Fix bogus order of error checks in new channel_binding code.

tglsfdc · tglsfdc · commit 2c97f7346841 · 2019-09-29T12:35:53.000-04:00
Coverity pointed out that it's pretty silly to check for a null pointer after we've already dereferenced the pointer. To fix, just swap the order of the two error checks. Oversight in commit d6e612f.
diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
@@ -502,18 +502,18 @@ pg_SASL_init(PGconn *conn, int payloadlen)
 			selected_mechanism = SCRAM_SHA_256_NAME;
 	}
 
-	if (conn->channel_binding[0] == 'r' &&	/* require */
-		strcmp(selected_mechanism, SCRAM_SHA_256_PLUS_NAME) != 0)
+	if (!selected_mechanism)
 	{
 		printfPQExpBuffer(&conn->errorMessage,
-						  libpq_gettext("channel binding is required, but server did not offer an authentication method that supports channel binding\n"));
+						  libpq_gettext("none of the server's SASL authentication mechanisms are supported\n"));
 		goto error;
 	}
 
-	if (!selected_mechanism)
+	if (conn->channel_binding[0] == 'r' &&	/* require */
+		strcmp(selected_mechanism, SCRAM_SHA_256_PLUS_NAME) != 0)
 	{
 		printfPQExpBuffer(&conn->errorMessage,
-						  libpq_gettext("none of the server's SASL authentication mechanisms are supported\n"));
+						  libpq_gettext("channel binding is required, but server did not offer an authentication method that supports channel binding\n"));
 		goto error;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -502,18 +502,18 @@ pg_SASL_init(PGconn *conn, int payloadlen)`
`502`	`502`	`selected_mechanism = SCRAM_SHA_256_NAME;`
`503`	`503`	`}`
`504`	`504`
`505`		`- if (conn->channel_binding[0] == 'r' && /* require */`
`506`		`- strcmp(selected_mechanism, SCRAM_SHA_256_PLUS_NAME) != 0)`
	`505`	`+ if (!selected_mechanism)`
`507`	`506`	`{`
`508`	`507`	`printfPQExpBuffer(&conn->errorMessage,`
`509`		`- libpq_gettext("channel binding is required, but server did not offer an authentication method that supports channel binding\n"));`
	`508`	`+ libpq_gettext("none of the server's SASL authentication mechanisms are supported\n"));`
`510`	`509`	`goto error;`
`511`	`510`	`}`
`512`	`511`
`513`		`- if (!selected_mechanism)`
	`512`	`+ if (conn->channel_binding[0] == 'r' && /* require */`
	`513`	`+ strcmp(selected_mechanism, SCRAM_SHA_256_PLUS_NAME) != 0)`
`514`	`514`	`{`
`515`	`515`	`printfPQExpBuffer(&conn->errorMessage,`
`516`		`- libpq_gettext("none of the server's SASL authentication mechanisms are supported\n"));`
	`516`	`+ libpq_gettext("channel binding is required, but server did not offer an authentication method that supports channel binding\n"));`
`517`	`517`	`goto error;`
`518`	`518`	`}`
`519`	`519`