[28441] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix unlikely null dereference in TGS client code
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Jun 30 19:40:16 2014
Date: Mon, 30 Jun 2014 19:40:08 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201406302340.s5UNe8NK022111@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/81e503c09ad9aef4a0afc6bf66a0269cde2151f3
commit 81e503c09ad9aef4a0afc6bf66a0269cde2151f3
Author: Neng Xue <xnsuda@yahoo.com>
Date: Mon Jun 30 14:04:56 2014 -0700
Fix unlikely null dereference in TGS client code
If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an
error re-reading the profile), k5_make_tgs_req will dereference a null
pointer. Check the return value before dereferencing defenctypes.
[ghudson@mit.edu: clarified commit message]
ticket: 7952 (new)
target_version: 1.12.2
tags: pullup
src/lib/krb5/krb/send_tgs.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/src/lib/krb5/krb/send_tgs.c b/src/lib/krb5/krb/send_tgs.c
index cd56366..f6fdf68 100644
--- a/src/lib/krb5/krb/send_tgs.c
+++ b/src/lib/krb5/krb/send_tgs.c
@@ -198,7 +198,9 @@ k5_make_tgs_req(krb5_context context,
req.nktypes = 1;
} else {
/* Get the default TGS enctypes. */
- krb5_get_tgs_ktypes(context, desired->server, &defenctypes);
+ ret = krb5_get_tgs_ktypes(context, desired->server, &defenctypes);
+ if (ret)
+ goto cleanup;
for (count = 0; defenctypes[count]; count++);
req.ktype = defenctypes;
req.nktypes = count;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
