[31570] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix null dereference in SPNEGO token
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Aug 31 22:47:42 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260901024736.56DB7105757@krbdev.mit.edu>
Date: Mon, 31 Aug 2026 22:47:36 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/67b499d637014365fb13621285db88e89b8ddafb
commit 67b499d637014365fb13621285db88e89b8ddafb
Author: Jeremy Hitt <jeremy.hitt@isilon.com>
Date: Fri Feb 13 00:58:14 2026 +0000
Fix null dereference in SPNEGO token processing
Commit fdceb225f881e2b1337eebcb9a9443fa4a9be3fd erroneously removed a
check from get_negTokenResp() for successful decoding of the
mechListMIC field. Restore the check to prevent a null pointer
dereference.
[ghudson@mit.edu: rewrote commit message]
(cherry picked from commit 4ae75cded0fbeb1def4c82e352759089d80d40ab)
ticket: 9213
version_fixed: 1.22.3
src/lib/gssapi/spnego/spnego_mech.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index 4a7783643..1dd0f1706 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -3517,6 +3517,8 @@ get_negTokenResp(OM_uint32 *minor_status, struct k5input *in,
if (k5_der_get_value(&seq, CONTEXT | 0x03, &field)) {
*mechListMIC = get_octet_string(&field);
+ if (*mechListMIC == GSS_C_NO_BUFFER)
+ return GSS_S_DEFECTIVE_TOKEN;
/* Handle Windows 2000 duplicate response token */
if (*responseToken &&
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
