[SSSD] [PATCH] Fix a double free bug

Sumit Bose sbose at redhat.com
Mon Jan 18 19:17:52 UTC 2010


Hi,

this patch fixes a double free bug in the PAM responder.

bye,
Sumit
-------------- next part --------------
From b34ce18ffd426d93fcacc3bc815c1b7d89c1d569 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 18 Jan 2010 20:06:30 +0100
Subject: [PATCH] Fix a double free bug

---
 server/responder/pam/pamsrv_cmd.c |    3 ---
 1 files changed, 0 insertions(+), 3 deletions(-)

diff --git a/server/responder/pam/pamsrv_cmd.c b/server/responder/pam/pamsrv_cmd.c
index ca41d64..8a7ccd9 100644
--- a/server/responder/pam/pamsrv_cmd.c
+++ b/server/responder/pam/pamsrv_cmd.c
@@ -687,7 +687,6 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
     if (blen >= sizeof(uint32_t) &&
         ((uint32_t *)(&body[blen - sizeof(uint32_t)]))[0] != END_OF_PAM_REQUEST) {
         DEBUG(1, ("Received data not terminated.\n"));
-        talloc_free(preq);
         ret = EINVAL;
         goto done;
     }
@@ -711,7 +710,6 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
             ret = EINVAL;
     }
     if (ret != EOK) {
-        talloc_free(preq);
         ret = EINVAL;
         goto done;
     }
@@ -722,7 +720,6 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
             if (strcasecmp(dom->name, pd->domain) == 0) break;
         }
         if (!dom) {
-            talloc_free(preq);
             ret = ENOENT;
             goto done;
         }
-- 
1.6.5.2



More information about the sssd-devel mailing list