Produits Entr'ouvert » Lasso

Hi,

I'm using lasso-2.3.6 on Linux.
And I called lasso_server_new() function as follow:

lasso_server_new("sp-metadata.xml", NULL, NULL, NULL);

If sp-metadata.xml has an AssertionConsumerService element without index attribute,
SIGSEGV occurs in stdlib's strtol() function which is called by xsdUnsignedShortParse() in lasso/saml-2.0/provider.c.
The reason why SIGSEGV occurs is that NULL is passed to the first argument of strtol().
The NULL comes from the variable 'index' in load_endpoint_type2() function.

I think the index attribute in AssertionConsumerService element is optional,
so the 'index' returned by getSaml2MdProp() may be NULL.
However, the 'index' is not asserted before calling xsdUnsignedShortParse().

I attach a patch to fix this problem.

Regards,
Hiro