From 6e1fdfb30bac750816da25d6dd4ed67d0149da12 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 31 Jul 2019 16:18:11 -0400 Subject: Handle all-zero tags in file2 rcache type In the unlikely case of an all-zero tag, rc_file2.c:store() could mistake an empty record for a replay. Check that records from the file are non-empty (by checking that the timestamp is non-zero) before comparing them to the tag. ticket: 8786 --- src/lib/krb5/rcache/rc_file2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/lib/krb5') diff --git a/src/lib/krb5/rcache/rc_file2.c b/src/lib/krb5/rcache/rc_file2.c index 10f9a92..3240776 100644 --- a/src/lib/krb5/rcache/rc_file2.c +++ b/src/lib/krb5/rcache/rc_file2.c @@ -174,8 +174,8 @@ store(krb5_context context, int fd, const uint8_t tag[TAG_LEN], uint32_t now, if (ret) return ret; - if ((nread >= 1 && memcmp(r1tag, tag, TAG_LEN) == 0) || - (nread == 2 && memcmp(r2tag, tag, TAG_LEN) == 0)) + if ((nread >= 1 && r1stamp && memcmp(r1tag, tag, TAG_LEN) == 0) || + (nread == 2 && r2stamp && memcmp(r2tag, tag, TAG_LEN) == 0)) return KRB5KRB_AP_ERR_REPEAT; /* Make note of the first record available for writing (empty, beyond -- cgit v1.1