[28477] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.12]: Fix unlikely null dereference in TGS client
daemon@ATHENA.MIT.EDU (Tom Yu)
Mon Jul 21 18:33:46 2014
Date: Mon, 21 Jul 2014 18:33:40 -0400
From: Tom Yu <tlyu@mit.edu>
Message-Id: <201407212233.s6LMXeJ8015844@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/70faf7db9d54ef464b220860d346c7d5f0ec83f3
commit 70faf7db9d54ef464b220860d346c7d5f0ec83f3
Author: Neng Xue <xnsuda@yahoo.com>
Date: Mon Jun 30 14:04:56 2014 -0700
Fix unlikely null dereference in TGS client code
If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an
error re-reading the profile), k5_make_tgs_req will dereference a null
pointer. Check the return value before dereferencing defenctypes.
[ghudson@mit.edu: clarified commit message]
(cherry picked from commit 81e503c09ad9aef4a0afc6bf66a0269cde2151f3)
ticket: 7952
version_fixed: 1.12.2
status: resolved
src/lib/krb5/krb/send_tgs.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/src/lib/krb5/krb/send_tgs.c b/src/lib/krb5/krb/send_tgs.c
index cd56366..f6fdf68 100644
--- a/src/lib/krb5/krb/send_tgs.c
+++ b/src/lib/krb5/krb/send_tgs.c
@@ -198,7 +198,9 @@ k5_make_tgs_req(krb5_context context,
req.nktypes = 1;
} else {
/* Get the default TGS enctypes. */
- krb5_get_tgs_ktypes(context, desired->server, &defenctypes);
+ ret = krb5_get_tgs_ktypes(context, desired->server, &defenctypes);
+ if (ret)
+ goto cleanup;
for (count = 0; defenctypes[count]; count++);
req.ktype = defenctypes;
req.nktypes = count;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
