[29169] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.12]: Tolerate null oid pointer in
daemon@ATHENA.MIT.EDU (Tom Yu)
Wed Dec 9 15:26:52 2015
Date: Wed, 9 Dec 2015 15:26:46 -0500
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201512092026.tB9KQkF5008834@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/fab95cde1f691ce6becc69bf013e2883d2213c03
commit fab95cde1f691ce6becc69bf013e2883d2213c03
Author: Greg Hudson <ghudson@mit.edu>
Date: Wed Jun 10 19:48:51 2015 -0400
Tolerate null oid pointer in gss_release_oid()
Under some circumstances, gss_inquire_name() can call
gss_release_oid() with a null oid pointer, which currently causes a
null dereference. The least invasive fix is for gss_release_oid() to
check for the invalid null pointer and return an error, like other
GSS-API functions do.
(cherry picked from commit 4676e823e6ee9a5731872b31c5588c1b5932e0a3)
ticket: 8303 (new)
version_fixed: 1.12.5
status: resolved
src/lib/gssapi/mechglue/g_initialize.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
index 68aa7a7..97048f3 100644
--- a/src/lib/gssapi/mechglue/g_initialize.c
+++ b/src/lib/gssapi/mechglue/g_initialize.c
@@ -164,7 +164,7 @@ gss_OID *oid;
OM_uint32 major;
gss_mech_info aMech;
- if (minor_status == NULL)
+ if (minor_status == NULL || oid == NULL)
return (GSS_S_CALL_INACCESSIBLE_WRITE);
*minor_status = gssint_mechglue_initialize_library();
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
