From: Greg Hudson <ghudson@mit.edu>
Date: Tue, 25 May 2010 02:44:45 +0000 (+0000)
Subject: FAST negotiation could erroneously succeed
X-Git-Tag: krb5-1.9-beta1~211
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=c7f5da582f3cdd08cd82b0c6a25167303575014b;p=krb5.git

FAST negotiation could erroneously succeed

When FAST negotiation is performed against an older KDC
(rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set),
krb5int_fast_verify_nego did not set the value of *fast_avail, causing
stack garbage to be used in init_creds_step_reply.  Initialize
*fast_avail at the beginning of the function per coding practices.

ticket: 6734
target_version: 1.8.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24102 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
index 7a157f638..30be3818c 100644
--- a/src/lib/krb5/krb/fast.c
+++ b/src/lib/krb5/krb/fast.c
@@ -597,6 +597,7 @@ krb5int_fast_verify_nego(krb5_context context,
     krb5_data scratch;
     krb5_boolean valid;
 
+    *fast_avail = FALSE;
     if (rep->enc_part2->flags& TKT_FLG_ENC_PA_REP) {
         pa = krb5int_find_pa_data(context, rep->enc_part2->enc_padata,
                                   KRB5_ENCPADATA_REQ_ENC_PA_REP);