s3-gse: Make gensec_gse cope with non-DCE GSSAPI

The validation of the mutual authentication reply produces no further
data to send to the server.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index c7ce38e14f8e6526af73740f84db270573063f37..010d5252292898ec3764d63ccbd17e6313b16a00 100644 (file)
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -350,12 +350,15 @@ static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
                goto done;
        }
 
-       blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
-       if (!blob.data) {
-               status = NT_STATUS_NO_MEMORY;
-       }
+       /* we may be told to return nothing */
+       if (out_data.length) {
+               blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+               if (!blob.data) {
+                       status = NT_STATUS_NO_MEMORY;
+               }
 
-       gss_maj = gss_release_buffer(&gss_min, &out_data);
+               gss_maj = gss_release_buffer(&gss_min, &out_data);
+       }
 
 done:
        *token_out = blob;