fix MITKRB5-SA-2006-003 for 1.5-branch
authorTom Yu <tlyu@mit.edu>
Wed, 10 Jan 2007 01:08:20 +0000 (01:08 +0000)
committerTom Yu <tlyu@mit.edu>
Wed, 10 Jan 2007 01:08:20 +0000 (01:08 +0000)
commitf2cd04ba52f75341687a69476ff3c950e9e4d980
treef518a8ff6568c0afb6eef8ceb55609b73ca1d104
parent34d3a9d632fee17703901d554196d910a9d7cefc
fix MITKRB5-SA-2006-003 for 1.5-branch

pull up r19043 from trunk

 r19043@cathode-dark-space:  tlyu | 2007-01-09 14:45:25 -0500
 ticket: new
 target_version: 1.6
 tags: pullup
 subject: MITKRB5-SA-2006-003: mechglue argument handling too lax
 component: krb5-libs

 Fix mechglue argument checks so that output pointers are always
 initialized regardless of whether the other arguments fail to validate
 for some reason.  This avoids freeing of uninitialized pointers.

 Initialize the gss_buffer_descs in ovsec_kadmd.c.

ticket: new
target_version: 1.5.2
version_fixed: 1.5.2
tags: pullup
component: krb5-libs

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-5@19050 dc483132-0cff-0310-8789-dd5450dbe970
25 files changed:
src/kadmin/server/ovsec_kadmd.c
src/lib/gssapi/mechglue/g_accept_sec_context.c
src/lib/gssapi/mechglue/g_acquire_cred.c
src/lib/gssapi/mechglue/g_canon_name.c
src/lib/gssapi/mechglue/g_compare_name.c
src/lib/gssapi/mechglue/g_delete_sec_context.c
src/lib/gssapi/mechglue/g_dsp_name.c
src/lib/gssapi/mechglue/g_dsp_status.c
src/lib/gssapi/mechglue/g_dup_name.c
src/lib/gssapi/mechglue/g_exp_sec_context.c
src/lib/gssapi/mechglue/g_export_name.c
src/lib/gssapi/mechglue/g_imp_name.c
src/lib/gssapi/mechglue/g_imp_sec_context.c
src/lib/gssapi/mechglue/g_init_sec_context.c
src/lib/gssapi/mechglue/g_initialize.c
src/lib/gssapi/mechglue/g_inq_context.c
src/lib/gssapi/mechglue/g_inq_cred.c
src/lib/gssapi/mechglue/g_inq_names.c
src/lib/gssapi/mechglue/g_process_context.c
src/lib/gssapi/mechglue/g_seal.c
src/lib/gssapi/mechglue/g_sign.c
src/lib/gssapi/mechglue/g_store_cred.c
src/lib/gssapi/mechglue/g_unseal.c
src/lib/gssapi/mechglue/g_verify.c
src/lib/gssapi/mechglue/oid_ops.c