Jasig/mod_auth_cas — pull request #82 by smaresca (2014-11-18 07:09:07+00:00)
Title: Bugfix: Repair NULL deref error in SAML 1.1 response parsing

#### Bugfix summary:
Segmentation fault occurred while preparing a cache entry; username from CAS ticket was never properly extracted, leaving the char* as a NULL banana peel. Full fix required improved parsing of the SAML 1.1 response and addition of some sanity checks.

#### Changes:
* Root cause located in isValidCasTicket() - when AuthenticationStatement contains user name, parse properly (even if saml validation response has no attributes)
* when no username parsed during SAML examination of isValidCASTicket, return FALSE so that its caller throws a "Authorization Required"
* hedge bets and check for valid username set in createCASCookie and writeCASCacheEntry
* AuthenticationMethod has no attributes, so prevent misuse of node attributes as identity attributes
*warn if no attributes available for authorization (e.g., attributes not released by CAS server config)

#### Stack trace:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff799496b in apr_xml_quote_string () from /usr/lib/libaprutil-1.so.0
(gdb) bt
0 0x00007ffff799496b in apr_xml_quote_string () from /usr/lib/libaprutil-1.so.0
1 0x00007ffff62e830e in writeCASCacheEntry (r=0x7ffff53c30a0, name=0x7ffff53c2780 "1b3855f0110f1a05d3ca5d2c5667b6e3", cache=0x7fffffffdc60, exists=0 '\000')
at mod_auth_cas.c:1215
2 0x00007ffff62e9635 in createCASCookie (r=0x7ffff53c30a0, user=0x0, attrs=0x7ffff53ccb50, ticket=0x7ffff53cb277 "ST-701585-TK73aKTv4yzBo1bcY6Ct-login.uconn.edu")
at mod_auth_cas.c:1288
3 0x00007ffff62eb221 in cas_authenticate (r=0x7ffff53c30a0) at mod_auth_cas.c:2057
4 0x000055555558fa28 in ap_run_check_user_id ()
5 0x0000555555591d0e in ap_process_request_internal ()
6 0x00005555555a55a0 in ap_process_request ()
7 0x00005555555a23d8 in ?? ()
8 0x000055555559bfa8 in ap_run_process_connection ()
9 0x00005555555aa210 in ?? ()
10 0x00005555555aa936 in ?? ()
11 0x00005555555ab103 in ap_mpm_run ()
12 0x00005555555804a4 in main ()
(gdb)

#### Other:
We really, really need a legitimate (i.e., robust) XML parser.