From 55ef0e7414c572c3326b2443d0cd3e6cbb6705bb Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Tue, 12 Jul 2005 20:59:52 +0000 Subject: [PATCH] pullup from trunk ticket: 3120 version_fixed: 1.4.2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-4@17300 dc483132-0cff-0310-8789-dd5450dbe970 --- src/kdc/ChangeLog | 10 ++++++++++ src/kdc/do_as_req.c | 6 +++++- src/kdc/do_tgs_req.c | 6 +++++- src/kdc/network.c | 1 + src/lib/krb5/krb/ChangeLog | 7 +++++++ src/lib/krb5/krb/unparse.c | 2 ++ 6 files changed, 30 insertions(+), 2 deletions(-) diff --git a/src/kdc/ChangeLog b/src/kdc/ChangeLog index 69f392c51..2774ff00e 100644 --- a/src/kdc/ChangeLog +++ b/src/kdc/ChangeLog @@ -1,3 +1,13 @@ +2005-07-12 Tom Yu + + * do_as_req.c (prepare_error_as): + * do_tgs_req.c (prepare_error_tgs): Free scratch only if no error, + to avoid double-free. Thanks to Daniel Wachdorf for discovering + these. Part of fix for MITKRB5-SA-2005-002 [CAN-2005-1174, + VU#259798]. + + * network.c (process_packet): Initialize response to NULL. + 2004-09-23 Ken Raeburn * network.c (closedown_network): Free each connection data diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 7f3efd849..a71922296 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -524,6 +524,10 @@ prepare_error_as (krb5_kdc_req *request, int error, krb5_data *e_data, retval = krb5_mk_error(kdc_context, &errpkt, scratch); free(errpkt.text.data); - *response = scratch; + if (retval) + free(scratch); + else + *response = scratch; + return retval; } diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 085e2855c..8d1904208 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -722,7 +722,11 @@ prepare_error_tgs (krb5_kdc_req *request, krb5_ticket *ticket, int error, retval = krb5_mk_error(kdc_context, &errpkt, scratch); free(errpkt.text.data); - *response = scratch; + if (retval) + free(scratch); + else + *response = scratch; + return retval; } diff --git a/src/kdc/network.c b/src/kdc/network.c index d05057aca..1610a350c 100644 --- a/src/kdc/network.c +++ b/src/kdc/network.c @@ -722,6 +722,7 @@ static void process_packet(struct connection *conn, const char *prog, char pktbuf[MAX_DGRAM_SIZE]; int port_fd = conn->fd; + response = NULL; saddr_len = sizeof(saddr); cc = recvfrom(port_fd, pktbuf, sizeof(pktbuf), 0, (struct sockaddr *)&saddr, &saddr_len); diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog index bca160197..f463e0deb 100644 --- a/src/lib/krb5/krb/ChangeLog +++ b/src/lib/krb5/krb/ChangeLog @@ -1,3 +1,10 @@ +2005-07-12 Tom Yu + + * unparse.c (krb5_unparse_name_ext): Account for zero-component + principal, to avoid single-byte overflow. Thanks to Daniel + Wachdorf. Part of fix for MITKRB5-SA-2005-002 [CAN-2005-1175, + VU#885830]. + 2005-03-22 Tom Yu * x-deltat.y (wsnum): Add missing semicolon following YYERROR, diff --git a/src/lib/krb5/krb/unparse.c b/src/lib/krb5/krb/unparse.c index badb5bf97..a67636641 100644 --- a/src/lib/krb5/krb/unparse.c +++ b/src/lib/krb5/krb/unparse.c @@ -91,6 +91,8 @@ krb5_unparse_name_ext(krb5_context context, krb5_const_principal principal, regi totalsize++; totalsize++; /* This is for the separator */ } + if (nelem == 0) + totalsize++; /* * Allocate space for the ascii string; if space has been -- 2.26.2