diff mbox series

[Openvpn-devel,v1] openvpnserv: don't return freed token groups from GetTokenGroups()

Message ID 20261104105737.7333-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] openvpnserv: don't return freed token groups from GetTokenGroups() |

Commit Message

Gert Doering Nov. 4, 2026, 10:57 a.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

When the second GetTokenInformation() call failed, the freed buffer was
returned. IsUserInGroup() then read it and IsAuthorizedUser() freed it
again. Return NULL, which IsUserInGroup() already handles by skipping
the token group check.

Broken since e82733a1 ("Fix user's group membership check in
interactive service to work with domains").

Change-Id: I5542520825112dfd64aab332bd76333b74d7fec0
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2128
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2128
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Gert Doering <gert@greenie.muc.de>
diff mbox series

Patch

diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c
index 6a13a06..2858f62 100644
--- a/src/openvpnserv/validate.c
+++ b/src/openvpnserv/validate.c
@@ -227,6 +227,7 @@ 
     {
         MsgToEventLog(M_SYSERR, L"GetTokenInformation");
         free(groups);
+        groups = NULL;
     }
     return groups;
 }