Module: wine Branch: master Commit: 81213a88e83b19c73e244e00bffac2e4057d513c URL: http://source.winehq.org/git/wine.git/?a=commit;h=81213a88e83b19c73e244e00bf...
Author: Hans Leidekker hans@codeweavers.com Date: Thu May 10 13:04:53 2012 +0200
secur32: Fix potential leaks of the NTLM session key.
---
dlls/secur32/dispatcher.c | 1 + dlls/secur32/ntlm.c | 17 +++++++++-------- 2 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/dlls/secur32/dispatcher.c b/dlls/secur32/dispatcher.c index 33b0512..5a9e26a 100644 --- a/dlls/secur32/dispatcher.c +++ b/dlls/secur32/dispatcher.c @@ -281,6 +281,7 @@ void cleanup_helper(PNegoHelper helper) return;
HeapFree(GetProcessHeap(), 0, helper->com_buf); + HeapFree(GetProcessHeap(), 0, helper->session_key);
/* closing stdin will terminate ntlm_auth */ close(helper->pipe_out); diff --git a/dlls/secur32/ntlm.c b/dlls/secur32/ntlm.c index d002b37..524eec3 100644 --- a/dlls/secur32/ntlm.c +++ b/dlls/secur32/ntlm.c @@ -825,7 +825,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW( ret = SEC_E_BUFFER_TOO_SMALL; if ((phContext == NULL) && (pInput == NULL)) { - HeapFree(GetProcessHeap(), 0, helper->session_key); cleanup_helper(helper); phNewContext->dwUpper = 0; phNewContext->dwLower = 0; @@ -844,7 +843,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW( ret = SEC_E_BUFFER_TOO_SMALL; if ((phContext == NULL) && (pInput == NULL)) { - HeapFree(GetProcessHeap(), 0, helper->session_key); cleanup_helper(helper); phNewContext->dwUpper = 0; phNewContext->dwLower = 0; @@ -858,7 +856,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW( ret = SEC_E_INTERNAL_ERROR; if ((phContext == NULL) && (pInput == NULL)) { - HeapFree(GetProcessHeap(), 0, helper->session_key); cleanup_helper(helper); phNewContext->dwUpper = 0; phNewContext->dwLower = 0; @@ -907,8 +904,7 @@ static SECURITY_STATUS SEC_ENTRY ntlm_InitializeSecurityContextW( helper->session_key = HeapAlloc(GetProcessHeap(), 0, bin_len); if(!helper->session_key) { - TRACE("Failed to allocate memory for session key\n"); - ret = SEC_E_INTERNAL_ERROR; + ret = SEC_E_INSUFFICIENT_MEMORY; goto isc_end; } memcpy(helper->session_key, bin, bin_len); @@ -1288,7 +1284,13 @@ static SECURITY_STATUS SEC_ENTRY ntlm_AcceptSecurityContext( if(strncmp(buffer, "BH ", 3) == 0) { TRACE("Helper sent %s\n", debugstr_a(buffer+3)); + HeapFree(GetProcessHeap(), 0, helper->session_key); helper->session_key = HeapAlloc(GetProcessHeap(), 0, 16); + if (!helper->session_key) + { + ret = SEC_E_INSUFFICIENT_MEMORY; + goto asc_end; + } /*FIXME: Generate the dummy session key = MD4(MD4(password))*/ memset(helper->session_key, 0 , 16); } @@ -1300,11 +1302,11 @@ static SECURITY_STATUS SEC_ENTRY ntlm_AcceptSecurityContext( TRACE("Failed to decode session key\n"); } TRACE("Session key is %s\n", debugstr_a(buffer+3)); + HeapFree(GetProcessHeap(), 0, helper->session_key); helper->session_key = HeapAlloc(GetProcessHeap(), 0, 16); if(!helper->session_key) { - TRACE("Failed to allocate memory for session key\n"); - ret = SEC_E_INTERNAL_ERROR; + ret = SEC_E_INSUFFICIENT_MEMORY; goto asc_end; } memcpy(helper->session_key, bin, 16); @@ -1356,7 +1358,6 @@ static SECURITY_STATUS SEC_ENTRY ntlm_DeleteSecurityContext(PCtxtHandle phContex phContext->dwLower = 0;
SECUR32_arc4Cleanup(helper->crypt.ntlm.a4i); - HeapFree(GetProcessHeap(), 0, helper->session_key); SECUR32_arc4Cleanup(helper->crypt.ntlm2.send_a4i); SECUR32_arc4Cleanup(helper->crypt.ntlm2.recv_a4i); HeapFree(GetProcessHeap(), 0, helper->crypt.ntlm2.send_sign_key);