Set handle->pw before sss_to_sudoers() since sss_check_user()

uses it.  Coverity CID 185651

diff --git a/plugins/sudoers/sssd.c b/plugins/sudoers/sssd.c
index d57f80a69a739c0fa1780cf79236148281257cad..9ecdd41095ee62f5c9d845a1adcd9f812a99c6f1 100644 (file)
--- a/plugins/sudoers/sssd.c
+++ b/plugins/sudoers/sssd.c
@@ -332,21 +332,24 @@ sudo_sss_query(struct sudo_nss *nss, struct passwd *pw)
     if (sss_result == NULL)
        goto done;
 
+    /* Stash a ref to the passwd struct in the handle. */
+    sudo_pw_addref(pw);
+    handle->pw = pw;
+
     /* Convert to sudoers parse tree. */
     if (!sss_to_sudoers(handle, sss_result, &nss->userspecs)) {
        ret = -1;
        goto done;
     }
 
-    /* Stash a ref to the passwd struct in the handle. */
-    sudo_pw_addref(pw);
-    handle->pw = pw;
-
 done:
     /* Cleanup */
     handle->fn_free_result(sss_result);
-    if (ret == -1)
+    if (ret == -1) {
        free_userspecs(&nss->userspecs);
+       sudo_pw_delref(handle->pw);
+       handle->pw = NULL;
+    }
 
     sudo_debug_printf(SUDO_DEBUG_DIAG, "Done with LDAP searches");