From: Volker Lendecke <vl@samba.org>
Date: Sat, 9 Jan 2010 19:22:00 +0000 (+0100)
Subject: s3: Fix a segfault in winbindd_dual_ccache_ntlm_auth()
X-Git-Tag: samba-4.0.0alpha11~31
X-Git-Url: http://git.samba.org/samba.git/?p=ira%2Fwip.git;a=commitdiff_plain;h=43c841b6bd92e987109df81b6b8a2b85f21b0181

s3: Fix a segfault in winbindd_dual_ccache_ntlm_auth()

ntlmssp_update allocates the reply_blob as a child of ntlmssp_state. This means
with ntlmss_end() it will be gone. winbindd_dual_ccache_ntlm_auth used the blob
after the ntlmssp_end().
---

diff --git a/source3/winbindd/winbindd_ccache_access.c b/source3/winbindd/winbindd_ccache_access.c
index 921110a0be5..2f71aaae527 100644
--- a/source3/winbindd/winbindd_ccache_access.c
+++ b/source3/winbindd/winbindd_ccache_access.c
@@ -116,7 +116,7 @@ static NTSTATUS do_ntlm_auth_with_hashes(const char *username,
 		data_blob_free(&reply);
 		goto done;
 	}
-	*auth_msg = reply;
+	*auth_msg = data_blob(reply.data, reply.length);
 	status = NT_STATUS_OK;
 
 done: