Prevent NULL dereference if group has no members
authorJim McDonough <jmcd@samba.org>
Thu, 31 Dec 2009 02:19:46 +0000 (18:19 -0800)
committerKarolin Seeger <kseeger@samba.org>
Wed, 13 Jan 2010 13:01:05 +0000 (14:01 +0100)
Fix bug #7014 (domain mode winbind crashes retriveing empty group members).
(cherry picked from commit 5fd32614f147a045aaee30ed9cf62e42ac6e30d8)

source/winbindd/winbindd_rpc.c

index db43559436f31d84cea5e60ca4ceac00340fa2bd..459a84460dc1a7e5b0bf414e818c5e6a2fa53e1a 100644 (file)
@@ -787,16 +787,16 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
         if (!NT_STATUS_IS_OK(result))
                return result;
 
-       *num_names = rids->count;
-       rid_mem = rids->rids;
-
-       if (!*num_names) {
+       if (!rids || !rids->count) {
                names = NULL;
                name_types = NULL;
                sid_mem = NULL;
                return NT_STATUS_OK;
        }
 
+       *num_names = rids->count;
+       rid_mem = rids->rids;
+
         /* Step #2: Convert list of rids into list of usernames.  Do this
            in bunches of ~1000 to avoid crashing NT4.  It looks like there
            is a buffer overflow or something like that lurking around