pullup from trunk

ticket: 2877
version_fixed: 1.4

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-4@17040 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/rpc/ChangeLog b/src/lib/rpc/ChangeLog
index 4c462856547b969cdfb3e3af13adcb1804fd0bb4..def5183a367f5df3825d43d36dd568fa1442982d 100644 (file)
--- a/src/lib/rpc/ChangeLog
+++ b/src/lib/rpc/ChangeLog
@@ -1,3 +1,17 @@
+2005-01-14  Tom Yu  <tlyu@mit.edu>
+
+       * xdr.c (xdr_bytes): Revert previous; the problem was actually in
+       xdr_rpc_gss_buf.
+
+       * authgss_prot.c (xdr_rpc_gss_wrap_data): Use xdr_alloc to avoid
+       size limit issues.  Use (unsigned int)-1 instead of MAX_NETOBJ_SZ.
+       (xdr_rpc_gss_unwrap_data): Use (unsigned int)-1 instead of
+       MAX_NETOBJ_SZ.
+       (xdr_rpc_gss_buf): Set tmplen even if doing XDR_FREE.
+
+       * xdr.c (xdr_bytes): Don't assign from *sizep if XDR_FREE, since
+       it'll be uninitialized then.  Shuts up Purify.
+
 2004-11-18  Tom Yu  <tlyu@mit.edu>
 
        * Makefile.in (install-unix): Install into KRB5_INCDIR/gssrpc,

diff --git a/src/lib/rpc/authgss_prot.c b/src/lib/rpc/authgss_prot.c
index 0e8029abd512c7eafbf325516afd7c5c0b80a1ef..ab6e7fea077cc7832580c3e3da6cc85ba84e7431 100644 (file)
--- a/src/lib/rpc/authgss_prot.c
+++ b/src/lib/rpc/authgss_prot.c
@@ -52,7 +52,7 @@ xdr_rpc_gss_buf(XDR *xdrs, gss_buffer_t buf, u_int maxsize)
        bool_t xdr_stat;
        u_int tmplen;
 
-       if (xdrs->x_op == XDR_ENCODE) {
+       if (xdrs->x_op != XDR_DECODE) {
                if (buf->length > UINT_MAX)
                        return (FALSE);
                else
@@ -129,54 +129,37 @@ xdr_rpc_gss_wrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr,
                      gss_ctx_id_t ctx, gss_qop_t qop,
                      rpc_gss_svc_t svc, uint32_t seq)
 {
+       XDR             tmpxdrs;
        gss_buffer_desc databuf, wrapbuf;
        OM_uint32       maj_stat, min_stat;
-       u_int           start, end;
        int             conf_state;
        bool_t          xdr_stat;
-       u_int           tmplen;
 
-       /* Skip databody length. */
-       start = XDR_GETPOS(xdrs);
-       if (start > UINT_MAX - 4)
-               return (FALSE);
-       XDR_SETPOS(xdrs, start + 4);
+       xdralloc_create(&tmpxdrs, XDR_ENCODE);
+
+       xdr_stat = FALSE;
        
        /* Marshal rpc_gss_data_t (sequence number + arguments). */
-       if (!xdr_u_int32(xdrs, &seq) || !(*xdr_func)(xdrs, xdr_ptr))
-               return (FALSE);
-       end = XDR_GETPOS(xdrs);
-       if (end < start + 4)
-               return (FALSE);
+       if (!xdr_u_int32(&tmpxdrs, &seq) || !(*xdr_func)(&tmpxdrs, xdr_ptr))
+               goto errout;
 
        /* Set databuf to marshalled rpc_gss_data_t. */
-       databuf.length = end - start - 4;
-       XDR_SETPOS(xdrs, start + 4);
-       databuf.value = XDR_INLINE(xdrs, (int)databuf.length);
+       databuf.length = xdr_getpos(&tmpxdrs);
+       databuf.value = xdralloc_getdata(&tmpxdrs);
 
-       xdr_stat = FALSE;
-       
        if (svc == RPCSEC_GSS_SVC_INTEGRITY) {
-               /* Marshal databody_integ length. */
-               XDR_SETPOS(xdrs, start);
-               if (databuf.length > UINT_MAX)
-                       return (FALSE);
-               else
-                       tmplen = databuf.length;
+               if (!xdr_rpc_gss_buf(xdrs, &databuf, (unsigned int)-1))
+                       goto errout;
 
-               if (!xdr_u_int(xdrs, &tmplen))
-                       return (FALSE);
-               
                /* Checksum rpc_gss_data_t. */
                maj_stat = gss_get_mic(&min_stat, ctx, qop,
                                       &databuf, &wrapbuf);
                if (maj_stat != GSS_S_COMPLETE) {
                        log_debug("gss_get_mic failed");
-                       return (FALSE);
+                       goto errout;
                }
                /* Marshal checksum. */
-               XDR_SETPOS(xdrs, end);
-               xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ);
+               xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1);
                gss_release_buffer(&min_stat, &wrapbuf);
        }               
        else if (svc == RPCSEC_GSS_SVC_PRIVACY) {
@@ -185,13 +168,14 @@ xdr_rpc_gss_wrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr,
                                    &conf_state, &wrapbuf);
                if (maj_stat != GSS_S_COMPLETE) {
                        log_status("gss_wrap", maj_stat, min_stat);
-                       return (FALSE);
+                       goto errout;
                }
                /* Marshal databody_priv. */
-               XDR_SETPOS(xdrs, start);
-               xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ);
+               xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1);
                gss_release_buffer(&min_stat, &wrapbuf);
        }
+errout:
+       xdr_destroy(&tmpxdrs);
        return (xdr_stat);
 }
 
@@ -216,12 +200,12 @@ xdr_rpc_gss_unwrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr,
        
        if (svc == RPCSEC_GSS_SVC_INTEGRITY) {
                /* Decode databody_integ. */
-               if (!xdr_rpc_gss_buf(xdrs, &databuf, MAX_NETOBJ_SZ)) {
+               if (!xdr_rpc_gss_buf(xdrs, &databuf, (unsigned int)-1)) {
                        log_debug("xdr decode databody_integ failed");
                        return (FALSE);
                }
                /* Decode checksum. */
-               if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ)) {
+               if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1)) {
                        gss_release_buffer(&min_stat, &databuf);
                        log_debug("xdr decode checksum failed");
                        return (FALSE);
@@ -239,7 +223,7 @@ xdr_rpc_gss_unwrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr,
        }
        else if (svc == RPCSEC_GSS_SVC_PRIVACY) {
                /* Decode databody_priv. */
-               if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ)) {
+               if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1)) {
                        log_debug("xdr decode databody_priv failed");
                        return (FALSE);
                }

diff --git a/src/tests/dejagnu/krb-standalone/ChangeLog b/src/tests/dejagnu/krb-standalone/ChangeLog
index fe26d2abffa9afd88ac3666f98b58e9a7a460e58..873c34b309a25d5e189298da5b238e9001ec5ffd 100644 (file)
--- a/src/tests/dejagnu/krb-standalone/ChangeLog
+++ b/src/tests/dejagnu/krb-standalone/ChangeLog
@@ -1,3 +1,10 @@
+2005-01-14  Tom Yu  <tlyu@mit.edu>
+
+       * kadmin.exp (kadmin_list): Check for communication failure.
+       (kadmin_test): Create a large number of principals, then attempt
+       to list, in order to check for fixed-size buffer problems in
+       RPCSEC_GSS.
+
 2004-12-20  Tom Yu  <tlyu@mit.edu>
 
        * pwhist.exp: New file.  Perform some sanity checking on password

diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp
index ded386d3de1c67dd00338adc305ea499ba32fb9a..c72548114fdd5c4bc4d99894fd016da915c5b1c3 100644 (file)
--- a/src/tests/dejagnu/krb-standalone/kadmin.exp
+++ b/src/tests/dejagnu/krb-standalone/kadmin.exp
@@ -402,6 +402,11 @@ proc kadmin_list {  } {
            catch "expect_after"
            return 0
        }
+       "Communication failure" {
+           fail "kadmin ldb got RPC error"
+           catch "expect_after"
+           return 0
+       }
        timeout {
            fail "kadmin ldb"
            catch "expect_after"
@@ -416,7 +421,7 @@ proc kadmin_list {  } {
     expect -re "assword\[^\r\n\]*: *" {
        send "adminpass$KEY\r"
     }
-    expect -re "\(.*@$REALMNAME\r\n\)*"
+    expect -re "\(.*@$REALMNAME\r\n\)+"
     expect_after
     expect eof
     set k_stat [wait -i $spawn_id]
@@ -1033,6 +1038,17 @@ proc kadmin_test { } {
        return
     }
 
+    # test retrieval of large number of principals
+    # bug [2877]
+    for { set i 0 } { $i < 200 } { incr i } {
+       if { ![kadmin_add "foo$i" foopass] } {
+           return
+       }
+    }
+
+    if { ![kadmin_list] } {
+       return
+    }
     verbose "kadmin_test succeeded"
 }