summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGünther Deschner <gd@samba.org>2006-12-15 16:45:39 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 12:16:31 -0500
commitb49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4 (patch)
tree735fdfb5e0bdc1543561d7cdfc9d3c72720bb066
parent69d4146042e6d35c439d1dd42e4b284d0ddcf1ef (diff)
downloadsamba-b49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4.tar.gz
samba-b49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4.tar.bz2
samba-b49f0ae01875a2f4fd8f56c8cd2d4ff42b998ef4.zip
r20186: Fix winbind crash bug in WINBIND_GETGROUPS.
response_extra_sent() expects to free a malloced extra_data.data while the add_XX_to_array functions all return talloced memory now. Jeremy, please check. Guenther (This used to be commit 9f34c9f3695757819d728a17a1497247ea479ebf)
-rw-r--r--source3/nsswitch/winbindd_group.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/source3/nsswitch/winbindd_group.c b/source3/nsswitch/winbindd_group.c
index 612147043e..deee07413c 100644
--- a/source3/nsswitch/winbindd_group.c
+++ b/source3/nsswitch/winbindd_group.c
@@ -1217,7 +1217,7 @@ static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid)
(struct getgroups_state *)private_data;
if (success) {
- if (!add_gid_to_array_unique(NULL, gid,
+ if (!add_gid_to_array_unique(s->state->mem_ctx, gid,
&s->token_gids,
&s->num_token_gids)) {
return;
@@ -1239,7 +1239,8 @@ static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid)
}
s->state->response.data.num_entries = s->num_token_gids;
- s->state->response.extra_data.data = s->token_gids;
+ /* s->token_gids are talloced */
+ s->state->response.extra_data.data = smb_xmemdup(s->token_gids, s->num_token_gids * sizeof(gid_t));
s->state->response.length += s->num_token_gids * sizeof(gid_t);
request_ok(s->state);
}