From 37d6df8704b4210e690ffeb3afc95fd240cceaa2 Mon Sep 17 00:00:00 2001
From: Ezra Peisach <epeisach@mit.edu>
Date: Tue, 17 Oct 2000 22:59:50 +0000
Subject: [PATCH] 	* asn1buf.h: Lengths are now unsigned int for 
 asn1buf_ensure_space(), asn1buf_expand(), asn1buf_imbed(), 
 asn1buf_sync(), asn1buf_insert_octetstring(), 	asn1buf_insert_charstring(),
 asn1_remove_octetstring(), 	asn1buf_remove_charstring(),

	* krb5_decode.c, krb5_encode.c: Length fields are unsigned ints.

	* asn1_make.c, asn1_make.h: Prototypes changed to use an unsigned
	int * in_len and retlen for: asn1_make_etag(), asn1_make_tag(),
	asn1_make_sequence(), asn1_make_set(), asn1_make_string(),
	asn1_make_length(), asn1_make_id().

	* asn1_k_encode.h, asn1_k_encode.c: Change length fields to
	unsigned ints for all functions.
	(asn1_encode_etype_info_entry): Test for KRB5_ETYPE_NO_SALT
	instead of -1.

	* asn1_k_decode.c (asn1_decode_etype_info_entry): Use a length of
	KRB5_ETYPE_NO_SALT to indicate the optional salt not being
	present. (instead of -1).
	(setup): Length is now unsigned int.

	* asn1_get.c, asn1_get.h: Change retlent to unsigned int * for
	asn1_get_tag(), asn1_get_tag_indef(), asn1_get_sequence,
	asn1_get_length().

	* asn1_encode.c, asn1_encode.h: Change retlen to unsigned int *
	for asn1_encode_integer(), asn1_encode_unsigned_integer(),
	asn1_encode_octetstring(), asn1_encode_charstring(),
	asn1_encode_printable_string(), asn1_encode_ia5string(),
	asn1_encode_generaltime(), asn1_encode_generalstring()

	* asn1_decode.c, asn1_decode.h: Change retlen to unsigned int *
	for asn1_decode_octetstring(), asn1_decode_generalstring(),
	asn1_decode_charstring(),

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@12779 dc483132-0cff-0310-8789-dd5450dbe970
---
 src/lib/krb5/asn.1/ChangeLog       | 39 +++++++++++++
 src/lib/krb5/asn.1/asn1_decode.c   |  8 +--
 src/lib/krb5/asn.1/asn1_decode.h   |  6 +-
 src/lib/krb5/asn.1/asn1_encode.c   | 40 +++++++------
 src/lib/krb5/asn.1/asn1_encode.h   | 23 ++++----
 src/lib/krb5/asn.1/asn1_get.c      |  8 +--
 src/lib/krb5/asn.1/asn1_get.h      |  8 +--
 src/lib/krb5/asn.1/asn1_k_decode.c | 10 ++--
 src/lib/krb5/asn.1/asn1_k_encode.c | 92 +++++++++++++++---------------
 src/lib/krb5/asn.1/asn1_k_encode.h | 84 +++++++++++++--------------
 src/lib/krb5/asn.1/asn1_make.c     | 31 +++++-----
 src/lib/krb5/asn.1/asn1_make.h     | 20 ++++---
 src/lib/krb5/asn.1/asn1buf.c       | 31 +++++-----
 src/lib/krb5/asn.1/asn1buf.h       | 19 +++---
 src/lib/krb5/asn.1/krb5_decode.c   |  2 +-
 src/lib/krb5/asn.1/krb5_encode.c   |  8 +--
 16 files changed, 239 insertions(+), 190 deletions(-)

diff --git a/src/lib/krb5/asn.1/ChangeLog b/src/lib/krb5/asn.1/ChangeLog
index e0c1f427f..f5aa4d7cc 100644
--- a/src/lib/krb5/asn.1/ChangeLog
+++ b/src/lib/krb5/asn.1/ChangeLog
@@ -1,3 +1,42 @@
+2000-10-17  Ezra Peisach  <epeisach@mit.edu>
+
+	* asn1buf.h: Lengths are now unsigned int for
+	asn1buf_ensure_space(), asn1buf_expand(), asn1buf_imbed(),
+	asn1buf_sync(), asn1buf_insert_octetstring(),
+	asn1buf_insert_charstring(), asn1_remove_octetstring(),
+	asn1buf_remove_charstring(),
+
+	* krb5_decode.c, krb5_encode.c: Length fields are unsigned ints. 
+	
+	* asn1_make.c, asn1_make.h: Prototypes changed to use an unsigned
+	int * in_len and retlen for: asn1_make_etag(), asn1_make_tag(),
+	asn1_make_sequence(), asn1_make_set(), asn1_make_string(),
+	asn1_make_length(), asn1_make_id().
+
+	* asn1_k_encode.h, asn1_k_encode.c: Change length fields to
+	unsigned ints for all functions.
+	(asn1_encode_etype_info_entry): Test for KRB5_ETYPE_NO_SALT
+	instead of -1.
+	
+	* asn1_k_decode.c (asn1_decode_etype_info_entry): Use a length of
+	KRB5_ETYPE_NO_SALT to indicate the optional salt not being
+	present. (instead of -1).
+	(setup): Length is now unsigned int.
+
+	* asn1_get.c, asn1_get.h: Change retlent to unsigned int * for
+	asn1_get_tag(), asn1_get_tag_indef(), asn1_get_sequence,
+	asn1_get_length().
+
+	* asn1_encode.c, asn1_encode.h: Change retlen to unsigned int *
+	for asn1_encode_integer(), asn1_encode_unsigned_integer(),
+	asn1_encode_octetstring(), asn1_encode_charstring(),
+	asn1_encode_printable_string(), asn1_encode_ia5string(),
+	asn1_encode_generaltime(), asn1_encode_generalstring()
+
+	* asn1_decode.c, asn1_decode.h: Change retlen to unsigned int *
+	for asn1_decode_octetstring(), asn1_decode_generalstring(),
+	asn1_decode_charstring(),
+
 2000-09-26  Tom Yu  <tlyu@mit.edu>
 
 	* asn1_get.c (asn1_get_tag_indef): Fix to not deref random garbage
diff --git a/src/lib/krb5/asn.1/asn1_decode.c b/src/lib/krb5/asn.1/asn1_decode.c
index dc0824b6d..74d453091 100644
--- a/src/lib/krb5/asn.1/asn1_decode.c
+++ b/src/lib/krb5/asn.1/asn1_decode.c
@@ -42,7 +42,7 @@ asn1_error_code retval;\
 asn1_class class;\
 asn1_construction construction;\
 asn1_tagnum tagnum;\
-int length
+unsigned int length
 
 #define tag(type)\
 retval = asn1_get_tag(buf,&class,&construction,&tagnum,&length);\
@@ -110,7 +110,7 @@ asn1_error_code asn1_decode_unsigned_integer(buf, val)
 
 asn1_error_code asn1_decode_octetstring(buf, retlen, val)
      asn1buf * buf;
-     int * retlen;
+     unsigned int * retlen;
      asn1_octet ** val;
 {
   setup();
@@ -123,7 +123,7 @@ asn1_error_code asn1_decode_octetstring(buf, retlen, val)
 
 asn1_error_code asn1_decode_charstring(buf, retlen, val)
      asn1buf * buf;
-     int * retlen;
+     unsigned int * retlen;
      char ** val;
 {
   setup();
@@ -137,7 +137,7 @@ asn1_error_code asn1_decode_charstring(buf, retlen, val)
 
 asn1_error_code asn1_decode_generalstring(buf, retlen, val)
      asn1buf * buf;
-     int * retlen;
+     unsigned int * retlen;
      char ** val;
 {
   setup();
diff --git a/src/lib/krb5/asn.1/asn1_decode.h b/src/lib/krb5/asn.1/asn1_decode.h
index 31de79b68..597d23940 100644
--- a/src/lib/krb5/asn.1/asn1_decode.h
+++ b/src/lib/krb5/asn.1/asn1_decode.h
@@ -66,11 +66,11 @@ asn1_error_code asn1_decode_null
 	PROTOTYPE((asn1buf *buf));
 
 asn1_error_code asn1_decode_octetstring
-	PROTOTYPE((asn1buf *buf, int *retlen, asn1_octet **val));
+	PROTOTYPE((asn1buf *buf, unsigned int *retlen, asn1_octet **val));
 asn1_error_code asn1_decode_generalstring
-	PROTOTYPE((asn1buf *buf, int *retlen, char **val));
+	PROTOTYPE((asn1buf *buf, unsigned int *retlen, char **val));
 asn1_error_code asn1_decode_charstring
-	PROTOTYPE((asn1buf *buf, int *retlen, char **val));
+	PROTOTYPE((asn1buf *buf, unsigned int *retlen, char **val));
 /* Note: A charstring is a special hack to account for the fact that
          krb5 structures store some OCTET STRING values in krb5_octet
 	 arrays and others in krb5_data structures 
diff --git a/src/lib/krb5/asn.1/asn1_encode.c b/src/lib/krb5/asn.1/asn1_encode.c
index 7ef89c8c2..69d94f410 100644
--- a/src/lib/krb5/asn.1/asn1_encode.c
+++ b/src/lib/krb5/asn.1/asn1_encode.c
@@ -32,10 +32,11 @@
 asn1_error_code asn1_encode_integer(buf, val, retlen)
      asn1buf * buf;
      const long val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int length = 0, partlen;
+  unsigned int length = 0;
+  unsigned int partlen;
   long valcopy;
   int digit;
   
@@ -69,10 +70,11 @@ asn1_error_code asn1_encode_integer(buf, val, retlen)
 asn1_error_code asn1_encode_unsigned_integer(buf, val, retlen)
      asn1buf * buf;
      const unsigned long val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int length = 0, partlen;
+  unsigned int length = 0;
+  unsigned int partlen;
   unsigned long valcopy;
   int digit;
   
@@ -101,12 +103,12 @@ asn1_error_code asn1_encode_unsigned_integer(buf, val, retlen)
 
 asn1_error_code asn1_encode_octetstring(buf, len, val, retlen)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      const asn1_octet * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int length;
+  unsigned int length;
 
   retval = asn1buf_insert_octetstring(buf,len,val);
   if(retval) return retval;
@@ -119,12 +121,12 @@ asn1_error_code asn1_encode_octetstring(buf, len, val, retlen)
 
 asn1_error_code asn1_encode_charstring(buf, len, val, retlen)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      const char * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int length;
+  unsigned int length;
 
   retval = asn1buf_insert_charstring(buf,len,val);
   if(retval) return retval;
@@ -152,12 +154,12 @@ asn1_error_code asn1_encode_null(buf, retlen)
 
 asn1_error_code asn1_encode_printablestring(buf, len, val, retlen)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      const char * val;
      int * retlen;
 {
   asn1_error_code retval;
-  int length;
+  unsigned int length;
 
   retval = asn1buf_insert_charstring(buf,len,val);
   if(retval) return retval;
@@ -170,12 +172,12 @@ asn1_error_code asn1_encode_printablestring(buf, len, val, retlen)
 
 asn1_error_code asn1_encode_ia5string(buf, len, val, retlen)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      const char * val;
      int * retlen;
 {
   asn1_error_code retval;
-  int length;
+  unsigned int length;
 
   retval = asn1buf_insert_charstring(buf,len,val);
   if(retval) return retval;
@@ -195,12 +197,12 @@ asn1_error_code asn1_encode_ia5string(buf, len, val, retlen)
 asn1_error_code asn1_encode_generaltime(buf, val, retlen)
      asn1buf * buf;
      const time_t val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
   struct tm *gtime;
   char s[16];
-  int length, sum=0;
+  unsigned int length, sum=0;
   time_t gmt_time;
 
   gmt_time = val + EPOCH;
@@ -235,12 +237,12 @@ asn1_error_code asn1_encode_generaltime(buf, val, retlen)
 
 asn1_error_code asn1_encode_generalstring(buf, len, val, retlen)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      const char * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int length;
+  unsigned int length;
 
   retval = asn1buf_insert_charstring(buf,len,val);
   if(retval) return retval;
diff --git a/src/lib/krb5/asn.1/asn1_encode.h b/src/lib/krb5/asn.1/asn1_encode.h
index 72686fba1..06ba6f3fe 100644
--- a/src/lib/krb5/asn.1/asn1_encode.h
+++ b/src/lib/krb5/asn.1/asn1_encode.h
@@ -50,7 +50,7 @@
 */
 
 asn1_error_code asn1_encode_integer
-	PROTOTYPE((asn1buf *buf, const long val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const long val, unsigned int *retlen));
 /* requires  *buf is allocated
    modifies  *buf, *retlen
    effects   Inserts the encoding of val into *buf and returns 
@@ -59,7 +59,8 @@ asn1_error_code asn1_encode_integer
               to expand the buffer. */
 
 asn1_error_code asn1_encode_unsigned_integer
-	PROTOTYPE((asn1buf *buf, const unsigned long val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const unsigned long val, 
+		   unsigned int *retlen));
 /* requires  *buf is allocated
    modifies  *buf, *retlen
    effects   Inserts the encoding of val into *buf and returns 
@@ -69,8 +70,8 @@ asn1_error_code asn1_encode_unsigned_integer
 
 asn1_error_code asn1_encode_octetstring
 	PROTOTYPE((asn1buf *buf,
-		   const int len, const asn1_octet *val,
-		   int *retlen));
+		   const unsigned int len, const asn1_octet *val,
+		   unsigned int *retlen));
 /* requires  *buf is allocated
    modifies  *buf, *retlen
    effects   Inserts the encoding of val into *buf and returns 
@@ -80,8 +81,8 @@ asn1_error_code asn1_encode_octetstring
 
 asn1_error_code asn1_encode_charstring
 	PROTOTYPE((asn1buf *buf,
-		   const int len, const char *val,
-		   int *retlen));
+		   const unsigned int len, const char *val,
+		   unsigned int *retlen));
 /* requires  *buf is allocated
    modifies  *buf, *retlen
    effects   Inserts the encoding of val into *buf and returns 
@@ -100,7 +101,7 @@ asn1_error_code asn1_encode_null
 
 asn1_error_code asn1_encode_printablestring
 	PROTOTYPE((asn1buf *buf,
-		   const int len, const char *val,
+		   const unsigned int len, const char *val,
 		   int *retlen));
 /* requires  *buf is allocated
    modifies  *buf, *retlen
@@ -111,7 +112,7 @@ asn1_error_code asn1_encode_printablestring
 
 asn1_error_code asn1_encode_ia5string
 	PROTOTYPE((asn1buf *buf,
-		   const int len, const char *val,
+		   const unsigned int len, const char *val,
 		   int *retlen));
 /* requires  *buf is allocated
    modifies  *buf, *retlen
@@ -121,7 +122,7 @@ asn1_error_code asn1_encode_ia5string
               to expand the buffer. */
 
 asn1_error_code asn1_encode_generaltime
-	PROTOTYPE((asn1buf *buf, const time_t val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const time_t val, unsigned int *retlen));
 /* requires  *buf is allocated
    modifies  *buf, *retlen
    effects   Inserts the encoding of val into *buf and returns
@@ -132,8 +133,8 @@ asn1_error_code asn1_encode_generaltime
 
 asn1_error_code asn1_encode_generalstring
 	PROTOTYPE((asn1buf *buf,
-		   const int len, const char *val,
-		   int *retlen));
+		   const unsigned int len, const char *val,
+		   unsigned int *retlen));
 /* requires  *buf is allocated,  val has a length of len characters
    modifies  *buf, *retlen
    effects   Inserts the encoding of val into *buf and returns 
diff --git a/src/lib/krb5/asn.1/asn1_get.c b/src/lib/krb5/asn.1/asn1_get.c
index c8a50ad61..b233a1aef 100644
--- a/src/lib/krb5/asn.1/asn1_get.c
+++ b/src/lib/krb5/asn.1/asn1_get.c
@@ -32,7 +32,7 @@ asn1_get_tag_indef(buf, class, construction, tagnum, retlen, indef)
      asn1_class * class;
      asn1_construction * construction;
      asn1_tagnum * tagnum;
-     int * retlen;
+     unsigned int * retlen;
      int * indef;
 {
   asn1_error_code retval;
@@ -62,7 +62,7 @@ asn1_get_tag(buf, class, construction, tagnum, retlen)
      asn1_class *class;
      asn1_construction *construction;
      asn1_tagnum *tagnum;
-     int *retlen;
+     unsigned int *retlen;
 {
   int indef;
 
@@ -71,7 +71,7 @@ asn1_get_tag(buf, class, construction, tagnum, retlen)
 
 asn1_error_code asn1_get_sequence(buf, retlen, indef)
      asn1buf * buf;
-     int * retlen;
+     unsigned int * retlen;
      int * indef;
 {
   asn1_error_code retval;
@@ -128,7 +128,7 @@ asn1_error_code asn1_get_id(buf, class, construction, tagnum)
 
 asn1_error_code asn1_get_length(buf, retlen, indef)
      asn1buf * buf;
-     int * retlen;
+     unsigned int * retlen;
      int * indef;
 {
   asn1_error_code retval;
diff --git a/src/lib/krb5/asn.1/asn1_get.h b/src/lib/krb5/asn.1/asn1_get.h
index 2f5edf112..450347011 100644
--- a/src/lib/krb5/asn.1/asn1_get.h
+++ b/src/lib/krb5/asn.1/asn1_get.h
@@ -38,13 +38,13 @@ asn1_error_code asn1_get_tag_indef
 		   asn1_class *class,
 		   asn1_construction *construction,
 		   asn1_tagnum *tagnum,
-		   int *retlen, int *indef));
+		   unsigned int *retlen, int *indef));
 asn1_error_code asn1_get_tag
 	PROTOTYPE((asn1buf *buf,
 		   asn1_class *class,
 		   asn1_construction *construction,
 		   asn1_tagnum *tagnum,
-		   int *retlen));
+		   unsigned int *retlen));
 /* requires  *buf is allocated
    effects   Decodes the tag in *buf.  If class != NULL, returns
               the class in *class.  Similarly, the construction,
@@ -55,7 +55,7 @@ asn1_error_code asn1_get_tag
 	     Returns ASN1_OVERRUN if *buf is exhausted during the parse. */
 
 asn1_error_code asn1_get_sequence
-	PROTOTYPE((asn1buf *buf, int *retlen, int *indef));
+	PROTOTYPE((asn1buf *buf, unsigned int *retlen, int *indef));
 /* requires  *buf is allocated
    effects   Decodes a tag from *buf and returns ASN1_BAD_ID if it
               doesn't have a sequence ID.  If retlen != NULL, the
@@ -77,7 +77,7 @@ asn1_error_code asn1_get_id
 	     Returns ASN1_OVERRUN if *buf is exhausted. */
 
 asn1_error_code asn1_get_length
-	PROTOTYPE((asn1buf *buf, int *retlen, int *indef));
+	PROTOTYPE((asn1buf *buf, unsigned int *retlen, int *indef));
 /* requires  *buf is allocated
    effects   Decodes the group of length octets at *buf's
               current position.  If retlen != NULL, the
diff --git a/src/lib/krb5/asn.1/asn1_k_decode.c b/src/lib/krb5/asn.1/asn1_k_decode.c
index a0c1ba345..b01506304 100644
--- a/src/lib/krb5/asn.1/asn1_k_decode.c
+++ b/src/lib/krb5/asn.1/asn1_k_decode.c
@@ -34,7 +34,7 @@ asn1_error_code retval;\
 asn1_class class;\
 asn1_construction construction;\
 asn1_tagnum tagnum;\
-int length,taglen
+unsigned int length,taglen
 
 #define unused_var(x) if(0) x=0
 
@@ -106,7 +106,7 @@ if(retval) return retval
 #define sequence_of(buf)\
 int size=0;\
 asn1buf seqbuf;\
-int length;\
+unsigned int length;\
 int indef;\
 retval = asn1_get_sequence(buf,&length,&indef);\
 if(retval) return retval;\
@@ -373,7 +373,7 @@ asn1_error_code asn1_decode_ticket(buf, val)
      krb5_ticket * val;
 {
   setup();
-  int applen;
+  unsigned int applen;
   apptag(1);
   { begin_structure();
     { krb5_kvno vno;
@@ -652,7 +652,7 @@ asn1_error_code asn1_decode_last_req_entry(buf, val)
 #ifdef KRB5_GENEROUS_LR_TYPE
     /* If we are only a single byte wide and negative - fill in the
        other bits */
-    if((val->lr_type & 0xffffff80) == 0x80) val->lr_type |= 0xffffff00;
+    if((val->lr_type & 0xffffff80U) == 0x80) val->lr_type |= 0xffffff00U;
 #endif
   }
   cleanup();
@@ -691,7 +691,7 @@ asn1_error_code asn1_decode_etype_info_entry(buf, val)
     if (tagnum == 1) {
 	    get_lenfield(val->length,val->salt,1,asn1_decode_octetstring);
     } else {
-	    val->length = -1;
+	    val->length = KRB5_ETYPE_NO_SALT;
 	    val->salt = 0;
     }
     end_structure();
diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
index 20857cd4f..2cfdd6ff6 100644
--- a/src/lib/krb5/asn.1/asn1_k_encode.c
+++ b/src/lib/krb5/asn.1/asn1_k_encode.c
@@ -74,7 +74,7 @@
      sum: cumulative length of the entire encoding */
 #define asn1_setup()\
   asn1_error_code retval;\
-  int length, sum=0
+  unsigned int length, sum=0
   
 /* asn1_addfield -- add a field, or component, to the encoding */
 #define asn1_addfield(value,tag,encoder)\
@@ -126,7 +126,7 @@
 asn1_error_code asn1_encode_ui_4(buf, val, retlen)
      asn1buf * buf;
      const krb5_ui_4 val;
-     int *retlen;
+     unsigned int * retlen;
 {
   return asn1_encode_unsigned_integer(buf,val,retlen);
 }
@@ -135,7 +135,7 @@ asn1_error_code asn1_encode_ui_4(buf, val, retlen)
 asn1_error_code asn1_encode_realm(buf, val, retlen)
      asn1buf * buf;
      const krb5_principal val;
-     int * retlen;
+     unsigned int * retlen;
 {
   if (val == NULL ||
       (val->realm.length && val->realm.data == NULL))
@@ -147,7 +147,7 @@ asn1_error_code asn1_encode_realm(buf, val, retlen)
 asn1_error_code asn1_encode_principal_name(buf, val, retlen)
      asn1buf * buf;
      const krb5_principal val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int n;
@@ -180,7 +180,7 @@ asn1_error_code asn1_encode_principal_name(buf, val, retlen)
 asn1_error_code asn1_encode_kerberos_time(buf, val, retlen)
      asn1buf * buf;
      const krb5_timestamp val;
-     int * retlen;
+     unsigned int * retlen;
      
 {
   return asn1_encode_generaltime(buf,val,retlen);
@@ -189,7 +189,7 @@ asn1_error_code asn1_encode_kerberos_time(buf, val, retlen)
 asn1_error_code asn1_encode_host_address(buf, val, retlen)
      asn1buf * buf;
      const krb5_address * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -205,7 +205,7 @@ asn1_error_code asn1_encode_host_address(buf, val, retlen)
 asn1_error_code asn1_encode_host_addresses(buf, val, retlen)
      asn1buf * buf;
      const krb5_address ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -226,7 +226,7 @@ asn1_error_code asn1_encode_host_addresses(buf, val, retlen)
 asn1_error_code asn1_encode_encrypted_data(buf, val, retlen)
      asn1buf * buf;
      const krb5_enc_data * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -235,8 +235,9 @@ asn1_error_code asn1_encode_encrypted_data(buf, val, retlen)
 	  return ASN1_MISSING_FIELD;
 
   asn1_addlenfield(val->ciphertext.length,val->ciphertext.data,2,asn1_encode_charstring);
+  /* krb5_kvno should be int */
   if(val->kvno)
-    asn1_addfield(val->kvno,1,asn1_encode_integer);
+    asn1_addfield((int) val->kvno,1,asn1_encode_integer);
   asn1_addfield(val->enctype,0,asn1_encode_integer);
 
   asn1_makeseq();
@@ -247,7 +248,7 @@ asn1_error_code asn1_encode_encrypted_data(buf, val, retlen)
 asn1_error_code asn1_encode_krb5_flags(buf, val, retlen)
      asn1buf * buf;
      const krb5_flags val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   krb5_flags valcopy = val;
@@ -274,7 +275,7 @@ asn1_error_code asn1_encode_krb5_flags(buf, val, retlen)
 asn1_error_code asn1_encode_ap_options(buf, val, retlen)
      asn1buf * buf;
      const krb5_flags val;
-     int * retlen;
+     unsigned int * retlen;
 {
   return asn1_encode_krb5_flags(buf,val,retlen);
 }
@@ -282,7 +283,7 @@ asn1_error_code asn1_encode_ap_options(buf, val, retlen)
 asn1_error_code asn1_encode_ticket_flags(buf, val, retlen)
      asn1buf * buf;
      const krb5_flags val;
-     int * retlen;
+     unsigned int * retlen;
 {
   return asn1_encode_krb5_flags(buf,val,retlen);
 }
@@ -290,7 +291,7 @@ asn1_error_code asn1_encode_ticket_flags(buf, val, retlen)
 asn1_error_code asn1_encode_kdc_options(buf, val, retlen)
      asn1buf * buf;
      const krb5_flags val;
-     int * retlen;
+     unsigned int * retlen;
 {
   return asn1_encode_krb5_flags(buf,val,retlen);
 }
@@ -298,7 +299,7 @@ asn1_error_code asn1_encode_kdc_options(buf, val, retlen)
 asn1_error_code asn1_encode_authorization_data(buf, val, retlen)
      asn1buf * buf;
      const krb5_authdata ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -319,7 +320,7 @@ asn1_error_code asn1_encode_authorization_data(buf, val, retlen)
 asn1_error_code asn1_encode_krb5_authdata_elt(buf, val, retlen)
      asn1buf * buf;
      const krb5_authdata * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -341,7 +342,7 @@ asn1_error_code asn1_encode_kdc_rep(msg_type, buf, val, retlen)
      int msg_type;
      asn1buf * buf;
      const krb5_kdc_rep * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -365,7 +366,7 @@ asn1_error_code asn1_encode_kdc_rep(msg_type, buf, val, retlen)
 asn1_error_code asn1_encode_enc_kdc_rep_part(buf, val, retlen)
      asn1buf * buf;
      const krb5_enc_kdc_rep_part * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -420,7 +421,7 @@ asn1_error_code asn1_encode_enc_kdc_rep_part(buf, val, retlen)
 asn1_error_code asn1_encode_kdc_req_body(buf, rep, retlen)
      asn1buf * buf;
      const krb5_kdc_req * rep;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   
@@ -489,7 +490,7 @@ asn1_error_code asn1_encode_kdc_req_body(buf, rep, retlen)
 asn1_error_code asn1_encode_encryption_key(buf, val, retlen)
      asn1buf * buf;
      const krb5_keyblock * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -507,7 +508,7 @@ asn1_error_code asn1_encode_encryption_key(buf, val, retlen)
 asn1_error_code asn1_encode_checksum(buf, val, retlen)
      asn1buf * buf;
      const krb5_checksum * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -525,7 +526,7 @@ asn1_error_code asn1_encode_checksum(buf, val, retlen)
 asn1_error_code asn1_encode_transited_encoding(buf, val, retlen)
      asn1buf * buf;
      const krb5_transited * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -544,7 +545,7 @@ asn1_error_code asn1_encode_transited_encoding(buf, val, retlen)
 asn1_error_code asn1_encode_last_req(buf, val, retlen)
      asn1buf * buf;
      const krb5_last_req_entry ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -565,7 +566,7 @@ asn1_error_code asn1_encode_last_req(buf, val, retlen)
 asn1_error_code asn1_encode_last_req_entry(buf, val, retlen)
      asn1buf * buf;
      const krb5_last_req_entry * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -581,7 +582,7 @@ asn1_error_code asn1_encode_last_req_entry(buf, val, retlen)
 asn1_error_code asn1_encode_sequence_of_pa_data(buf, val, retlen)
      asn1buf * buf;
      const krb5_pa_data ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -602,7 +603,7 @@ asn1_error_code asn1_encode_sequence_of_pa_data(buf, val, retlen)
 asn1_error_code asn1_encode_pa_data(buf, val, retlen)
      asn1buf * buf;
      const krb5_pa_data * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -619,7 +620,7 @@ asn1_error_code asn1_encode_pa_data(buf, val, retlen)
 asn1_error_code asn1_encode_sequence_of_ticket(buf, val, retlen)
      asn1buf * buf;
      const krb5_ticket ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -640,7 +641,7 @@ asn1_error_code asn1_encode_sequence_of_ticket(buf, val, retlen)
 asn1_error_code asn1_encode_ticket(buf, val, retlen)
      asn1buf * buf;
      const krb5_ticket * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -660,7 +661,7 @@ asn1_error_code asn1_encode_sequence_of_enctype(buf, len, val, retlen)
      asn1buf * buf;
      const int len;
      const krb5_enctype * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -681,7 +682,7 @@ asn1_error_code asn1_encode_kdc_req(msg_type, buf, val, retlen)
      int msg_type;
      asn1buf * buf;
      const krb5_kdc_req * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -702,7 +703,7 @@ asn1_error_code asn1_encode_kdc_req(msg_type, buf, val, retlen)
 asn1_error_code asn1_encode_krb_safe_body(buf, val, retlen)
      asn1buf * buf;
      const krb5_safe * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -729,7 +730,7 @@ asn1_error_code asn1_encode_krb_safe_body(buf, val, retlen)
 asn1_error_code asn1_encode_sequence_of_krb_cred_info(buf, val, retlen)
      asn1buf * buf;
      const krb5_cred_info ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -750,7 +751,7 @@ asn1_error_code asn1_encode_sequence_of_krb_cred_info(buf, val, retlen)
 asn1_error_code asn1_encode_krb_cred_info(buf, val, retlen)
      asn1buf * buf;
      const krb5_cred_info * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -786,15 +787,16 @@ asn1_error_code asn1_encode_krb_cred_info(buf, val, retlen)
 asn1_error_code asn1_encode_etype_info_entry(buf, val, retlen)
      asn1buf * buf;
      const krb5_etype_info_entry * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
-  if(val == NULL || (val->length > 0 && val->salt == NULL))
+  if(val == NULL || (val->length > 0 && val->length != KRB5_ETYPE_NO_SALT &&
+		     val->salt == NULL))
      return ASN1_MISSING_FIELD;
 
-  if (val->length >= 0)
-	  asn1_addlenfield((int) val->length,val->salt,1,
+  if (val->length >= 0 && val->length != KRB5_ETYPE_NO_SALT)
+	  asn1_addlenfield(val->length,val->salt,1,
 			   asn1_encode_octetstring);
   asn1_addfield(val->etype,0,asn1_encode_integer);
   asn1_makeseq();
@@ -805,7 +807,7 @@ asn1_error_code asn1_encode_etype_info_entry(buf, val, retlen)
 asn1_error_code asn1_encode_etype_info(buf, val, retlen)
      asn1buf * buf;
      const krb5_etype_info_entry ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
     asn1_setup();
     int i;
@@ -825,7 +827,7 @@ asn1_error_code asn1_encode_etype_info(buf, val, retlen)
 asn1_error_code asn1_encode_sequence_of_passwdsequence(buf, val, retlen)
      asn1buf * buf;
      const passwd_phrase_element ** val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   int i;
@@ -845,7 +847,7 @@ asn1_error_code asn1_encode_sequence_of_passwdsequence(buf, val, retlen)
 asn1_error_code asn1_encode_passwdsequence(buf, val, retlen)
      asn1buf * buf;
      const passwd_phrase_element * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   asn1_addlenfield(val->phrase->length,val->phrase->data,1,asn1_encode_charstring);
@@ -857,7 +859,7 @@ asn1_error_code asn1_encode_passwdsequence(buf, val, retlen)
 asn1_error_code asn1_encode_sam_flags(buf, val, retlen)
      asn1buf * buf;
      const krb5_flags val;
-     int * retlen;
+     unsigned int * retlen;
 {
   return asn1_encode_krb5_flags(buf,val,retlen);
 }
@@ -868,7 +870,7 @@ asn1_error_code asn1_encode_sam_flags(buf, val, retlen)
 asn1_error_code asn1_encode_sam_challenge(buf, val, retlen)
      asn1buf * buf;
      const krb5_sam_challenge * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   /* possibly wrong */
@@ -895,7 +897,7 @@ asn1_error_code asn1_encode_sam_challenge(buf, val, retlen)
 asn1_error_code asn1_encode_sam_key(buf, val, retlen)
      asn1buf * buf;
      const krb5_sam_key * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   asn1_addfield(&(val->sam_key),0,asn1_encode_encryption_key);
@@ -909,7 +911,7 @@ asn1_error_code asn1_encode_sam_key(buf, val, retlen)
 asn1_error_code asn1_encode_enc_sam_response_enc(buf, val, retlen)
      asn1buf * buf;
      const krb5_enc_sam_response_enc * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
   add_optstring(val->sam_sad,3,asn1_encode_charstring);
@@ -925,7 +927,7 @@ asn1_error_code asn1_encode_enc_sam_response_enc(buf, val, retlen)
 asn1_error_code asn1_encode_sam_response(buf, val, retlen)
      asn1buf * buf;
      const krb5_sam_response * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
@@ -948,7 +950,7 @@ asn1_error_code asn1_encode_sam_response(buf, val, retlen)
 asn1_error_code asn1_encode_predicted_sam_response(buf, val, retlen)
      asn1buf * buf;
      const krb5_predicted_sam_response * val;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_setup();
 
diff --git a/src/lib/krb5/asn.1/asn1_k_encode.h b/src/lib/krb5/asn.1/asn1_k_encode.h
index d1b804d3b..6a83ecb9d 100644
--- a/src/lib/krb5/asn.1/asn1_k_encode.h
+++ b/src/lib/krb5/asn.1/asn1_k_encode.h
@@ -107,145 +107,145 @@ asn1_error_code asn1_encode_asn1_type(asn1buf *buf,
 
 asn1_error_code asn1_encode_ui_4 PROTOTYPE((asn1buf *buf,
 					    const krb5_ui_4 val,
-					    int *retlen));
+					    unsigned int *retlen));
 
 asn1_error_code asn1_encode_msgtype PROTOTYPE((asn1buf *buf,
 					       const /*krb5_msgtype*/int val,
-					       int *retlen));
+					       unsigned int *retlen));
 
 asn1_error_code asn1_encode_realm
-	PROTOTYPE((asn1buf *buf, const krb5_principal val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_principal val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_principal_name
-	PROTOTYPE((asn1buf *buf, const krb5_principal val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_principal val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_encrypted_data
-	PROTOTYPE((asn1buf *buf, const krb5_enc_data *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_enc_data *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_krb5_flags
-	PROTOTYPE((asn1buf *buf, const krb5_flags val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_flags val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_ap_options
-	PROTOTYPE((asn1buf *buf, const krb5_flags val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_flags val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_ticket_flags
-	PROTOTYPE((asn1buf *buf, const krb5_flags val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_flags val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_kdc_options
-	PROTOTYPE((asn1buf *buf, const krb5_flags val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_flags val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_authorization_data
-	PROTOTYPE((asn1buf *buf, const krb5_authdata **val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_authdata **val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_krb5_authdata_elt
-	PROTOTYPE((asn1buf *buf, const krb5_authdata *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_authdata *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_kdc_rep
 	PROTOTYPE((int msg_type, asn1buf *buf, const krb5_kdc_rep *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_enc_kdc_rep_part
 	PROTOTYPE((asn1buf *buf, const krb5_enc_kdc_rep_part *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_ticket
-	PROTOTYPE((asn1buf *buf, const krb5_ticket *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_ticket *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_encryption_key
-	PROTOTYPE((asn1buf *buf, const krb5_keyblock *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_keyblock *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_kerberos_time
-	PROTOTYPE((asn1buf *buf, const krb5_timestamp val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_timestamp val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_checksum
-	PROTOTYPE((asn1buf *buf, const krb5_checksum *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_checksum *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_host_address
-	PROTOTYPE((asn1buf *buf, const krb5_address *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_address *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_host_addresses
-	PROTOTYPE((asn1buf *buf, const krb5_address **val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_address **val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_transited_encoding
-	PROTOTYPE((asn1buf *buf, const krb5_transited *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_transited *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_last_req
 	PROTOTYPE((asn1buf *buf, const krb5_last_req_entry **val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_sequence_of_pa_data
-	PROTOTYPE((asn1buf *buf, const krb5_pa_data **val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_pa_data **val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_sequence_of_ticket
-	PROTOTYPE((asn1buf *buf, const krb5_ticket **val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_ticket **val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_sequence_of_enctype
 	PROTOTYPE((asn1buf *buf,
 		   const int len, const krb5_enctype *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_kdc_req
 	PROTOTYPE((int msg_type,
 		   asn1buf *buf,
 		   const krb5_kdc_req *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_kdc_req_body
-	PROTOTYPE((asn1buf *buf, const krb5_kdc_req *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_kdc_req *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_krb_safe_body
-	PROTOTYPE((asn1buf *buf, const krb5_safe *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_safe *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_sequence_of_krb_cred_info
-	PROTOTYPE((asn1buf *buf, const krb5_cred_info **val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_cred_info **val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_krb_cred_info
-	PROTOTYPE((asn1buf *buf, const krb5_cred_info *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_cred_info *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_last_req_entry
 	PROTOTYPE((asn1buf *buf, const krb5_last_req_entry *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_pa_data
-	PROTOTYPE((asn1buf *buf, const krb5_pa_data *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_pa_data *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_alt_method
 	PROTOTYPE((asn1buf *buf, const krb5_alt_method *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_etype_info_entry
 	PROTOTYPE((asn1buf *buf, const krb5_etype_info_entry *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_etype_info
 	PROTOTYPE((asn1buf *buf, const krb5_etype_info_entry **val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_passwdsequence
-	PROTOTYPE((asn1buf *buf, const passwd_phrase_element *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const passwd_phrase_element *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_sequence_of_passwdsequence
 	PROTOTYPE((asn1buf *buf, const passwd_phrase_element **val,
-	int *retlen));
+	unsigned int *retlen));
 
 asn1_error_code asn1_encode_sam_flags
-	PROTOTYPE((asn1buf * buf, const krb5_flags val, int *retlen));
+	PROTOTYPE((asn1buf * buf, const krb5_flags val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_sam_challenge
-	PROTOTYPE((asn1buf *buf, const krb5_sam_challenge * val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_sam_challenge * val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_sam_key
-	PROTOTYPE((asn1buf *buf, const krb5_sam_key *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_sam_key *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_enc_sam_response_enc
 	PROTOTYPE((asn1buf *buf, const krb5_enc_sam_response_enc *val,
-		   int *retlen));
+		   unsigned int *retlen));
 
 asn1_error_code asn1_encode_sam_response
-	PROTOTYPE((asn1buf *buf, const krb5_sam_response *val, int *retlen));
+	PROTOTYPE((asn1buf *buf, const krb5_sam_response *val, unsigned int *retlen));
 
 asn1_error_code asn1_encode_predicted_sam_response
 	PROTOTYPE((asn1buf *buf, const krb5_predicted_sam_response *val, 
-		   int *retlen));
+		   unsigned int *retlen));
 
 #endif
diff --git a/src/lib/krb5/asn.1/asn1_make.c b/src/lib/krb5/asn.1/asn1_make.c
index 64e96f7b9..3b325aa4a 100644
--- a/src/lib/krb5/asn.1/asn1_make.c
+++ b/src/lib/krb5/asn.1/asn1_make.c
@@ -30,22 +30,23 @@ asn1_error_code asn1_make_etag(buf, class, tagnum, in_len, retlen)
      asn1buf * buf;
      const asn1_class class;
      const asn1_tagnum tagnum;
-     const int in_len;
-     int * retlen;
+     const unsigned int in_len;
+     unsigned int * retlen;
 {
   return asn1_make_tag(buf,class,CONSTRUCTED,tagnum,in_len,retlen);
 }
 
+
 asn1_error_code asn1_make_tag(buf, class, construction, tagnum, in_len, retlen)
      asn1buf * buf;
      const asn1_class class;
      const asn1_construction construction;
      const asn1_tagnum tagnum;
-     const int in_len;
-     int * retlen;
+     const unsigned int in_len;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int sumlen=0, length;
+  unsigned int sumlen=0, length;
 
   if(tagnum > ASN1_TAGNUM_MAX) return ASN1_OVERFLOW;
 
@@ -62,8 +63,8 @@ asn1_error_code asn1_make_tag(buf, class, construction, tagnum, in_len, retlen)
 
 asn1_error_code asn1_make_length(buf, in_len, retlen)
      asn1buf * buf;
-     const int in_len;
-     int * retlen;
+     const unsigned int in_len;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
 
@@ -94,7 +95,7 @@ asn1_error_code asn1_make_id(buf, class, construction, tagnum, retlen)
      const asn1_class class;
      const asn1_construction construction;
      const asn1_tagnum tagnum;
-     int * retlen;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
 
@@ -129,11 +130,11 @@ asn1_error_code asn1_make_id(buf, class, construction, tagnum, retlen)
 
 asn1_error_code asn1_make_sequence(buf, seq_len, retlen)
      asn1buf * buf;
-     const int seq_len;
-     int * retlen;
+     const unsigned int seq_len;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int len, sum=0;
+  unsigned int len, sum=0;
 
   retval = asn1_make_length(buf,seq_len,&len);
   if(retval) return retval;
@@ -148,11 +149,11 @@ asn1_error_code asn1_make_sequence(buf, seq_len, retlen)
 
 asn1_error_code asn1_make_set(buf, set_len, retlen)
      asn1buf * buf;
-     const int set_len;
-     int * retlen;
+     const unsigned int set_len;
+     unsigned int * retlen;
 {
   asn1_error_code retval;
-  int len, sum=0;
+  unsigned int len, sum=0;
 
   retval = asn1_make_length(buf,set_len,&len);
   if(retval) return retval;
@@ -167,7 +168,7 @@ asn1_error_code asn1_make_set(buf, set_len, retlen)
 
 asn1_error_code asn1_make_string(buf, length, string, retlen)
      asn1buf * buf;
-     const int length;
+     const unsigned int length;
      const char * string;
      int * retlen;
 {
diff --git a/src/lib/krb5/asn.1/asn1_make.h b/src/lib/krb5/asn.1/asn1_make.h
index d2d3367a8..51562f2d7 100644
--- a/src/lib/krb5/asn.1/asn1_make.h
+++ b/src/lib/krb5/asn.1/asn1_make.h
@@ -50,8 +50,8 @@ asn1_error_code asn1_make_etag
 	PROTOTYPE((asn1buf *buf,
 		   const asn1_class class,
 		   const asn1_tagnum tagnum,
-		   const int in_len,
-		   int *retlen));
+		   const unsigned int in_len,
+		   unsigned int *retlen));
 /* requires  *buf is allocated, in_len is the length of an ASN.1 encoding
              which has just been inserted in *buf
    modifies  *buf, *retlen
@@ -64,8 +64,8 @@ asn1_error_code asn1_make_tag
 	PROTOTYPE((asn1buf *buf, const asn1_class class,
 		   const asn1_construction construction,
 		   const asn1_tagnum tagnum,
-		   const int in_len,
-		   int *retlen));
+		   const unsigned int in_len,
+		   unsigned int *retlen));
 /* requires  *buf is allocated, in_len is the length of an ASN.1 encoding
              which has just been inserted in *buf
    modifies  *buf, *retlen
@@ -78,7 +78,7 @@ asn1_error_code asn1_make_tag
 	      the implementation. */
 
 asn1_error_code asn1_make_sequence
-	PROTOTYPE((asn1buf *buf, const int seq_len, int *len));
+	PROTOTYPE((asn1buf *buf, const unsigned int seq_len, unsigned int *len));
 /* requires  *buf is allocated, seq_len is the length of a series of
              sequence components which have just been inserted in *buf
    modifies  *buf, *retlen
@@ -87,7 +87,8 @@ asn1_error_code asn1_make_sequence
              Returns ENOMEM if memory runs out. */
 
 asn1_error_code asn1_make_set
-	PROTOTYPE((asn1buf *buf, const int set_len, int *retlen));
+	PROTOTYPE((asn1buf *buf, const unsigned int set_len, 
+		   unsigned int *retlen));
 /* requires  *buf is allocated, seq_len is the length of a series of
              sequence components which have just been inserted in *buf
    modifies  *buf, *retlen
@@ -97,7 +98,7 @@ asn1_error_code asn1_make_set
 
 asn1_error_code asn1_make_string
 	PROTOTYPE((asn1buf *buf,
-		   const int len, const char *string,
+		   const unsigned int len, const char *string,
 		   int *retlen));
 /* requires  *buf is allocated, len is the length of *string
    effects   Inserts the encoding of *string 
@@ -111,7 +112,8 @@ asn1_error_code asn1_make_string
 
 /* "helper" procedure for asn1_make_tag */
 asn1_error_code asn1_make_length
-	PROTOTYPE((asn1buf *buf, const int in_len, int *retlen));
+	PROTOTYPE((asn1buf *buf, const unsigned int in_len, 
+		   unsigned int *retlen));
 /* requires  *buf is allocated, in_len is the length of an ASN.1 encoding
              which has just been inserted in *buf
    modifies  *buf, *retlen
@@ -124,7 +126,7 @@ asn1_error_code asn1_make_id
 		   const asn1_class class,
 		   const asn1_construction construction,
 		   const asn1_tagnum tagnum,
-		   int *retlen));
+		   unsigned int *retlen));
 /* requires  *buf is allocated, class and tagnum are appropriate for
              the ASN.1 encoding which has just been inserted in *buf
    modifies  *buf, *retlen
diff --git a/src/lib/krb5/asn.1/asn1buf.c b/src/lib/krb5/asn.1/asn1buf.c
index 9c639279a..61db90d48 100644
--- a/src/lib/krb5/asn.1/asn1buf.c
+++ b/src/lib/krb5/asn.1/asn1buf.c
@@ -78,7 +78,7 @@ asn1_error_code asn1buf_wrap_data(buf, code)
 asn1_error_code asn1buf_imbed(subbuf, buf, length, indef)
      asn1buf * subbuf;
      const asn1buf * buf;
-     const int length;
+     const unsigned int length;
      const int indef;
 {
   subbuf->base = subbuf->next = buf->next;
@@ -95,7 +95,7 @@ asn1_error_code asn1buf_sync(buf, subbuf, lasttag, length)
      asn1buf * buf;
      asn1buf * subbuf;
      const asn1_tagnum lasttag;
-     const int length;
+     const unsigned int length;
 {
   asn1_error_code retval;
 
@@ -124,13 +124,14 @@ asn1_error_code asn1buf_skiptail(buf)
   asn1_class class;
   asn1_construction construction;
   asn1_tagnum tagnum;
-  int taglen;
+  unsigned int taglen;
   int nestlevel;
 
   nestlevel = 1;
   while (nestlevel > 0) {
     retval = asn1_get_tag(buf, &class, &construction, &tagnum, &taglen);
     if (retval) return retval;
+    buf->next += taglen;
     if (construction == CONSTRUCTED && taglen == 0)
       nestlevel++;
     if (tagnum == ASN1_TAGNUM_CEILING)
@@ -159,7 +160,7 @@ asn1_error_code asn1buf_insert_octet(buf, o)
 {
   asn1_error_code retval;
 
-  retval = asn1buf_ensure_space(buf,1);
+  retval = asn1buf_ensure_space(buf,1U);
   if(retval) return retval;
   *(buf->next) = (char)o;
   (buf->next)++;
@@ -168,7 +169,7 @@ asn1_error_code asn1buf_insert_octet(buf, o)
 
 asn1_error_code asn1buf_insert_octetstring(buf, len, s)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      const krb5_octet * s;
 {
   asn1_error_code retval;
@@ -183,7 +184,7 @@ asn1_error_code asn1buf_insert_octetstring(buf, len, s)
 
 asn1_error_code asn1buf_insert_charstring(buf, len, s)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      const char * s;
 {
   asn1_error_code retval;
@@ -208,7 +209,7 @@ asn1_error_code asn1buf_remove_octet(buf, o)
 
 asn1_error_code asn1buf_remove_octetstring(buf, len, s)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      asn1_octet ** s;
 {
   int i;
@@ -229,7 +230,7 @@ asn1_error_code asn1buf_remove_octetstring(buf, len, s)
 
 asn1_error_code asn1buf_remove_charstring(buf, len, s)
      asn1buf * buf;
-     const int len;
+     const unsigned int len;
      char ** s;
 {
   int i;
@@ -309,7 +310,7 @@ asn1_error_code asn1buf_unparse(buf, s)
     if(*s == NULL) return ENOMEM;
     strcpy(*s,"<EMPTY>");
   }else{
-    int length = asn1buf_len(buf);
+    unsigned int length = asn1buf_len(buf);
     int i;
 
     *s = calloc(length+1, sizeof(char));
@@ -340,7 +341,7 @@ asn1_error_code asn1buf_hex_unparse(buf, s)
     if(*s == NULL) return ENOMEM;
     strcpy(*s,"<EMPTY>");
   }else{
-    int length = asn1buf_len(buf);
+    unsigned int length = asn1buf_len(buf);
     int i;
 
     *s = malloc(3*length);
@@ -377,11 +378,11 @@ int asn1buf_free(buf)
 #undef asn1buf_ensure_space
 asn1_error_code asn1buf_ensure_space(buf, amount)
      asn1buf * buf;
-     const int amount;
+     const unsigned int amount;
 {
-  int free = asn1buf_free(buf);
-  if(free < amount){
-    asn1_error_code retval = asn1buf_expand(buf, amount-free);
+  int avail = asn1buf_free(buf);
+  if(avail < amount){
+    asn1_error_code retval = asn1buf_expand(buf, amount-avail);
     if(retval) return retval;
   }
   return 0;
@@ -389,7 +390,7 @@ asn1_error_code asn1buf_ensure_space(buf, amount)
 
 asn1_error_code asn1buf_expand(buf, inc)
      asn1buf * buf;
-     int inc;
+     unsigned int inc;
 {
 #define STANDARD_INCREMENT 200
   int next_offset = buf->next - buf->base;
diff --git a/src/lib/krb5/asn.1/asn1buf.h b/src/lib/krb5/asn.1/asn1buf.h
index 6920d1df1..4fbe03003 100644
--- a/src/lib/krb5/asn.1/asn1buf.h
+++ b/src/lib/krb5/asn.1/asn1buf.h
@@ -33,7 +33,7 @@ int asn1buf_free
 
 
 asn1_error_code asn1buf_ensure_space
-	PROTOTYPE((asn1buf *buf, const int amount));
+	PROTOTYPE((asn1buf *buf, const unsigned int amount));
 /* requires  *buf is allocated
    modifies  *buf
    effects  If buf has less than amount octets of free space, then it is
@@ -46,7 +46,7 @@ asn1_error_code asn1buf_ensure_space
 
 
 asn1_error_code asn1buf_expand
-	PROTOTYPE((asn1buf *buf, int inc));
+	PROTOTYPE((asn1buf *buf, unsigned int inc));
 /* requires  *buf is allocated
    modifies  *buf
    effects   Expands *buf by allocating space for inc more octets.
@@ -111,7 +111,8 @@ asn1_error_code asn1buf_wrap_data
 	     Returns ASN1_MISSING_FIELD if code is empty. */
 
 asn1_error_code asn1buf_imbed
-	PROTOTYPE((asn1buf *subbuf, const asn1buf *buf, const int length,
+	PROTOTYPE((asn1buf *subbuf, const asn1buf *buf, 
+		   const unsigned int length,
 		   const int indef));
 /* requires  *subbuf and *buf are allocated
    effects   *subbuf becomes a sub-buffer of *buf.  *subbuf begins
@@ -122,7 +123,7 @@ asn1_error_code asn1buf_imbed
 
 asn1_error_code asn1buf_sync
 	PROTOTYPE((asn1buf *buf, asn1buf *subbuf, const asn1_tagnum lasttag,
-		   const int length));
+		   const unsigned int length));
 /* requires  *subbuf is a sub-buffer of *buf, as created by asn1buf_imbed.
              lasttag is a pointer to the last tagnumber read.
    effects   Synchronizes *buf's current position to match that of *subbuf. */
@@ -149,7 +150,7 @@ extern __inline__ asn1_error_code asn1buf_insert_octet(buf, o)
 {
   asn1_error_code retval;
 
-  retval = asn1buf_ensure_space(buf,1);
+  retval = asn1buf_ensure_space(buf,1U);
   if(retval) return retval;
   *(buf->next) = (char)o;
   (buf->next)++;
@@ -158,7 +159,7 @@ extern __inline__ asn1_error_code asn1buf_insert_octet(buf, o)
 #endif
 
 asn1_error_code asn1buf_insert_octetstring
-	PROTOTYPE((asn1buf *buf, const int len, const asn1_octet *s));
+	PROTOTYPE((asn1buf *buf, const unsigned int len, const asn1_octet *s));
 /* requires  *buf is allocated
    modifies  *buf
    effects   Inserts the contents of s (an octet array of length len)
@@ -166,7 +167,7 @@ asn1_error_code asn1buf_insert_octetstring
 	     Returns ENOMEM if memory is exhausted. */
 
 asn1_error_code asn1buf_insert_charstring
-	PROTOTYPE((asn1buf *buf, const int len, const char *s));
+	PROTOTYPE((asn1buf *buf, const unsigned int len, const char *s));
 /* requires  *buf is allocated
    modifies  *buf
    effects   Inserts the contents of s (a character array of length len)
@@ -185,7 +186,7 @@ asn1_error_code asn1buf_remove_octet
    : ((*(o) = (asn1_octet)(*(((buf)->next)++))),0))
 
 asn1_error_code asn1buf_remove_octetstring
-	PROTOTYPE((asn1buf *buf, const int len, asn1_octet **s));
+	PROTOTYPE((asn1buf *buf, const unsigned int len, asn1_octet **s));
 /* requires  *buf is allocated
    effects   Removes the next len octets of *buf and returns them in **s.
 	     Returns ASN1_OVERRUN if there are fewer than len unread octets
@@ -193,7 +194,7 @@ asn1_error_code asn1buf_remove_octetstring
 	     Returns ENOMEM if *s could not be allocated. */
 
 asn1_error_code asn1buf_remove_charstring
-	PROTOTYPE((asn1buf *buf, const int len,
+	PROTOTYPE((asn1buf *buf, const unsigned int len,
 					  char **s));
 /* requires  *buf is allocated
    effects   Removes the next len octets of *buf and returns them in **s.
diff --git a/src/lib/krb5/asn.1/krb5_decode.c b/src/lib/krb5/asn.1/krb5_decode.c
index 69028b9bb..0429a1a4b 100644
--- a/src/lib/krb5/asn.1/krb5_decode.c
+++ b/src/lib/krb5/asn.1/krb5_decode.c
@@ -51,7 +51,7 @@ asn1_tagnum tagnum;\
 setup_no_tagnum()
 
 #define setup()\
-int length;\
+unsigned int length;\
 setup_no_length()
 
 /* helper macros for cleanup */
diff --git a/src/lib/krb5/asn.1/krb5_encode.c b/src/lib/krb5/asn.1/krb5_encode.c
index 60955b866..6220798f3 100644
--- a/src/lib/krb5/asn.1/krb5_encode.c
+++ b/src/lib/krb5/asn.1/krb5_encode.c
@@ -82,7 +82,7 @@
 #define krb5_setup()\
   asn1_error_code retval;\
   asn1buf *buf=NULL;\
-  int length, sum=0;\
+  unsigned int length, sum=0;\
 \
   if(rep == NULL) return ASN1_MISSING_FIELD;\
 \
@@ -301,7 +301,7 @@ krb5_error_code encode_krb5_enc_kdc_rep_part(rep, code)
 {
   asn1_error_code retval;
   asn1buf *buf=NULL;
-  int length, sum=0;
+  unsigned int length, sum=0;
 
   if(rep == NULL) return ASN1_MISSING_FIELD;
 
@@ -685,7 +685,7 @@ krb5_error_code encode_krb5_authdata(rep, code)
 {
   asn1_error_code retval;
   asn1buf *buf=NULL;
-  int length;
+  unsigned int length;
   
   if(rep == NULL) return ASN1_MISSING_FIELD;
 
@@ -707,7 +707,7 @@ krb5_error_code encode_krb5_alt_method(rep, code)
 
   /* method-data[1]		OctetString OPTIONAL */
   if(rep->data != NULL && rep->length > 0)
-    krb5_addlenfield((int) rep->length,rep->data,1,asn1_encode_octetstring);
+    krb5_addlenfield(rep->length,rep->data,1,asn1_encode_octetstring);
 
   /* method-type[0]		Integer */
   krb5_addfield(rep->method,0,asn1_encode_integer);
-- 
2.26.2