to just return an error. Instead, just return an empty list of SAN values so that processing will continue on to check if other certificates match. --- src/plugins/preauth/pkinit/pkinit_crypto_nss.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) (limited to 'src') diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c index 26901986b..1aae6147f 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c @@ -3161,12 +3161,8 @@ crypto_cert_get_matching_data(krb5_context context, md->ku_bits = cert_get_ku_bits(context, cert_handle->cert); md->eku_bits = cert_get_eku_bits(context, cert_handle->cert, PR_FALSE); if (cert_retrieve_cert_sans(context, cert_handle->cert, - &md->sans, &md->sans, NULL) != 0) { - free(md->subject_dn); - free(md->issuer_dn); - free(md); - return ENOMEM; - } + &md->sans, &md->sans, NULL) != 0) + md->sans = NULL; *ret_data = md; return 0; } -- cgit