Dodgy ssl code

[Philip Martin <ph...@codematters.co.uk>]

Hello

I noticed the following while preparing r5480.

The functions server_ssl_callback, client_ssl_keypw_callback,
client_ssl_callback in libsvn_ra_dav/session.c don't handle errors
properly.  They all call svn_auth_xxx functions and ignore any
svn_error_t* that is returned.  This has two problems: the first is
that there is a resource leak because svn_error_clear is not called.
The second is more serious, if an error is returned it is foolish to
assume that the credentials are valid, the pointer may be invalid and
using it may cause a SEGV.

-- 
Philip Martin

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: Dodgy ssl code

[Ben Collins-Sussman <su...@collab.net>]

Philip Martin <ph...@codematters.co.uk> writes:

> The functions server_ssl_callback, client_ssl_keypw_callback,
> client_ssl_callback in libsvn_ra_dav/session.c don't handle errors
> properly.

Philip, you are so correct.  Thank you for noticing.

David Waite, can you fix this in your upcoming patch?  Please trap the
svn_error_t's thrown by the svn_auth_* calls, and clear them, and
throw -1.  See session.c:request_auth() for an example.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org