added check for NULL values

- allow unspecified value in struct pam_data to be NULL
 - check if domain structure is initialized in pam_reply

3 files changed, 8 insertions, 9 deletions

diff --git a/server/providers/dp_auth_util.c b/server/providers/dp_auth_util.c
index 630dafe8..366a3fb2 100644
--- a/server/providers/dp_auth_util.c
+++ b/server/providers/dp_auth_util.c
@@ -59,6 +59,13 @@ bool dp_pack_pam_request(DBusMessage *msg, struct pam_data *pd)
 {
     int ret;
 
+    if (pd->user == NULL || pd->domain == NULL) return false;
+    if (pd->service == NULL) pd->service = "";
+    if (pd->tty == NULL) pd->tty = "";
+    if (pd->ruser == NULL) pd->ruser = "";
+    if (pd->rhost == NULL) pd->rhost = "";
+
+
     ret = dbus_message_append_args(msg,
                                    DBUS_TYPE_INT32,  &(pd->cmd),
                                    DBUS_TYPE_STRING, &(pd->domain),
diff --git a/server/responder/pam/pamsrv_cmd.c b/server/responder/pam/pamsrv_cmd.c
index 6d3f8991..df0cba45 100644
--- a/server/responder/pam/pamsrv_cmd.c
+++ b/server/responder/pam/pamsrv_cmd.c
@@ -141,6 +141,7 @@ static void pam_reply(struct pam_auth_req *preq)
     DEBUG(4, ("pam_reply get called.\n"));
 
     if ((pd->cmd == SSS_PAM_AUTHENTICATE) &&
+        (preq->domain != NULL) &&
         (preq->domain->cache_credentials == true) &&
         (pd->offline_auth == false)) {
 
diff --git a/server/responder/pam/pamsrv_dp.c b/server/responder/pam/pamsrv_dp.c
index f352b270..fadb284a 100644
--- a/server/responder/pam/pamsrv_dp.c
+++ b/server/responder/pam/pamsrv_dp.c
@@ -88,15 +88,6 @@ int pam_dp_send_req(struct pam_auth_req *preq, int timeout)
     DBusConnection *conn;
     dbus_bool_t ret;
 
-    if ((pd->domain == NULL) ||
-        (pd->user == NULL) ||
-        (pd->service == NULL) ||
-        (pd->tty == NULL) ||
-        (pd->ruser == NULL) ||
-        (pd->rhost == NULL) ) {
-        return EINVAL;
-    }
-
     /* double check dp_ctx has actually been initialized.
      * in some pathological cases it may happen that nss starts up before
      * dp connection code is actually able to establish a connection.