[15943] in Kerberos-V5-bugs
[krbdev.mit.edu #8666] Explicit NULL deref in finish_dispatch()
daemon@ATHENA.MIT.EDU (Robbie Harwood via RT)
Wed Apr 18 17:10:15 2018
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Robbie Harwood via RT" <rt-comment@KRBDEV-PROD-APP-1.mit.edu>
In-Reply-To: <rt-8666@krbdev.mit.edu>
Message-ID: <rt-8666-48396.6.13435588785485@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #8666'":;
Date: Wed, 18 Apr 2018 17:09:57 -0400 (EDT)
Reply-To: rt-comment@KRBDEV-PROD-APP-1.mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
In dispatch.c, dispatch() allocates a dispatch_state structure called
state, and initializes some fields. However, unless krb5_is_as_req(pkt)
is true, state->active_realm does not get initialized before the state
object is passed to finish_dispatch_cache.
finish_dispatch_cache() passes through state to finish_dispatch().
finish_dispatch() invokes the kdc_context macro in a call to
krb5_free_data(), which dereferences state->active_realm (for
realm_tgsprinc).
This is an explicit NULL dereference. Worth noting also is that
make_too_big_error() will attempt to dereference the same value later in
finish_dispatch().
Thanks,
--Robbie
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
