[30554] in CVS-changelog-for-Kerberos-V5
krb5 commit: Handle all-zero tags in file2 rcache type
daemon@ATHENA.MIT.EDU (Greg Hudson)
Thu Aug 1 17:11:45 2019
Date: Thu, 1 Aug 2019 17:11:39 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <201908012111.x71LBdNK028063@drugstore.mit.edu>
To: <cvs-krb5@mit.edu>
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/6e1fdfb30bac750816da25d6dd4ed67d0149da12
commit 6e1fdfb30bac750816da25d6dd4ed67d0149da12
Author: Greg Hudson <ghudson@mit.edu>
Date: Wed Jul 31 16:18:11 2019 -0400
Handle all-zero tags in file2 rcache type
In the unlikely case of an all-zero tag, rc_file2.c:store() could
mistake an empty record for a replay. Check that records from the
file are non-empty (by checking that the timestamp is non-zero) before
comparing them to the tag.
ticket: 8786
src/lib/krb5/rcache/rc_file2.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/lib/krb5/rcache/rc_file2.c b/src/lib/krb5/rcache/rc_file2.c
index 10f9a92..3240776 100644
--- a/src/lib/krb5/rcache/rc_file2.c
+++ b/src/lib/krb5/rcache/rc_file2.c
@@ -174,8 +174,8 @@ store(krb5_context context, int fd, const uint8_t tag[TAG_LEN], uint32_t now,
if (ret)
return ret;
- if ((nread >= 1 && memcmp(r1tag, tag, TAG_LEN) == 0) ||
- (nread == 2 && memcmp(r2tag, tag, TAG_LEN) == 0))
+ if ((nread >= 1 && r1stamp && memcmp(r1tag, tag, TAG_LEN) == 0) ||
+ (nread == 2 && r2stamp && memcmp(r2tag, tag, TAG_LEN) == 0))
return KRB5KRB_AP_ERR_REPEAT;
/* Make note of the first record available for writing (empty, beyond
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5