r18158: Stop winbindd from accumulating memory creds infinitely when doing

pam offline logons.

Guenther
(This used to be commit 95788cb291b89b431972e29e148b412992cc32a5)

1 files changed, 21 insertions, 12 deletions

diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c
index 9bad738d51..efdd0e874f 100644
--- a/source3/nsswitch/winbindd_pam.c
+++ b/source3/nsswitch/winbindd_pam.c
@@ -1865,22 +1865,26 @@ void winbindd_pam_logoff(struct winbindd_cli_state *state)
 	state->request.data.logoff.krb5ccname
 		[sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
 
-	parse_domain_user(state->request.data.logoff.user, name_domain, user);
-
-	domain = find_auth_domain(state, name_domain);
+	if (!parse_domain_user(state->request.data.logoff.user, name_domain, user)) {
+		goto failed;
+	}
 
-	if (domain == NULL) {
-		set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
-		DEBUG(5, ("Pam Logoff for %s returned %s "
-			  "(PAM: %d)\n",
-			  state->request.data.auth.user, 
-			  state->response.data.auth.nt_status_string,
-			  state->response.data.auth.pam_error));
-		request_error(state);
-		return;
+	if ((domain = find_auth_domain(state, name_domain)) == NULL) {
+		goto failed;
 	}
 
 	sendto_domain(state, domain);
+	return;
+
+ failed:
+	set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
+	DEBUG(5, ("Pam Logoff for %s returned %s "
+		  "(PAM: %d)\n",
+		  state->request.data.auth.user, 
+		  state->response.data.auth.nt_status_string,
+		  state->response.data.auth.pam_error));
+	request_error(state);
+	return;
 }
 
 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
@@ -1899,6 +1903,11 @@ enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
 		goto process_result;
 	}
 
+	if (state->request.data.logoff.krb5ccname[0] == '\0') {
+		result = NT_STATUS_OK;
+		goto process_result;
+	}
+
 #ifdef HAVE_KRB5
 	
 	if (state->request.data.logoff.uid < 0) {