[OPEN-ILS-DEV] C nits: potential segfault in login

[Scott McKellar]

If the configuration file doesn't contain a <username> element,
nothing in osrf_system_bootstrap_client_resc() notices.  It happily
passes the NULL to client_session(), which passes it to 
session_connect(), which doesn't notice either.

Eventually, if everything else goes well, we pass the NULL to 
sprintf() as we try to compose the first stanza.  Oops.

Similar considerations apply if the configuration file doesn't contain
a <passwd> tag.  We pass a NULL down to session_connect(), and 
eventually to strlen() as we try to compose the second stanza.

I would expect to see a segmentation violation in these cases.  I can't
say for sure because I don't have a chat server running yet, so I
error out for lack of a socket before I get far enough to segfault.

We can fix these problems various ways in various places, but 
somebody besides me needs to make a policy decision.  Should we treat
a NULL as a fatal error, or convert it to an empty string and let
the authentication worry about it?  At what level should that policy
be applied?  Might we have one policy at one level and another
policy at another level, so that different applications can behave
differently?

Give me a decision and I can probably develop a patch for it.  
Depending on the chosen policy I may not be able to test the patch 
completely until I get a chat server running.  Also I won't even 
try to address any similar issues in Perl or Java.

Scott McKellar
http://home.swbell.net/mck9/aargh/