s3:libsmb/smb_seal: always use SAFE_FREE(buf) in common_free_enc_buffer()

[rusty/samba.git] / source3 / libsmb / smb_seal.c

diff --git a/source3/libsmb/smb_seal.c b/source3/libsmb/smb_seal.c
index 8230a2eb85d958f081846164bb6e36576a05ba30..950f3e3822f0c1c9ecf92e40131286c52bfaf6bd 100644 (file)
--- a/source3/libsmb/smb_seal.c
+++ b/source3/libsmb/smb_seal.c
@@ -22,7 +22,9 @@
 #include "smb_crypt.h"
 #include "libsmb/libsmb.h"
 #include "ntlmssp_wrap.h"
+#include "libcli/auth/krb5_wrap.h"
 
+#undef malloc
 
 /******************************************************************************
  Pull out the encryption context for this packet. 0 means global context.
@@ -147,7 +149,11 @@ static NTSTATUS common_ntlm_encrypt_buffer(struct auth_ntlmssp_state *auth_ntlms
         * check needed.
         */
 
-       buf_out = SMB_XMALLOC_ARRAY(char, 8 + NTLMSSP_SIG_SIZE + data_len);
+       buf_out = (char *)malloc(8 + NTLMSSP_SIG_SIZE + data_len);
+       if (buf_out == NULL) {
+               TALLOC_FREE(frame);
+               return NT_STATUS_NO_MEMORY;
+       }
 
        /* Copy the data from the original buffer. */
 
@@ -209,14 +215,23 @@ static NTSTATUS common_gss_decrypt_buffer(struct smb_tran_enc_state_gss *gss_sta
                        (gss_qop_t *) NULL);    
 
        if (ret != GSS_S_COMPLETE) {
-               ADS_STATUS adss = ADS_ERROR_GSS(ret, minor);
-               DEBUG(0,("common_gss_encrypt_buffer: gss_unwrap failed. Error %s\n",
-                       ads_errstr(adss) ));
-               return map_nt_error_from_gss(ret, minor);
+               NTSTATUS status = NT_STATUS_ACCESS_DENIED;
+               char *gss_err;
+
+               gss_err = gssapi_error_string(talloc_tos(),
+                                             ret, minor,
+                                             GSS_C_NULL_OID);
+               DEBUG(0,("common_gss_decrypt_buffer: gss_unwrap failed. "
+                        "Error [%d/%d] - %s - %s\n",
+                        ret, minor, nt_errstr(status),
+                        gss_err ? gss_err : "<unknown>"));
+               talloc_free(gss_err);
+
+               return status;
        }
 
        if (out_buf.length > in_buf.length) {
-               DEBUG(0,("common_gss_encrypt_buffer: gss_unwrap size (%u) too large (%u) !\n",
+               DEBUG(0,("common_gss_decrypt_buffer: gss_unwrap size (%u) too large (%u) !\n",
                        (unsigned int)out_buf.length,
                        (unsigned int)in_buf.length ));
                gss_release_buffer(&minor, &out_buf);
@@ -266,10 +281,19 @@ static NTSTATUS common_gss_encrypt_buffer(struct smb_tran_enc_state_gss *gss_sta
                        &out_buf);
 
        if (ret != GSS_S_COMPLETE) {
-               ADS_STATUS adss = ADS_ERROR_GSS(ret, minor);
-               DEBUG(0,("common_gss_encrypt_buffer: gss_wrap failed. Error %s\n",
-                       ads_errstr(adss) ));
-               return map_nt_error_from_gss(ret, minor);
+               NTSTATUS status = NT_STATUS_ACCESS_DENIED;
+               char *gss_err;
+
+               gss_err = gssapi_error_string(talloc_tos(),
+                                             ret, minor,
+                                             GSS_C_NULL_OID);
+               DEBUG(0,("common_gss_encrypt_buffer: gss_unwrap failed. "
+                        "Error [%d/%d] - %s - %s\n",
+                        ret, minor, nt_errstr(status),
+                        gss_err ? gss_err : "<unknown>"));
+               talloc_free(gss_err);
+
+               return status;
        }
 
        if (!flags_got) {
@@ -290,7 +314,7 @@ static NTSTATUS common_gss_encrypt_buffer(struct smb_tran_enc_state_gss *gss_sta
         * bother :-*(. JRA.
         */
 
-       *ppbuf_out = (char *)SMB_MALLOC(out_buf.length + 8); /* We know this can't wrap. */
+       *ppbuf_out = (char *)malloc(out_buf.length + 8); /* We know this can't wrap. */
        if (!*ppbuf_out) {
                gss_release_buffer(&minor, &out_buf);
                return NT_STATUS_NO_MEMORY;
@@ -420,18 +444,5 @@ void common_free_enc_buffer(struct smb_trans_enc_state *es, char *buf)
                return;
        }
 
-       if (es->smb_enc_type == SMB_TRANS_ENC_NTLM) {
-               SAFE_FREE(buf);
-               return;
-       }
-
-#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
-       if (es->smb_enc_type == SMB_TRANS_ENC_GSS) {
-               OM_uint32 min;
-               gss_buffer_desc rel_buf;
-               rel_buf.value = buf;
-               rel_buf.length = smb_len_nbt(buf) + 4;
-               gss_release_buffer(&min, &rel_buf);
-       }
-#endif
+       SAFE_FREE(buf);
 }