[31604] in CVS-changelog-for-Kerberos-V5
krb5 commit: Detect iprop update of nonexistent principal
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 2 22:44:07 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261103034342.8A6A8101CCE@krbdev.mit.edu>
Date: Mon, 2 Nov 2026 22:43:42 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/3d5c8db948c2f4f67cc8b85eb94ad8a423c045f4
commit 3d5c8db948c2f4f67cc8b85eb94ad8a423c045f4
Author: Zoltan Borbely <Zoltan.Borbely@morganstanley.com>
Date: Tue Feb 10 19:05:16 2026 +0100
Detect iprop update of nonexistent principal
If the update log metadata falls out of sync with the database, a
non-creation update entry could be applied to a nonexistent principal.
This scenario currently results in a process abort with the DB2
database module when krb5_encode_princ_entry() is invoked with
entry->len set to zero. Detect this mismatch in ulog_conv_2dbentry()
and return an error to force a full resync.
[ghudson@mit.edu: rewrote comment and commit message]
ticket: 9280 (new)
tags: pullup
target_version: 1.22-next
src/lib/kdb/kdb_convert.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/lib/kdb/kdb_convert.c b/src/lib/kdb/kdb_convert.c
index 1231abc4f..a716c065a 100644
--- a/src/lib/kdb/kdb_convert.c
+++ b/src/lib/kdb/kdb_convert.c
@@ -747,6 +747,18 @@ ulog_conv_2dbentry(krb5_context context, krb5_db_entry **entry,
#undef u
}
+ if (ent->len == 0) {
+ /*
+ * The len field should have been set in the existing principal or (for
+ * a creation update) set in the update entry. If was not set, we just
+ * applied a non-creation update to a nonexistent principal, implying
+ * that our database is out of sync with our ulog metadata. Return an
+ * error to force a full resync.
+ */
+ ret = KRB5_KDB_NOENTRY;
+ goto cleanup;
+ }
+
/*
* process mod_princ_data request
*/
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
