auth/pycredentials: always check self is a Credentials object

This prevents a segfault with

    credentials.Credentials.guess(x)

where x is not a Credentials object.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

1 files changed, 247 insertions, 39 deletions

diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
index 1aef16a0145..9e231b04cb3 100644
--- a/auth/credentials/pycredentials.c
+++ b/auth/credentials/pycredentials.c
@@ -51,7 +51,12 @@ static PyObject *py_creds_new(PyTypeObject *type, PyObject *args, PyObject *kwar
 
 static PyObject *py_creds_get_username(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_username(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_username(creds));
 }
 
 static PyObject *py_creds_set_username(PyObject *self, PyObject *args)
@@ -59,13 +64,18 @@ static PyObject *py_creds_set_username(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_username(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_username(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_ntlm_username_domain(PyObject *self, PyObject *unused)
@@ -74,7 +84,12 @@ static PyObject *py_creds_get_ntlm_username_domain(PyObject *self, PyObject *unu
 	const char *user = NULL;
 	const char *domain = NULL;
 	PyObject *ret = NULL;
-	cli_credentials_get_ntlm_username_domain(PyCredentials_AsCliCredentials(self),
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	cli_credentials_get_ntlm_username_domain(creds,
 						 frame, &user, &domain);
 	ret = Py_BuildValue("(ss)",
 			    user,
@@ -101,6 +116,11 @@ static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyOb
 	const char *kwnames[] = { "flags", "challenge",
 				  "target_info",
 				  NULL };
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	tv_now = timeval_current();
 	server_timestamp = timeval_to_nttime(&tv_now);
@@ -115,7 +135,7 @@ static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyOb
 		return NULL;
 	}
 
-	status = cli_credentials_get_ntlm_response(PyCredentials_AsCliCredentials(self),
+	status = cli_credentials_get_ntlm_response(creds,
 						   frame, &flags,
 						   challenge,
 						   &server_timestamp,
@@ -147,7 +167,13 @@ static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyOb
 static PyObject *py_creds_get_principal(PyObject *self, PyObject *unused)
 {
 	TALLOC_CTX *frame = talloc_stackframe();
-	PyObject *ret = PyString_FromStringOrNULL(cli_credentials_get_principal(PyCredentials_AsCliCredentials(self), frame));
+	PyObject *ret = NULL;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	ret = PyString_FromStringOrNULL(cli_credentials_get_principal(creds, frame));
 	TALLOC_FREE(frame);
 	return ret;
 }
@@ -157,18 +183,28 @@ static PyObject *py_creds_set_principal(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_principal(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_principal(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_password(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_password(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_password(creds));
 }
 
 static PyObject *py_creds_set_password(PyObject *self, PyObject *args)
@@ -177,12 +213,18 @@ static PyObject *py_creds_set_password(PyObject *self, PyObject *args)
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
 	PyObject *result = NULL;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+
 	if (!PyArg_ParseTuple(args, PYARG_STR_UNI"|i", "utf8", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	result = PyBool_FromLong(cli_credentials_set_password(PyCredentials_AsCliCredentials(self), newval, obt));
+	result = PyBool_FromLong(cli_credentials_set_password(creds, newval, obt));
 	PyMem_Free(discard_const_p(void*, newval));
 	return result;
 }
@@ -196,6 +238,11 @@ static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
 	Py_ssize_t size =  0;
 	int result;
 	bool ok;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "O|i", &newval, &_obt)) {
 		return NULL;
@@ -209,7 +256,7 @@ static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
 	}
 	blob.length = size;
 
-	ok = cli_credentials_set_utf16_password(PyCredentials_AsCliCredentials(self),
+	ok = cli_credentials_set_utf16_password(creds,
 						&blob, obt);
 
 	return PyBool_FromLong(ok);
@@ -217,7 +264,12 @@ static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
 
 static PyObject *py_creds_get_old_password(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_old_password(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_old_password(creds));
 }
 
 static PyObject *py_creds_set_old_password(PyObject *self, PyObject *args)
@@ -225,13 +277,18 @@ static PyObject *py_creds_set_old_password(PyObject *self, PyObject *args)
 	char *oldval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &oldval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_old_password(PyCredentials_AsCliCredentials(self), oldval, obt));
+	return PyBool_FromLong(cli_credentials_set_old_password(creds, oldval, obt));
 }
 
 static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
@@ -241,6 +298,11 @@ static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
 	Py_ssize_t size =  0;
 	int result;
 	bool ok;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "O", &oldval)) {
 		return NULL;
@@ -253,7 +315,7 @@ static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
 	}
 	blob.length = size;
 
-	ok = cli_credentials_set_old_utf16_password(PyCredentials_AsCliCredentials(self),
+	ok = cli_credentials_set_old_utf16_password(creds,
 						    &blob);
 
 	return PyBool_FromLong(ok);
@@ -261,7 +323,12 @@ static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
 
 static PyObject *py_creds_get_domain(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_domain(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_domain(creds));
 }
 
 static PyObject *py_creds_set_domain(PyObject *self, PyObject *args)
@@ -269,18 +336,28 @@ static PyObject *py_creds_set_domain(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_domain(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_domain(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_realm(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_realm(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_realm(creds));
 }
 
 static PyObject *py_creds_set_realm(PyObject *self, PyObject *args)
@@ -288,32 +365,52 @@ static PyObject *py_creds_set_realm(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_realm(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_realm(creds, newval, obt));
 }
 
 static PyObject *py_creds_get_bind_dn(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_bind_dn(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_bind_dn(creds));
 }
 
 static PyObject *py_creds_set_bind_dn(PyObject *self, PyObject *args)
 {
 	char *newval;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 	if (!PyArg_ParseTuple(args, "s", &newval))
 		return NULL;
 
-	return PyBool_FromLong(cli_credentials_set_bind_dn(PyCredentials_AsCliCredentials(self), newval));
+	return PyBool_FromLong(cli_credentials_set_bind_dn(creds, newval));
 }
 
 static PyObject *py_creds_get_workstation(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_workstation(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_workstation(creds));
 }
 
 static PyObject *py_creds_set_workstation(PyObject *self, PyObject *args)
@@ -321,39 +418,69 @@ static PyObject *py_creds_set_workstation(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	return PyBool_FromLong(cli_credentials_set_workstation(PyCredentials_AsCliCredentials(self), newval, obt));
+	return PyBool_FromLong(cli_credentials_set_workstation(creds, newval, obt));
 }
 
 static PyObject *py_creds_is_anonymous(PyObject *self, PyObject *unused)
 {
-	return PyBool_FromLong(cli_credentials_is_anonymous(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyBool_FromLong(cli_credentials_is_anonymous(creds));
 }
 
 static PyObject *py_creds_set_anonymous(PyObject *self, PyObject *unused)
 {
-	cli_credentials_set_anonymous(PyCredentials_AsCliCredentials(self));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	cli_credentials_set_anonymous(creds);
 	Py_RETURN_NONE;
 }
 
 static PyObject *py_creds_authentication_requested(PyObject *self, PyObject *unused)
 {
-        return PyBool_FromLong(cli_credentials_authentication_requested(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+        return PyBool_FromLong(cli_credentials_authentication_requested(creds));
 }
 
 static PyObject *py_creds_wrong_password(PyObject *self, PyObject *unused)
 {
-        return PyBool_FromLong(cli_credentials_wrong_password(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+         return PyBool_FromLong(cli_credentials_wrong_password(creds));
 }
 
 static PyObject *py_creds_set_cmdline_callbacks(PyObject *self, PyObject *unused)
 {
-        return PyBool_FromLong(cli_credentials_set_cmdline_callbacks(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+        return PyBool_FromLong(cli_credentials_set_cmdline_callbacks(creds));
 }
 
 static PyObject *py_creds_parse_string(PyObject *self, PyObject *args)
@@ -361,13 +488,18 @@ static PyObject *py_creds_parse_string(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	cli_credentials_parse_string(PyCredentials_AsCliCredentials(self), newval, obt);
+	cli_credentials_parse_string(creds, newval, obt);
 	Py_RETURN_NONE;
 }
 
@@ -376,13 +508,18 @@ static PyObject *py_creds_parse_file(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	cli_credentials_parse_file(PyCredentials_AsCliCredentials(self), newval, obt);
+	cli_credentials_parse_file(creds, newval, obt);
 	Py_RETURN_NONE;
 }
 
@@ -404,8 +541,13 @@ static PyObject *py_cli_credentials_set_password_will_be_nt_hash(PyObject *self,
 static PyObject *py_creds_get_nt_hash(PyObject *self, PyObject *unused)
 {
 	PyObject *ret;
+	struct samr_Password *ntpw = NULL;
 	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
-	struct samr_Password *ntpw = cli_credentials_get_nt_hash(creds, creds);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	ntpw = cli_credentials_get_nt_hash(creds, creds);
 
 	ret = PyBytes_FromStringAndSize(discard_const_p(char, ntpw->hash), 16);
 	TALLOC_FREE(ntpw);
@@ -414,34 +556,55 @@ static PyObject *py_creds_get_nt_hash(PyObject *self, PyObject *unused)
 
 static PyObject *py_creds_get_kerberos_state(PyObject *self, PyObject *unused)
 {
-	int state = cli_credentials_get_kerberos_state(PyCredentials_AsCliCredentials(self));
+	int state;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	state = cli_credentials_get_kerberos_state(creds);
 	return PyInt_FromLong(state);
 }
 
 static PyObject *py_creds_set_kerberos_state(PyObject *self, PyObject *args)
 {
 	int state;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 	if (!PyArg_ParseTuple(args, "i", &state))
 		return NULL;
 
-	cli_credentials_set_kerberos_state(PyCredentials_AsCliCredentials(self), state);
+	cli_credentials_set_kerberos_state(creds, state);
 	Py_RETURN_NONE;
 }
 
 static PyObject *py_creds_set_krb_forwardable(PyObject *self, PyObject *args)
 {
 	int state;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 	if (!PyArg_ParseTuple(args, "i", &state))
 		return NULL;
 
-	cli_credentials_set_krb_forwardable(PyCredentials_AsCliCredentials(self), state);
+	cli_credentials_set_krb_forwardable(creds, state);
 	Py_RETURN_NONE;
 }
 
 
 static PyObject *py_creds_get_forced_sasl_mech(PyObject *self, PyObject *unused)
 {
-	return PyString_FromStringOrNULL(cli_credentials_get_forced_sasl_mech(PyCredentials_AsCliCredentials(self)));
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
+	return PyString_FromStringOrNULL(cli_credentials_get_forced_sasl_mech(creds));
 }
 
 static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args)
@@ -449,13 +612,18 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args)
 	char *newval;
 	enum credentials_obtained obt = CRED_SPECIFIED;
 	int _obt = obt;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s", &newval)) {
 		return NULL;
 	}
 	obt = _obt;
 
-	cli_credentials_set_forced_sasl_mech(PyCredentials_AsCliCredentials(self), newval);
+	cli_credentials_set_forced_sasl_mech(creds, newval);
 	Py_RETURN_NONE;
 }
 
@@ -467,6 +635,10 @@ static PyObject *py_creds_guess(PyObject *self, PyObject *args)
 	struct cli_credentials *creds;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
 		return NULL;
@@ -499,6 +671,10 @@ static PyObject *py_creds_set_machine_account(PyObject *self, PyObject *args)
 	TALLOC_CTX *mem_ctx;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
 		return NULL;
@@ -542,6 +718,10 @@ static PyObject *py_creds_get_named_ccache(PyObject *self, PyObject *args)
 	TALLOC_CTX *mem_ctx;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "|Os", &py_lp_ctx, &ccache_name))
 		return NULL;
@@ -585,6 +765,11 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
 	PyObject *py_lp_ctx = Py_None;
 	int _obt = obt;
 	int ret;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "s|iO", &newval, &_obt, &py_lp_ctx))
 		return NULL;
@@ -601,7 +786,7 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
 		return NULL;
 	}
 
-	ret = cli_credentials_set_ccache(PyCredentials_AsCliCredentials(self),
+	ret = cli_credentials_set_ccache(creds,
 					 lp_ctx,
 					 newval, CRED_SPECIFIED,
 					 &error_string);
@@ -620,11 +805,16 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
 static PyObject *py_creds_set_gensec_features(PyObject *self, PyObject *args)
 {
 	unsigned int gensec_features;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "I", &gensec_features))
 		return NULL;
 
-	cli_credentials_set_gensec_features(PyCredentials_AsCliCredentials(self), gensec_features);
+	cli_credentials_set_gensec_features(creds, gensec_features);
 
 	Py_RETURN_NONE;
 }
@@ -632,8 +822,13 @@ static PyObject *py_creds_set_gensec_features(PyObject *self, PyObject *args)
 static PyObject *py_creds_get_gensec_features(PyObject *self, PyObject *args)
 {
 	unsigned int gensec_features;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
-	gensec_features = cli_credentials_get_gensec_features(PyCredentials_AsCliCredentials(self));
+	gensec_features = cli_credentials_get_gensec_features(creds);
 	return PyInt_FromLong(gensec_features);
 }
 
@@ -673,12 +868,17 @@ static PyObject *py_creds_new_client_authenticator(PyObject *self,
 static PyObject *py_creds_set_secure_channel_type(PyObject *self, PyObject *args)
 {
 	unsigned int channel_type;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "I", &channel_type))
 		return NULL;
 
 	cli_credentials_set_secure_channel_type(
-		PyCredentials_AsCliCredentials(self),
+		creds,
 		channel_type);
 
 	Py_RETURN_NONE;
@@ -687,9 +887,13 @@ static PyObject *py_creds_set_secure_channel_type(PyObject *self, PyObject *args
 static PyObject *py_creds_get_secure_channel_type(PyObject *self, PyObject *args)
 {
 	enum netr_SchannelType channel_type = SEC_CHAN_NULL;
+	struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
-	channel_type = cli_credentials_get_secure_channel_type(
-		PyCredentials_AsCliCredentials(self));
+	channel_type = cli_credentials_get_secure_channel_type(creds);
 
 	return PyInt_FromLong(channel_type);
 }
@@ -704,6 +908,10 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self,
 	PyObject *py_cp = Py_None;
 
 	creds = PyCredentials_AsCliCredentials(self);
+	if (creds == NULL) {
+		PyErr_Format(PyExc_TypeError, "Credentials expected");
+		return NULL;
+	}
 
 	if (!PyArg_ParseTuple(args, "|O", &py_cp)) {
 		return NULL;