Commit 3f6fe05495eaf53d937e2cfb2ed25817d96d08ed
2019-10-20T17:23:01
gssapi: protect GSS_ERROR macro The GSS_ERROR(x) macro may expand to `(x & value)` on some implementations, instead of `((x) & value)`. This is the case on macOS, which means that if we attempt to wrap an expression in that macro, like `a = b`, then that would expand to `(a = b & value)`. Since `&` has a higher precedence, this is not at all what we want, and will set our result code to an incorrect value. Evaluate the expression then test it with `GSS_ERROR` independently to avoid this.
diff --git a/src/transports/auth_negotiate.c b/src/transports/auth_negotiate.c
index 1c79a24..e924dc3 100644
--- a/src/transports/auth_negotiate.c
+++ b/src/transports/auth_negotiate.c
@@ -135,7 +135,7 @@ static int negotiate_next_token(
mech = &negotiate_oid_spnego;
- if (GSS_ERROR(status_major = gss_init_sec_context(
+ status_major = gss_init_sec_context(
&status_minor,
GSS_C_NO_CREDENTIAL,
&ctx->gss_context,
@@ -148,7 +148,9 @@ static int negotiate_next_token(
NULL,
&output_token,
NULL,
- NULL))) {
+ NULL);
+
+ if (GSS_ERROR(status_major)) {
negotiate_err_set(status_major, status_minor, "negotiate failure");
error = -1;
goto done;
@@ -220,8 +222,9 @@ static int negotiate_init_context(
size_t i;
/* Query supported mechanisms looking for SPNEGO) */
- if (GSS_ERROR(status_major =
- gss_indicate_mechs(&status_minor, &mechanism_list))) {
+ status_major = gss_indicate_mechs(&status_minor, &mechanism_list);
+
+ if (GSS_ERROR(status_major)) {
negotiate_err_set(status_major, status_minor,
"could not query mechanisms");
return -1;