[31554] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix PKINIT display of system errors from OpenSSL
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Thu Jul 9 22:03:39 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260710020332.7AA261055F8@krbdev.mit.edu>
Date: Thu, 9 Jul 2026 22:03:32 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/2cd34d81af21347c11a18556c58eabf3d010615f
commit 2cd34d81af21347c11a18556c58eabf3d010615f
Author: Greg Hudson <ghudson@mit.edu>
Date: Tue Jul 7 02:13:47 2026 -0400
Fix PKINIT display of system errors from OpenSSL
In oerr(), if ERR_reason_error_string() returns null for an OpenSSL
error code, fall back to strerror_r() if it is a system code. If we
do not successfully produce a reason string, do not pass a null string
to krb5_set_error_message().
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 11c570f0e..0a6fd7c1e 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -758,6 +758,7 @@ oerr(krb5_context context, krb5_error_code code, const char *fmt, ...)
unsigned long err;
va_list ap;
char *str, buf[128];
+ const char *reason;
int r;
if (!code)
@@ -770,12 +771,20 @@ oerr(krb5_context context, krb5_error_code code, const char *fmt, ...)
return code;
err = ERR_peek_error();
- if (err) {
- krb5_set_error_message(context, code, _("%s: %s"), str,
- ERR_reason_error_string(err));
- } else {
- krb5_set_error_message(context, code, "%s", str);
+ reason = err ? ERR_reason_error_string(err) : NULL;
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ /* Fall back to strerror_r() for system errors. */
+ if (reason == NULL && ERR_SYSTEM_ERROR(err)) {
+ if (strerror_r(ERR_GET_REASON(err), buf, sizeof(buf)) == 0)
+ reason = buf;
}
+#endif
+
+ if (reason != NULL)
+ krb5_set_error_message(context, code, _("%s: %s"), str, reason);
+ else
+ krb5_set_error_message(context, code, "%s", str);
TRACE_PKINIT_OPENSSL_ERROR(context, str);
while ((err = ERR_get_error()) != 0) {
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
