[31544] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix reachable assert when importing krb5 names
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Sun Jun 7 22:13:04 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260608021259.71F20105545@krbdev.mit.edu>
Date: Sun, 7 Jun 2026 22:12:59 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/07818f1fd34560dbfd87c2f65bf8cd705be0e1d2
commit 07818f1fd34560dbfd87c2f65bf8cd705be0e1d2
Author: Greg Hudson <ghudson@mit.edu>
Date: Mon Jun 1 08:59:34 2026 -0400
Fix reachable assert when importing krb5 names
If a name token contains trailing garbage, error out from
krb5_gss_import_name() instead of crashing the process with an
assertion failure. Reported by Aisle Research (Ze Sheng, Dmitrijs
Trizna, Luigino Camastra, Guido Vranken).
ticket: 9217
tags: pullup
target_version: 1.22-next
src/lib/gssapi/krb5/import_name.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/lib/gssapi/krb5/import_name.c b/src/lib/gssapi/krb5/import_name.c
index a067d0742..9a27b1468 100644
--- a/src/lib/gssapi/krb5/import_name.c
+++ b/src/lib/gssapi/krb5/import_name.c
@@ -297,7 +297,8 @@ import_name(OM_uint32 *minor_status, gss_buffer_t input_name_buffer,
goto fail_name;
cp += length;
}
- assert(cp == end);
+ if (cp != end)
+ goto fail_name;
} else {
status = GSS_S_BAD_NAMETYPE;
goto cleanup;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
