[15995] in Kerberos-V5-bugs
[krbdev.mit.edu #8666] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Wed May 2 01:29:47 2018
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Greg Hudson via RT" <rt-comment@KRBDEV-PROD-APP-1.mit.edu>
In-Reply-To: <rt-8666@krbdev.mit.edu>
Message-ID: <rt-8666-48490.6.80764187203998@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #8666'":;
Date: Wed, 2 May 2018 01:25:43 -0400 (EDT)
Reply-To: rt-comment@KRBDEV-PROD-APP-1.mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Fix KDC null dereference on large TGS replies
For TGS requests, dispatch() doesn't set state->active_realm, which
leads to a NULL dereference in finish_dispatch() if the reply is too
big for UDP. Prior to commit 0a2f14f752c32a24200363cc6b6ae64a92f81379
the active realm was a global and was set when process_tgs_req()
called setup_server_realm().
Move TGS decoding out of process_tgs_req() so that we can set
state->active_realm before any errors requiring response. Add a test
case.
[ghudson@mit.edu: edited commit message; added test case; reduced code
duplication; removed server handle from process_tgs_req() parameters]
(cherry picked from commit 6afa8b4abf8f7c5774d03e6b15ee7288ad68d725)
https://github.com/krb5/krb5/commit/086b505b7248ec78502857d6dac72a57c59b36e8
Author: Robbie Harwood <rharwood@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 086b505b7248ec78502857d6dac72a57c59b36e8
Branch: krb5-1.16
src/kdc/Makefile.in | 1 +
src/kdc/dispatch.c | 48 +++++++++++++++++++++++++++---------------------
src/kdc/do_tgs_req.c | 24 ++++++------------------
src/kdc/kdc_util.h | 5 ++---
src/kdc/t_bigreply.py | 19 +++++++++++++++++++
5 files changed, 55 insertions(+), 42 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
