* ser_actx.c (krb5_auth_context_externalize): Do bounds checking on converted size...

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14238 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog
index bbcb51f5dbef98b4a1b12787d9e1419f7ffdc806..fdf6a2e3676a141e5f4f695aacdda7cafd456e77 100644 (file)
--- a/src/lib/krb5/krb/ChangeLog
+++ b/src/lib/krb5/krb/ChangeLog
@@ -1,3 +1,8 @@
+2002-03-06  Ken Raeburn  <raeburn@mit.edu>
+
+       * ser_actx.c (krb5_auth_context_externalize): Do bounds checking
+       on converted size value.
+
 2002-02-27  Sam Hartman  <hartmans@mit.edu>
 
        * rd_cred.c (krb5_rd_cred_basic): Don't check IP addresses; if

diff --git a/src/lib/krb5/krb/fwd_tgt.c b/src/lib/krb5/krb/fwd_tgt.c
index 9c8a1046b37c40708da6147db8d06c1f43f83a11..06a1bcd4da357e3683baa7628b937bd7cf6dbebb 100644 (file)
--- a/src/lib/krb5/krb/fwd_tgt.c
+++ b/src/lib/krb5/krb/fwd_tgt.c
@@ -79,9 +79,30 @@ krb5_fwd_tgt_creds(context, auth_context, rhost, client, server, cc,
     if (retval)
       goto errout;
     if (session_key) {
-      enctype = session_key->enctype;
-      krb5_free_keyblock (context, session_key);
-      session_key = NULL;
+       enctype = session_key->enctype;
+       krb5_free_keyblock (context, session_key);
+       session_key = NULL;
+    } else if (server) { /* must server be non-NULL when rhost is given? */
+       /* Try getting credentials to see what the remote side supports.
+          Not bulletproof, just a heuristic.  */
+       krb5_creds in, *out = 0;
+       memset (&in, 0, sizeof(in));
+
+       retval = krb5_copy_principal (context, server, &in.server);
+       if (retval)
+           goto punt;
+       retval = krb5_copy_principal (context, client, &in.client);
+       if (retval)
+           goto punt;
+       retval = krb5_get_credentials (context, 0, cc, &in, &out);
+       if (retval)
+           goto punt;
+       /* Got the credentials.  Okay, now record the enctype and
+          throw them away.  */
+       enctype = out->keyblock.enctype;
+       krb5_free_creds (context, out);
+    punt:
+       krb5_free_cred_contents (context, &in);
     }
     
     retval = krb5_os_hostaddr(context, rhost, &addrs);

diff --git a/src/lib/krb5/krb/ser_actx.c b/src/lib/krb5/krb/ser_actx.c
index ec82aaa9e1693cf841a51441a4b02dfa66358613..7844a5e70e14561a34961d0395af17eb78c3bdc2 100644 (file)
--- a/src/lib/krb5/krb/ser_actx.c
+++ b/src/lib/krb5/krb/ser_actx.c
@@ -240,6 +240,8 @@ krb5_auth_context_externalize(kcontext, arg, buffer, lenremain)
 
            /* Convert to signed 32 bit integer */
            obuf32 = obuf;
+           if (kret == 0 && obuf != obuf32)
+               kret = EINVAL;
            if (!kret)
                (void) krb5_ser_pack_int32(obuf32, &bp, &remain);