#4223 Coverity: client_entry is set NULL when successfully retrieved
Closed: Fixed None Opened 10 years ago by mkosek.

Coverity bug:

Defect type: DEADCODE

1. freeipa-3.3.3/daemons/ipa-kdb/ipa_kdb_mspac.c:2004:assignment – Assigning: "client_entry" = "NULL".
2. freeipa-3.3.3/daemons/ipa-kdb/ipa_kdb_mspac.c:2061:null – At condition "client_entry", the value of "client_entry" must be NULL.
3. freeipa-3.3.3/daemons/ipa-kdb/ipa_kdb_mspac.c:2061:dead_error_condition – The condition "client_entry" cannot be true.
4. freeipa-3.3.3/daemons/ipa-kdb/ipa_kdb_mspac.c:2061:dead_error_line – Execution cannot reach this expression "client_entry" inside statement "kerr = ipadb_get_pac(contex...".

Possible problem:

    ...
    if (client_princ != NULL) {
        ks_client_princ = client_princ;
        if (!is_as_req) {
            kerr = ipadb_get_principal(context, client_princ, flags,
&client_entry);
            /* If we didn't find client_princ in our database, it might be:
             * - a principal from another realm, handle it down in ipadb_get/
        verify_pac()
             */
>>>        if (!kerr) {
                client_entry = NULL;
            }
        }
    } else {
        if (client == NULL) {
            *signed_auth_data = NULL;
            return 0;
        }
        ks_client_princ = client->princ;
    }
    ...

I think the condition is wrong and should be reverted:

if (!kerr) {

This is a regression in 3.3.5 caused by 6b45ec3. Moving to appropriate milestone.

master:

  • 4048d41 ipa-kdb: do not fetch client principal if it is the same as existing entry

ipa-3-3:

  • 4de37e6 ipa-kdb: do not fetch client principal if it is the same as existing entry

Metadata Update from @mkosek:
- Issue assigned to abbra
- Issue set to the milestone: FreeIPA 3.3.5 (bug fixing)

7 years ago

Login to comment on this ticket.

Metadata