diff options
| author | Edward Thomson <ethomson@edwardthomson.com> | 2019-10-20 17:23:01 +0100 |
|---|---|---|
| committer | Edward Thomson <ethomson@edwardthomson.com> | 2020-01-24 09:54:28 -0600 |
| commit | 3f6fe05495eaf53d937e2cfb2ed25817d96d08ed (patch) | |
| tree | 082b02afac097e038c57c86bddef2c270c29d448 | |
| parent | 73fe690db2241bf99590f9217da2d4e51c742fb2 (diff) | |
| download | libgit2-3f6fe05495eaf53d937e2cfb2ed25817d96d08ed.tar.gz | |
gssapi: protect GSS_ERROR macro
The GSS_ERROR(x) macro may expand to `(x & value)` on some
implementations, instead of `((x) & value)`. This is the case on macOS,
which means that if we attempt to wrap an expression in that macro, like
`a = b`, then that would expand to `(a = b & value)`.
Since `&` has a higher precedence, this is not at all what we want, and
will set our result code to an incorrect value. Evaluate the expression
then test it with `GSS_ERROR` independently to avoid this.
| -rw-r--r-- | src/transports/auth_negotiate.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/transports/auth_negotiate.c b/src/transports/auth_negotiate.c index 1c79a2468..e924dc37e 100644 --- a/src/transports/auth_negotiate.c +++ b/src/transports/auth_negotiate.c @@ -135,7 +135,7 @@ static int negotiate_next_token( mech = &negotiate_oid_spnego; - if (GSS_ERROR(status_major = gss_init_sec_context( + status_major = gss_init_sec_context( &status_minor, GSS_C_NO_CREDENTIAL, &ctx->gss_context, @@ -148,7 +148,9 @@ static int negotiate_next_token( NULL, &output_token, NULL, - NULL))) { + NULL); + + if (GSS_ERROR(status_major)) { negotiate_err_set(status_major, status_minor, "negotiate failure"); error = -1; goto done; @@ -220,8 +222,9 @@ static int negotiate_init_context( size_t i; /* Query supported mechanisms looking for SPNEGO) */ - if (GSS_ERROR(status_major = - gss_indicate_mechs(&status_minor, &mechanism_list))) { + status_major = gss_indicate_mechs(&status_minor, &mechanism_list); + + if (GSS_ERROR(status_major)) { negotiate_err_set(status_major, status_minor, "could not query mechanisms"); return -1; |