[31617] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Detect iprop update of nonexistent principal
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Tue Nov 3 19:18:40 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261104001835.00AFC105851@krbdev.mit.edu>
Date: Tue, 3 Nov 2026 19:18:34 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/9f9ecf6933191a22b68b7041986611ac0f318f41
commit 9f9ecf6933191a22b68b7041986611ac0f318f41
Author: Zoltan Borbely <Zoltan.Borbely@morganstanley.com>
Date: Tue Feb 10 19:05:16 2026 +0100
Detect iprop update of nonexistent principal
If the update log metadata falls out of sync with the database, a
non-creation update entry could be applied to a nonexistent principal.
This scenario currently results in a process abort with the DB2
database module when krb5_encode_princ_entry() is invoked with
entry->len set to zero. Detect this mismatch in ulog_conv_2dbentry()
and return an error to force a full resync.
[ghudson@mit.edu: rewrote comment and commit message]
(cherry picked from commit 3d5c8db948c2f4f67cc8b85eb94ad8a423c045f4)
ticket: 9280
version_fixed: 1.22.3
src/lib/kdb/kdb_convert.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/lib/kdb/kdb_convert.c b/src/lib/kdb/kdb_convert.c
index 1231abc4f..a716c065a 100644
--- a/src/lib/kdb/kdb_convert.c
+++ b/src/lib/kdb/kdb_convert.c
@@ -747,6 +747,18 @@ ulog_conv_2dbentry(krb5_context context, krb5_db_entry **entry,
#undef u
}
+ if (ent->len == 0) {
+ /*
+ * The len field should have been set in the existing principal or (for
+ * a creation update) set in the update entry. If was not set, we just
+ * applied a non-creation update to a nonexistent principal, implying
+ * that our database is out of sync with our ulog metadata. Return an
+ * error to force a full resync.
+ */
+ ret = KRB5_KDB_NOENTRY;
+ goto cleanup;
+ }
+
/*
* process mod_princ_data request
*/
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
