diff options
| author | Greg Hudson <ghudson@mit.edu> | 2010-05-25 02:44:45 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2010-05-25 02:44:45 +0000 |
| commit | c7f5da582f3cdd08cd82b0c6a25167303575014b (patch) | |
| tree | 1c9514740075b3963f39a952900fea1e7e608d81 /src | |
| parent | 1d65bc6d55dad1e74b3df4d7133a2863e28e87a8 (diff) | |
| download | krb5-c7f5da582f3cdd08cd82b0c6a25167303575014b.tar.gz krb5-c7f5da582f3cdd08cd82b0c6a25167303575014b.tar.xz krb5-c7f5da582f3cdd08cd82b0c6a25167303575014b.zip | |
FAST negotiation could erroneously succeed
When FAST negotiation is performed against an older KDC
(rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set),
krb5int_fast_verify_nego did not set the value of *fast_avail, causing
stack garbage to be used in init_creds_step_reply. Initialize
*fast_avail at the beginning of the function per coding practices.
ticket: 6734
target_version: 1.8.2
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24102 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/krb5/krb/fast.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c index 7a157f6381..30be3818c9 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -597,6 +597,7 @@ krb5int_fast_verify_nego(krb5_context context, krb5_data scratch; krb5_boolean valid; + *fast_avail = FALSE; if (rep->enc_part2->flags& TKT_FLG_ENC_PA_REP) { pa = krb5int_find_pa_data(context, rep->enc_part2->enc_padata, KRB5_ENCPADATA_REQ_ENC_PA_REP); |