diff options
| author | Günther Deschner <gd@samba.org> | 2006-12-15 16:45:39 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 12:16:31 -0500 |
| commit | b49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4 (patch) | |
| tree | 735fdfb5e0bdc1543561d7cdfc9d3c72720bb066 | |
| parent | 69d4146042e6d35c439d1dd42e4b284d0ddcf1ef (diff) | |
| download | samba-b49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4.tar.gz samba-b49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4.tar.bz2 samba-b49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4.zip | |
r20186: Fix winbind crash bug in WINBIND_GETGROUPS.
response_extra_sent() expects to free a malloced
extra_data.data while the add_XX_to_array functions all return talloced
memory now. Jeremy, please check.
Guenther
(This used to be commit 9f34c9f3695757819d728a17a1497247ea479ebf)
| -rw-r--r-- | source3/nsswitch/winbindd_group.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/source3/nsswitch/winbindd_group.c b/source3/nsswitch/winbindd_group.c index 612147043e..deee07413c 100644 --- a/source3/nsswitch/winbindd_group.c +++ b/source3/nsswitch/winbindd_group.c @@ -1217,7 +1217,7 @@ static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid) (struct getgroups_state *)private_data; if (success) { - if (!add_gid_to_array_unique(NULL, gid, + if (!add_gid_to_array_unique(s->state->mem_ctx, gid, &s->token_gids, &s->num_token_gids)) { return; @@ -1239,7 +1239,8 @@ static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid) } s->state->response.data.num_entries = s->num_token_gids; - s->state->response.extra_data.data = s->token_gids; + /* s->token_gids are talloced */ + s->state->response.extra_data.data = smb_xmemdup(s->token_gids, s->num_token_gids * sizeof(gid_t)); s->state->response.length += s->num_token_gids * sizeof(gid_t); request_ok(s->state); } |