Cross realm checks can check beyond end of buffer

        * keytab.c (is_xrealm_tgt): Use strncmp instead of strcmp - as
        principal and realm name do not need to be null terminated.

ticket: new
tags: pullup
target_version: 1.3

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15466 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/kdb/ChangeLog b/src/lib/kdb/ChangeLog
index de4ff5a5ebf5f04995526e15aa00d93e9f3eea56..87f60aad919f05adfda608b6449d1441d0cc6802 100644 (file)
--- a/src/lib/kdb/ChangeLog
+++ b/src/lib/kdb/ChangeLog
@@ -1,3 +1,8 @@
+2003-05-22  Ezra Peisach  <epeisach@mit.edu>
+
+       * keytab.c (is_xrealm_tgt): Use strncmp instead of strcmp - as
+       principal and realm name do not need to be null terminated.
+
 2003-04-01  Tom Yu  <tlyu@mit.edu>
 
        * Makefile.in: Remove $(SHLIB_DBLIB_DEPS) and related variables.

diff --git a/src/lib/kdb/keytab.c b/src/lib/kdb/keytab.c
index 90a81cac84cbce816c874eb87a92ceed1900ee2a..5db382cc25c686ab522a15718cdc9d74f9b502b9 100644 (file)
--- a/src/lib/kdb/keytab.c
+++ b/src/lib/kdb/keytab.c
@@ -217,7 +217,7 @@ is_xrealm_tgt(krb5_context context, krb5_const_principal princ)
     dat = krb5_princ_component(context, princ, 1);
     if (dat->length != princ->realm.length)
        return 1;
-    if (strcmp(dat->data, princ->realm.data) == 0)
+    if (strncmp(dat->data, princ->realm.data, dat->length) == 0)
        return 0;
     return 1;