From a9463b204f8431e9aa142acb36f3c0d33c841623 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 27 Mar 2020 10:13:11 +0100 Subject: [PATCH] nsswitch: fix use-after-free causing segfault in _pam_delete_cred MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=14327 Guenther Signed-off-by: Guenther Deschner Reviewed-by: Alexander Bokovoy Autobuild-User(master): Günther Deschner Autobuild-Date(master): Mon Mar 30 13:01:20 UTC 2020 on sn-devel-184 (cherry picked from commit 047b0d8ab534c7a10a8572fd9f21e2456fd30710) --- nsswitch/pam_winbind.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c index 3ad70d3c4cd..7af03fe2bd0 100644 --- a/nsswitch/pam_winbind.c +++ b/nsswitch/pam_winbind.c @@ -2609,7 +2609,6 @@ static int _pam_delete_cred(pam_handle_t *pamh, int flags, wbc_status = wbcCtxLogoffUserEx(ctx->wbc_ctx, &logoff, &error); retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status, user, "wbcLogoffUser"); - wbcFreeMemory(error); wbcFreeMemory(logoff.blobs); logoff.blobs = NULL; @@ -2629,6 +2628,7 @@ out: retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status, user, "wbcLogoffUser"); } + wbcFreeMemory(error); /* * Delete the krb5 ccname variable from the PAM environment -- 2.25.1