From: Tom Yu <tlyu@mit.edu>
Date: Fri, 13 Mar 2009 21:16:14 +0000 (+0000)
Subject: CVE-2009-0845 SPNEGO can dereference a null pointer
X-Git-Tag: krb5-1.8-alpha1~596
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=4fa89fc784b87b22bb551e9a8dc754cb2392d732;p=krb5.git

CVE-2009-0845 SPNEGO can dereference a null pointer

acc_ctx_new() can return an error condition without establishing a
SPNEGO context structure.  This can cause a null pointer dereference
in cleanup code in spnego_gss_accept_sec_context().

ticket: 6417
tags: pullup
target_version: 1.7

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22084 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index 3a6653caf..708017a8d 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1650,7 +1650,8 @@ spnego_gss_accept_sec_context(
 				 &negState, &return_token);
 	}
 cleanup:
-	if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC) {
+	if (return_token == INIT_TOKEN_SEND ||
+	    return_token == CONT_TOKEN_SEND) {
 		/* For acceptor-sends-first send a tokenInit */
 		int tmpret;