diff options
| author | Greg Hudson <ghudson@mit.edu> | 2019-07-31 16:18:11 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2019-08-01 16:35:26 -0400 |
| commit | 6e1fdfb30bac750816da25d6dd4ed67d0149da12 (patch) | |
| tree | a65d4a43c4a65cfd19239dd8db59825e6bfb6a91 /src/lib/krb5 | |
| parent | 2a852b1f3fb00c7d19f4dbfba76f5ff7ebccd2c7 (diff) | |
| download | krb5-6e1fdfb30bac750816da25d6dd4ed67d0149da12.zip krb5-6e1fdfb30bac750816da25d6dd4ed67d0149da12.tar.gz krb5-6e1fdfb30bac750816da25d6dd4ed67d0149da12.tar.bz2 | |
Handle all-zero tags in file2 rcache type
In the unlikely case of an all-zero tag, rc_file2.c:store() could
mistake an empty record for a replay. Check that records from the
file are non-empty (by checking that the timestamp is non-zero) before
comparing them to the tag.
ticket: 8786
Diffstat (limited to 'src/lib/krb5')
| -rw-r--r-- | src/lib/krb5/rcache/rc_file2.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/lib/krb5/rcache/rc_file2.c b/src/lib/krb5/rcache/rc_file2.c index 10f9a92..3240776 100644 --- a/src/lib/krb5/rcache/rc_file2.c +++ b/src/lib/krb5/rcache/rc_file2.c @@ -174,8 +174,8 @@ store(krb5_context context, int fd, const uint8_t tag[TAG_LEN], uint32_t now, if (ret) return ret; - if ((nread >= 1 && memcmp(r1tag, tag, TAG_LEN) == 0) || - (nread == 2 && memcmp(r2tag, tag, TAG_LEN) == 0)) + if ((nread >= 1 && r1stamp && memcmp(r1tag, tag, TAG_LEN) == 0) || + (nread == 2 && r2stamp && memcmp(r2tag, tag, TAG_LEN) == 0)) return KRB5KRB_AP_ERR_REPEAT; /* Make note of the first record available for writing (empty, beyond |