summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2010-09-16 17:20:08 +1000
committerAndrew Tridgell <tridge@samba.org>2010-09-16 21:09:17 +1000
commitd5a4e53ad8dd572b9469530dfcd37601e2905a88 (patch)
treed1e13f810598339f3d5463edc7af31a6b00dae4d /source4
parentdc59de562774a1ee09e3c819c3523e66da975f24 (diff)
downloadsamba-d5a4e53ad8dd572b9469530dfcd37601e2905a88.tar.gz
samba-d5a4e53ad8dd572b9469530dfcd37601e2905a88.tar.bz2
samba-d5a4e53ad8dd572b9469530dfcd37601e2905a88.zip
s4-kdc: prevent segfault on bad trust strings
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4')
-rw-r--r--source4/kdc/db-glue.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index 8e311b439b..68f1e4b88b 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -1041,7 +1041,6 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
krb5_error_code ret;
struct ldb_message *msg = NULL;
struct ldb_dn *realm_dn = ldb_get_default_basedn(kdc_db_ctx->samdb);
- const char *realm;
krb5_principal alloc_principal = NULL;
if (principal->name.name_string.len != 2
@@ -1109,6 +1108,7 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
} else {
enum trust_direction direction = UNKNOWN;
+ const char *realm = NULL;
/* Either an inbound or outbound trust */
@@ -1116,12 +1116,16 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
/* look for inbound trust */
direction = INBOUND;
realm = principal->name.name_string.val[1];
- }
-
- if (strcasecmp(lpcfg_realm(lp_ctx), principal->name.name_string.val[1]) == 0) {
+ } else if (strcasecmp(lpcfg_realm(lp_ctx), principal->name.name_string.val[1]) == 0) {
/* look for outbound trust */
direction = OUTBOUND;
realm = principal->realm;
+ } else {
+ krb5_warnx(context, "samba_kdc_fetch: not our realm for trusts ('%s', '%s')",
+ principal->realm, principal->name.name_string.val[1]);
+ krb5_set_error_message(context, HDB_ERR_NOENTRY, "samba_kdc_fetch: not our realm for trusts ('%s', '%s')",
+ principal->realm, principal->name.name_string.val[1]);
+ return HDB_ERR_NOENTRY;
}
/* Trusted domains are under CN=system */