From: Tom Yu <tlyu@mit.edu>
Date: Thu, 14 Apr 2011 22:17:10 +0000 (+0000)
Subject: kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285]
X-Git-Tag: krb5-1.7.2-final~2
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=b5faed0e51b474b88a0e2f88035d0fb589b541e5;p=krb5.git

kadmind frees invalid pointer [MITKRB5-SA-2011-004 CVE-2011-0285]

back-port r24878 for 1.7-branch

 ------------------------------------------------------------------------
 r24878 | tlyu | 2011-04-13 14:43:37 -0400 (Wed, 13 Apr 2011) | 11 lines

 ticket: 6899
 tags: pullup
 target_version: 1.9.1

 Fix the sole case in process_chpw_request() where a return could occur
 without allocating the data pointer in the response.  This prevents a
 later free() of an invalid pointer in kill_tcp_or_rpc_connection().

 Also initialize rep->data to NULL in process_chpw_request() and clean
 up *response in dispatch() as an additional precaution.

ticket: 6901
status: resolved
version_fixed: 1.7.2

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-7@24881 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/kadmin/server/network.c b/src/kadmin/server/network.c
index df3f01cf0..0ea2e5027 100644
--- a/src/kadmin/server/network.c
+++ b/src/kadmin/server/network.c
@@ -1351,6 +1351,10 @@ cleanup:
     if (local_kaddrs != NULL)
 	krb5_free_addresses(server_handle->context, local_kaddrs);
 
+    if ((*response)->data == NULL) {
+        free(*response);
+        *response = NULL;
+    }
     krb5_kt_close(server_handle->context, kt);
 
     return ret;
diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index c3b7fa1e3..0cd28a0f9 100644
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -73,8 +73,13 @@ process_chpw_request(context, server_handle, realm, keytab,
     plen = (*ptr++ & 0xff);
     plen = (plen<<8) | (*ptr++ & 0xff);
 
-    if (plen != req->length)
-	return(KRB5KRB_AP_ERR_MODIFIED);
+    if (plen != req->length) {
+        ret = KRB5KRB_AP_ERR_MODIFIED;
+        numresult = KRB5_KPASSWD_MALFORMED;
+        strlcpy(strresult, "Request length was inconsistent",
+                sizeof(strresult));
+        goto chpwfail;
+    }
 
     /* verify version number */