pidgin: 1fa9e4af: jabber: Fix a pernicious race condition ...

[darkrain42 at pidgin.im]

----------------------------------------------------------------------
Revision: 1fa9e4afdd810001996bc2b829fd6027f21a882f
Parent:   b774861efdbf45332c7737f9a02bb448aa253702
Author:   darkrain42 at pidgin.im
Date:     08/27/10 00:30:23
Branch:   im.pidgin.pidgin
URL: http://d.pidgin.im/viewmtn/revision/info/1fa9e4afdd810001996bc2b829fd6027f21a882f

Changelog: 

jabber: Fix a pernicious race condition in our cyrus auth code

About sasl_getsecret_t, sasl.h reads, in part:
 outputs:
  psecret set to password structure which must persist until
          next call to getsecret **in same connection**, but middleware
          will erase password data when it's done with it.

Clearly this needs to be per-JabberStream*, not a static var.
Jan Kaluza noted the static var and then I noted the sasl.h docs.
Fixes #11560

Changes against parent b774861efdbf45332c7737f9a02bb448aa253702

  patched  ChangeLog
  patched  libpurple/protocols/jabber/auth_cyrus.c
  patched  libpurple/protocols/jabber/jabber.c
  patched  libpurple/protocols/jabber/jabber.h

-------------- next part --------------
============================================================
--- ChangeLog	b234b5ce8eeff10eb3202a52530bec4470f5f46e
+++ ChangeLog	71ce3ef99433f91f53311875015eb3b49d6f5814
@@ -8,16 +8,21 @@ version 2.7.4 (MM/DD/YYYY):
 	* Added ability to use TURN relaying via TCP and TLS (including preference
 	  settings for these).
 
+	Pidgin:
+	* Add support for the Gadu-Gadu protocol in the gevolution plugin to
+	  provide Evolution integration with contacts with GG IDs. (#10709)
+
+	XMPP:
+	* Fix a crash when multiple accounts are simultaneously performing
+	  SASL authentication when built with Cyrus SASL support.  (thanks
+	  to Jan Kaluza) (#11560)
+
 	Yahoo/Yahoo JAPAN:
 	* Stop doing unnecessary lookups of certain alias information.  This
 	  solves deadlocks when a given Yahoo account has a ridiculously large
 	  (>500 buddies) list and may improve login speed for those on slow
 	  connections. (#12532)
 
-	Pidgin:
-	* Add support for the Gadu-Gadu protocol in the gevolution plugin to
-	  provide Evolution integration with contacts with GG IDs. (#10709)
-
 version 2.7.3 (08/10/2010):
 	General:
 	* Use silent build rules for automake >1.11. You can enable verbose
============================================================
--- libpurple/protocols/jabber/jabber.c	bad7f0bf46ec064f14facd6a467eb06918bb7d27
+++ libpurple/protocols/jabber/jabber.c	9c1f4dbfa2d4aec4f3eaa4108bf6661902317394
@@ -1631,6 +1631,8 @@ void jabber_close(PurpleConnection *gc)
 	if(js->sasl_mechs)
 		g_string_free(js->sasl_mechs, TRUE);
 	g_free(js->sasl_cb);
+	/* Note: _not_ g_free.  See auth_cyrus.c:jabber_sasl_cb_secret */
+	free(js->sasl_secret);
 #endif
 	g_free(js->serverFQDN);
 	while(js->commands) {
============================================================
--- libpurple/protocols/jabber/jabber.h	480e97195d8da8a1120c4f5cb1360b77c9a3d24b
+++ libpurple/protocols/jabber/jabber.h	1c6cf16631a65e79ba7fff3147fcbfba98ed7c05
@@ -206,6 +206,7 @@ struct _JabberStream
 #ifdef HAVE_CYRUS_SASL
 	sasl_conn_t *sasl;
 	sasl_callback_t *sasl_cb;
+	sasl_secret_t *sasl_secret;
 	const char *current_mech;
 	int auth_fail_count;
 
============================================================
--- libpurple/protocols/jabber/auth_cyrus.c	de85c1d927c318ab37dbaae05f4823749ff6da3b
+++ libpurple/protocols/jabber/auth_cyrus.c	d2bfd74ef5947eedc6fc7b489e53cf43b57f6f41
@@ -94,7 +94,6 @@ static int jabber_sasl_cb_secret(sasl_co
 	PurpleAccount *account;
 	const char *pw;
 	size_t len;
-	static sasl_secret_t *x = NULL;
 
 	account = purple_connection_get_account(js->gc);
 	pw = purple_account_get_password(account);
@@ -104,15 +103,15 @@ static int jabber_sasl_cb_secret(sasl_co
 
 	len = strlen(pw);
 	/* Not an off-by-one because sasl_secret_t defines char data[1] */
-	x = (sasl_secret_t *) realloc(x, sizeof(sasl_secret_t) + len);
-
-	if (!x)
+	/* TODO: This can probably be moved to glib's allocator */
+	js->sasl_secret = malloc(sizeof(sasl_secret_t) + len);
+	if (!js->sasl_secret)
 		return SASL_NOMEM;
 
-	x->len = len;
-	strcpy((char*)x->data, pw);
+	js->sasl_secret->len = len;
+	strcpy((char*)js->sasl_secret->data, pw);
 
-	*secret = x;
+	*secret = js->sasl_secret;
 	return SASL_OK;
 }