diff options
author | Ezra Peisach <epeisach@mit.edu> | 2005-01-17 17:32:26 +0000 |
---|---|---|
committer | Ezra Peisach <epeisach@mit.edu> | 2005-01-17 17:32:26 +0000 |
commit | dc57beffefe7df48e440887976fbbaefa71b828a (patch) | |
tree | 2ea5c8b302ec1453e862e50e313ab10aa93a32b7 /src | |
parent | 2656e5e1e026f800559eed79dfcc58cd3da5d9a0 (diff) | |
download | krb5-dc57beffefe7df48e440887976fbbaefa71b828a.zip krb5-dc57beffefe7df48e440887976fbbaefa71b828a.tar.gz krb5-dc57beffefe7df48e440887976fbbaefa71b828a.tar.bz2 |
subject; krb5_do_preauth could attempt to free NULL pointer
* preauth2.c (krb5_do_preauth): Upon error in decoding
krb5_type_info{,2}, on failure, do not call krb5_free_type_info
with a null pointer.
The only way to reach this code is to set a preauth list requesting for ETYPE_INFO
or ETYPE_INFO2 in a call to krb5_get_in_tkt_with_password.
Before sending the request, krb5_do_preauth tries to parse a NULL length asn1 buffer,
fails and tries to free a null pointer.
ticket: new
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17047 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src')
-rw-r--r-- | src/lib/krb5/krb/ChangeLog | 6 | ||||
-rw-r--r-- | src/lib/krb5/krb/preauth2.c | 3 |
2 files changed, 8 insertions, 1 deletions
diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog index 2241278..95578ce 100644 --- a/src/lib/krb5/krb/ChangeLog +++ b/src/lib/krb5/krb/ChangeLog @@ -1,3 +1,9 @@ +2005-01-17 Ezra Peisach <epeisach@mit.edu> + + * preauth2.c (krb5_do_preauth): Upon error in decoding + krb5_type_info{,2}, on failure, do not call krb5_free_type_info + with a null pointer. + 2005-01-15 Jeffrey Altman <jaltman@mit.edu> * cp_key_cnt.c, copy_princ.c: diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c index 6238a82..e146c3d 100644 --- a/src/lib/krb5/krb/preauth2.c +++ b/src/lib/krb5/krb/preauth2.c @@ -892,7 +892,8 @@ krb5_do_preauth(krb5_context context, else ret = decode_krb5_etype_info(&scratch, &etype_info); if (ret) { ret = 0; /*Ignore error and etype_info element*/ - krb5_free_etype_info( context, etype_info); + if (etype_info) + krb5_free_etype_info( context, etype_info); etype_info = NULL; continue; } |