diff options
Diffstat (limited to 'src/backend/libpq/auth.c')
| -rw-r--r-- | src/backend/libpq/auth.c | 25 |
1 files changed, 17 insertions, 8 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 45dcd65afaf..a533786f082 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -1193,6 +1193,7 @@ pg_GSS_checkauth(Port *port) min_stat, lmin_s; gss_buffer_desc gbuf; + char *princ; /* * Get the name of the user that authenticated, and compare it to the pg @@ -1207,17 +1208,26 @@ pg_GSS_checkauth(Port *port) } /* + * gbuf.value might not be null-terminated, so turn it into a regular + * null-terminated string. + */ + princ = palloc(gbuf.length + 1); + memcpy(princ, gbuf.value, gbuf.length); + princ[gbuf.length] = '\0'; + gss_release_buffer(&lmin_s, &gbuf); + + /* * Copy the original name of the authenticated principal into our backend * memory for display later. */ - port->gss->princ = MemoryContextStrdup(TopMemoryContext, gbuf.value); + port->gss->princ = MemoryContextStrdup(TopMemoryContext, princ); /* * Split the username at the realm separator */ - if (strchr(gbuf.value, '@')) + if (strchr(princ, '@')) { - char *cp = strchr(gbuf.value, '@'); + char *cp = strchr(princ, '@'); /* * If we are not going to include the realm in the username that is @@ -1244,7 +1254,7 @@ pg_GSS_checkauth(Port *port) elog(DEBUG2, "GSSAPI realm (%s) and configured realm (%s) don't match", cp, port->hba->krb_realm); - gss_release_buffer(&lmin_s, &gbuf); + pfree(princ); return STATUS_ERROR; } } @@ -1253,15 +1263,14 @@ pg_GSS_checkauth(Port *port) { elog(DEBUG2, "GSSAPI did not return realm but realm matching was requested"); - - gss_release_buffer(&lmin_s, &gbuf); + pfree(princ); return STATUS_ERROR; } - ret = check_usermap(port->hba->usermap, port->user_name, gbuf.value, + ret = check_usermap(port->hba->usermap, port->user_name, princ, pg_krb_caseins_users); - gss_release_buffer(&lmin_s, &gbuf); + pfree(princ); return ret; } |