diff options
| author | Tom Yu <tlyu@mit.edu> | 2013-12-31 19:41:12 -0500 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2013-12-31 20:27:00 -0500 |
| commit | 30589b2a1636de9f9b68591f0e546cb0fa21989f (patch) | |
| tree | d12bb6a59b84b75d08ec5f32b846cf081f85f0b4 | |
| parent | f37067776f9431879769f3874fdab6120ba3f155 (diff) | |
| download | krb5-30589b2a1636de9f9b68591f0e546cb0fa21989f.tar.gz krb5-30589b2a1636de9f9b68591f0e546cb0fa21989f.tar.xz krb5-30589b2a1636de9f9b68591f0e546cb0fa21989f.zip | |
Fix possible null deref in previous
My rework of the do_tgs_req.c patch introduced a null deref if
decode_krb5_tgs_req() failed.
ticket: 7802
| -rw-r--r-- | src/kdc/do_tgs_req.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 5cfe0b64b1..6bc4f15c0e 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -145,11 +145,12 @@ process_tgs_req(struct server_handle *handle, krb5_data *pkt, session_key.contents = NULL; retval = decode_krb5_tgs_req(pkt, &request); - /* Save pointer to client-requested service principal, in case of errors - * before a successful call to search_sprinc(). */ - sprinc = request->server; if (retval) return retval; + /* Save pointer to client-requested service principal, in case of + * errors before a successful call to search_sprinc(). */ + sprinc = request->server; + if (request->msg_type != KRB5_TGS_REQ) { krb5_free_kdc_req(handle->kdc_err_context, request); return KRB5_BADMSGTYPE; |