dcerpc: NULL pointer deref crash in handling rpc request.
authorJeremy Allison <jra@samba.org>
Thu, 18 Jun 2015 16:57:42 +0000 (09:57 -0700)
committerJeremy Allison <jra@samba.org>
Thu, 18 Jun 2015 17:25:27 +0000 (19:25 +0200)
commit5deb8169fecef108b4f8010446398475ba8b46de
tree162d65bc7dd23b8fac8bd46dede1ee76591fc28c
parenta680d605a72716f20d5cae3635b681de9c71abda
dcerpc: NULL pointer deref crash in handling rpc request.

source4/rpc_server/dcerpc_server.c:dcesrv_request() calls gensec_have_feature().

Codenomicon found a code path that allows the client to send a
request that calls into this function without ever having set
up security. So call->conn->auth_state.gensec_security exists
(gensec has been initialized when the RPC pipe is set up)
but call->conn->auth_state.gensec_security->ops has not been
initialized. We dereference the NULL pointer and crash.

An alternate way to fix this would be to create a new
public bool gensec_initialized(() function and call that
inside dcesrv_request() instead of doing a null
check on call->conn->auth_state.gensec_security,
but that's a more invasive fix we can add later.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11341

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
auth/gensec/gensec.c