[2684] in Kerberos-V5-bugs
krb5-kdc/387: KDC drops core
daemon@ATHENA.MIT.EDU (John R. Jackson)
Tue Mar 11 18:04:01 1997
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: krb5-unassigned@RT-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU, jrj@cc.purdue.edu
Date: Tue, 11 Mar 1997 17:59:02 -0500 (EST)
From: "John R. Jackson" <jrj@fortress.cc.purdue.edu>
Reply-To: jrj@cc.purdue.edu
To: krb5-bugs@MIT.EDU
>Number: 387
>Category: krb5-kdc
>Synopsis: KDC drops core
>Confidential: no
>Severity: serious
>Priority: low
>Responsible: krb5-unassigned
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Tue Mar 11 18:01:00 EST 1997
>Last-Modified:
>Originator: John R. Jackson
>Organization:
Purdue University Computing Center
>Release: 1.0
>Environment:
System: SunOS fortress.cc.purdue.edu 5.5.1 Generic_103640-03 sun4d sparc SUNW,SPARCserver-1000
Architecture: sun4
>Description:
Since setting up cross realms is completely undocumented :-(, I'm
having to just take wild guesses. During one of these sessions,
I ended up with a setup that causes the KDC to drop core because
of missing error condition tests in krb5_ktkdb_get_entry().
It is trying to look up a principal (I think the host/XXX one)
with the "wrong" kvno (i.e. there is no key with that vno). I
don't know why it is trying to do this (i.e. where it got the kvno
it is trying to use), but the point is that the current code does
not test for krb5_dbm_db_get_mkey() or krb5_dbe_find_enctype()
failing and (as I recall) krb5_dbekd_decrypt_key_data() ends up
dereferencing a NULL pointer.
>How-To-Repeat:
Sorry, but since I'm flying blind on setting this up, I don't know
how to tell you to reproduce it, but the suggested patch is pretty
self-evident.
>Fix:
Index: keytab.c
===================================================================
RCS file: /usr/src/cvsroot/kerberos/src/lib/kdb/keytab.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 keytab.c
--- keytab.c 1996/12/06 14:54:07 1.1.1.1
+++ keytab.c 1997/02/28 23:35:39
@@ -126,8 +126,11 @@
return KRB5_KT_NOTFOUND;
}
/* match key */
- krb5_dbm_db_get_mkey(context, id->ops, &master_key);
- krb5_dbe_find_enctype(context, &db_entry, enctype, -1, kvno, &key_data);
+ if (kerror = krb5_dbm_db_get_mkey(context, id->ops, &master_key))
+ goto error;
+ if (kerror = krb5_dbe_find_enctype(context, &db_entry, enctype, -1,
+ kvno, &key_data))
+ goto error;
if (kerror = krb5_dbekd_decrypt_key_data(context, master_key, key_data,
&entry->key, NULL))
goto error;
>Audit-Trail:
>Unformatted:
