s3: Fix crash in pam_winbind, another reference to freed memory.

Fix bug #6840.

Signed-off-by: Bo Yang <boyang@samba.org>
(cherry picked from commit 1791b1cc43ce744c73b473aff0e311acbdf0ee4e)

diff --git a/source/nsswitch/pam_winbind.c b/source/nsswitch/pam_winbind.c
index 3d0c5ef90e577f72c612e968b8db1c2e1ce8b427..74540817af0d6574d35e7b4691de84ab3ce68398 100644 (file)
--- a/source/nsswitch/pam_winbind.c
+++ b/source/nsswitch/pam_winbind.c
@@ -1784,7 +1784,7 @@ static int winbind_auth_request(struct pwb_context *ctx,
        if (logon.blobs) {
                wbcFreeMemory(logon.blobs);
        }
-       if (info && info->blobs) {
+       if (info && info->blobs && !p_info) {
                wbcFreeMemory(info->blobs);
        }
        if (error && !p_error) {
@@ -3138,10 +3138,14 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
                                        free(username_ret);
                                }
 
-                               wbcFreeMemory(info);
-                               wbcFreeMemory(policy);
                        }
 
+                       if (info && info->blobs) {
+                               wbcFreeMemory(info->blobs);
+                       }
+                       wbcFreeMemory(info);
+                       wbcFreeMemory(policy);
+
                        goto out;
                }
        } else {