Hans Leidekker : secur32: Fix potential leaks of the NTLM session key.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 81213a88e83b19c73e244e00bffac2e4057d513c
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=81213a88e83b19c73e244e00bf...

Author: Hans Leidekker <hans(a)codeweavers.com>
Date:   Thu May 10 13:04:53 2012 +0200

secur32: Fix potential leaks of the NTLM session key.

---

 dlls/secur32/dispatcher.c |    1 +
 dlls/secur32/ntlm.c       |   17 +++++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/dlls/secur32/dispatcher.c b/dlls/secur32/dispatcher.c
index 33b0512..5a9e26a 100644
--- a/dlls/secur32/dispatcher.c
+++ b/dlls/secur32/dispatcher.c
@@ -281,6 +281,7 @@ void cleanup_helper(PNegoHelper helper)
         return;
 
     HeapFree(GetProcessHeap(), 0, helper->com_buf);
+    HeapFree(GetProcessHeap(), 0, helper->session_key);
 
     /* closing stdin will terminate ntlm_auth */
     close(helper->pipe_out);
diff --git a/dlls/secur32/ntlm.c b/dlls/secur32/ntlm.c
index d002b37..524eec3 100644
--- a/dlls/secur32/ntlm.c
+++ b/dlls/secur32/ntlm.c
@@ -825,7 +825,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW(
         ret = SEC_E_BUFFER_TOO_SMALL;
         if ((phContext == NULL) && (pInput == NULL))
         {
-            HeapFree(GetProcessHeap(), 0, helper->session_key);
             cleanup_helper(helper);
             phNewContext->dwUpper = 0;
             phNewContext->dwLower = 0;
@@ -844,7 +843,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW(
         ret = SEC_E_BUFFER_TOO_SMALL;
         if ((phContext == NULL) && (pInput == NULL))
         {
-            HeapFree(GetProcessHeap(), 0, helper->session_key);
             cleanup_helper(helper);
             phNewContext->dwUpper = 0;
             phNewContext->dwLower = 0;
@@ -858,7 +856,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW(
         ret = SEC_E_INTERNAL_ERROR;
         if ((phContext == NULL) && (pInput == NULL))
         {
-            HeapFree(GetProcessHeap(), 0, helper->session_key);
             cleanup_helper(helper);
             phNewContext->dwUpper = 0;
             phNewContext->dwLower = 0;
@@ -907,8 +904,7 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW(
             helper->session_key = HeapAlloc(GetProcessHeap(), 0, bin_len);
             if(!helper->session_key)
             {
-                TRACE("Failed to allocate memory for session key\n");
-                ret = SEC_E_INTERNAL_ERROR;
+                ret = SEC_E_INSUFFICIENT_MEMORY;
                 goto isc_end;
             }
             memcpy(helper->session_key, bin, bin_len);
@@ -1288,7 +1284,13 @@ static SECURITY_STATUS SEC_ENTRY ntlm_AcceptSecurityContext(
             if(strncmp(buffer, "BH ", 3) == 0)
             {
                 TRACE("Helper sent %s\n", debugstr_a(buffer+3));
+                HeapFree(GetProcessHeap(), 0, helper->session_key);
                 helper->session_key = HeapAlloc(GetProcessHeap(), 0, 16);
+                if (!helper->session_key)
+                {
+                    ret = SEC_E_INSUFFICIENT_MEMORY;
+                    goto asc_end;
+                }
                 /*FIXME: Generate the dummy session key = MD4(MD4(password))*/
                 memset(helper->session_key, 0 , 16);
             }
@@ -1300,11 +1302,11 @@ static SECURITY_STATUS SEC_ENTRY ntlm_AcceptSecurityContext(
                     TRACE("Failed to decode session key\n");
                 }
                 TRACE("Session key is %s\n", debugstr_a(buffer+3));
+                HeapFree(GetProcessHeap(), 0, helper->session_key);
                 helper->session_key = HeapAlloc(GetProcessHeap(), 0, 16);
                 if(!helper->session_key)
                 {
-                    TRACE("Failed to allocate memory for session key\n");
-                    ret = SEC_E_INTERNAL_ERROR;
+                    ret = SEC_E_INSUFFICIENT_MEMORY;
                     goto asc_end;
                 }
                 memcpy(helper->session_key, bin, 16);
@@ -1356,7 +1358,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_DeleteSecurityContext(PCtxtHandle phContex
     phContext->dwLower = 0;
 
     SECUR32_arc4Cleanup(helper->crypt.ntlm.a4i);
-    HeapFree(GetProcessHeap(), 0, helper->session_key);
     SECUR32_arc4Cleanup(helper->crypt.ntlm2.send_a4i);
     SECUR32_arc4Cleanup(helper->crypt.ntlm2.recv_a4i);
     HeapFree(GetProcessHeap(), 0, helper->crypt.ntlm2.send_sign_key);