From: Tom Yu <tlyu@mit.edu>
Date: Mon, 5 Dec 2011 21:38:44 +0000 (+0000)
Subject: pull up r25480 from trunk, minus a non-applying manpage patch
X-Git-Tag: krb5-1.9.3-final~7
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=2b90ddc305e4fde5e6d296a4495227eaa4ad79d5;p=krb5.git

pull up r25480 from trunk, minus a non-applying manpage patch

 ------------------------------------------------------------------------
 r25480 | ghudson | 2011-11-20 00:19:45 -0500 (Sun, 20 Nov 2011) | 13 lines

 ticket: 7021
 subject: Fix failure interval of 0 in LDAP lockout code
 target_version: 1.10
 tags: pullup

 A failure count interval of 0 caused krb5_ldap_lockout_check_policy to
 pass the lockout check (but didn't cause a reset of the failure count
 in krb5_ldap_lockout_audit).  It should be treated as forever, as in
 the DB2 back end.

 This bug is the previously unknown cause of the assertion failure
 fixed in CVE-2011-1528.

ticket: 7040
version_fixed: 1.9.3
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@25513 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
index fd164dd98..401cc43be 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
@@ -131,7 +131,7 @@ krb5_ldap_lockout_check_policy(krb5_context context,
     code = lookup_lockout_policy(context, entry, &max_fail,
                                  &failcnt_interval,
                                  &lockout_duration);
-    if (code != 0 || failcnt_interval == 0)
+    if (code != 0)
         return code;
 
     if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))