• Mike Kaganski's avatar
    Don't crash when accessing WebDAV resource after auth failed · 9ee59811
    Mike Kaganski yazdı
    In my testing on Windows, the crashing scenario was this:
    1. FileDialogHelper_Impl::updateVersions() creates storage calling
       comphelper::OStorageHelper::GetStorageFromURL;
    2. Content::openStream() calls isDocument first;
    3. Content::isDocument() indirectly initiates WebDAV session,
       creating a NeonSession;
    4. All operations of NeonSession call Init() first; its first call
       initializes m_pHttpSession using ne_session_create, and then
       adds auth callbacks using ne_add_server_auth/ne_add_proxy_auth
    5. Then NeonSession performs the rest of PROPFIND task, calling
       ah_post_send and auth_challenge; the latter fails, then
       ah_post_send calls clean_session, which cleans m_pHttpSession's
       auth_session's sspi_host;
    6. NeonSession::HandleError throws DAVException for NE_AUTH error;
    7. Content::isDocument() returns true to Content::openStream(),
       which proceeds to execute the command, which in turn re-uses
       the NeonSession and its m_pHttpSession;
    8. NeonSession::OPTIONS then indirectly calls continue_sspi, which
       tries to dereference the m_pHttpSession's auth_session's
       sspi_host which is nullptr at this point.
    
    So in case NeonSession detects the NE_AUTH error condition, let's
    set a flag indicating that the next Init() should reinitialize its
    m_pHttpSession.
    
    Also fixed a case when xProps was used before initialization in
    Content::getPropertyValues.
    
    Change-Id: Ifc9eec4fe0333ff6be17c5089068441b4a6eb78c
    Reviewed-on: https://gerrit.libreoffice.org/65950
    Tested-by: Jenkins
    Reviewed-by: 's avatarMike Kaganski <mike.kaganski@collabora.com>
    Reviewed-on: https://gerrit.libreoffice.org/66003Tested-by: 's avatarMike Kaganski <mike.kaganski@collabora.com>
    Reviewed-by: 's avatarAndras Timar <andras.timar@collabora.com>
    9ee59811
webdavcontent.cxx 162 KB