[Sblim-commit] sfcb httpAdapter.c, 1.103, 1.104 ChangeLog, 1.754, 1.755 NEWS, 1.675, 1.676

[Chris B. <buc...@us...>]

Update of /cvsroot/sblim/sfcb
In directory vz-cvs-3.sog:/tmp/cvs-serv7775

Modified Files:
	httpAdapter.c ChangeLog NEWS 
Log Message:
[ 3512094 ] SFCB can leak PAM handles under error conditions

Index: NEWS
===================================================================
RCS file: /cvsroot/sblim/sfcb/NEWS,v
retrieving revision 1.675
retrieving revision 1.676
diff -u -d -r1.675 -r1.676
--- NEWS	30 Mar 2012 17:56:41 -0000	1.675
+++ NEWS	30 Mar 2012 21:51:31 -0000	1.676
@@ -66,6 +66,7 @@
 - 3408288 Safer Signal Handlers
 - 3441028 sblim-sfcb fails on large https requests
 - 3416054 Provider continues despite SIGSEGV
+- 3512094 SFCB can leak PAM handles under error conditions
 
 Changes in 1.3.13
 =================

Index: httpAdapter.c
===================================================================
RCS file: /cvsroot/sblim/sfcb/httpAdapter.c,v
retrieving revision 1.103
retrieving revision 1.104
diff -u -d -r1.103 -r1.104
--- httpAdapter.c	30 Mar 2012 02:33:43 -0000	1.103
+++ httpAdapter.c	30 Mar 2012 21:51:31 -0000	1.104
@@ -137,6 +137,14 @@
   const char* role;
 };
 typedef struct auth_extras AuthExtras;
+AuthExtras      extras = {NULL, NULL, NULL, NULL};
+
+void releaseAuthHandle() {
+  if (extras.release) {
+     extras.release(extras.authHandle);
+     extras.release = NULL;
+  }
+}
 
 typedef int     (*Authenticate) (char *principal, char *pwd);
 typedef int     (*Authenticate2) (char *principal, char *pwd, AuthExtras *extras);
@@ -210,7 +218,7 @@
  * Call the authentication library
  * Return 1 on success, 0 on fail, -1 on expired
  */
-int baValidate(char *cred, char **principal, AuthExtras* extras)
+int baValidate(char *cred, char **principal)
 {
    char *auth,*pw=NULL;
    int i;
@@ -253,7 +261,7 @@
   else {
      *principal=strdup(auth);
      if (authenticate2)
-       ret = authenticate2(auth, pw, extras);
+       ret = authenticate2(auth, pw, &extras);
      else 
        ret = authenticate(auth, pw);
 
@@ -963,7 +971,6 @@
        }
    }
 #endif
-   AuthExtras      extras = {NULL, NULL, NULL, NULL};
 
    if (!authorized && !discardInput && doBa) {
 
@@ -982,7 +989,7 @@
           extras.clientIp = ipstr;
 	//	fprintf(stderr, "client is: %s\n", ipstr);
 
-       barc = baValidate(inBuf.authorization,&inBuf.principal,&extras);
+       barc = baValidate(inBuf.authorization,&inBuf.principal);
 #ifdef ALLOW_UPDATE_EXPIRED_PW
        if (barc == AUTH_EXPIRED) {
  	 hcrFlags |= HCR_EXPIRED_PW;
@@ -1033,6 +1040,7 @@
       exit(1);
    }
    if (discardInput) {
+     releaseAuthHandle();
      free(hdr);
      freeBuffer(&inBuf);
      _SFCB_RETURN(discardInput-1);
@@ -1083,9 +1091,7 @@
    if (response.buffer != NULL)
      cleanupCimXmlRequest(&response);
 
-  if (extras.release) {
-     extras.release(extras.authHandle);
-  }
+   releaseAuthHandle();
 
 #ifdef SFCB_DEBUG
    if (uset && (_sfcb_trace_mask & TRACE_RESPONSETIMING) ) {
@@ -1142,6 +1148,7 @@
          semAcquireUnDo(httpProcSem,0);
          semReleaseUnDo(httpProcSem,httpProcIdX+1);
          semRelease(httpWorkSem,0);
+	 atexit(releaseAuthHandle);
 	 atexit(uninitGarbageCollector);
 	 atexit(sunsetControl);
       }

Index: ChangeLog
===================================================================
RCS file: /cvsroot/sblim/sfcb/ChangeLog,v
retrieving revision 1.754
retrieving revision 1.755
diff -u -d -r1.754 -r1.755
--- ChangeLog	30 Mar 2012 17:56:41 -0000	1.754
+++ ChangeLog	30 Mar 2012 21:51:31 -0000	1.755
@@ -1,3 +1,8 @@
+2012-03-30  Chris Buccella  <buc...@li...>
+
+	* httpAdapter.c:
+	[ 3512094 ] SFCB can leak PAM handles under error conditions
+
 2012-03-29  Chris Buccella  <buc...@li...>
 
 	* providerDrv.c: