[31538] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix null dereference in SPNEGO token processing
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Wed May 20 19:41:58 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260520234154.C3AB8101BCB@krbdev.mit.edu>
Date: Wed, 20 May 2026 19:41:54 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/4ae75cded0fbeb1def4c82e352759089d80d40ab
commit 4ae75cded0fbeb1def4c82e352759089d80d40ab
Author: Jeremy Hitt <jeremy.hitt@isilon.com>
Date: Fri Feb 13 00:58:14 2026 +0000
Fix null dereference in SPNEGO token processing
Commit fdceb225f881e2b1337eebcb9a9443fa4a9be3fd erroneously removed a
check from get_negTokenResp() for successful decoding of the
mechListMIC field. Restore the check to prevent a null pointer
dereference.
[ghudson@mit.edu: rewrote commit message]
ticket: 9213 (new)
tags: pullup
target_version: 1.22-next
src/lib/gssapi/spnego/spnego_mech.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index f0c37c7cd..23f93c240 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -3517,6 +3517,8 @@ get_negTokenResp(OM_uint32 *minor_status, struct k5input *in,
if (k5_der_get_value(&seq, CONTEXT | 0x03, &field)) {
*mechListMIC = get_octet_string(&field);
+ if (*mechListMIC == GSS_C_NO_BUFFER)
+ return GSS_S_DEFECTIVE_TOKEN;
/* Handle Windows 2000 duplicate response token */
if (*responseToken &&
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
