diff options
| author | Greg Hudson <ghudson@mit.edu> | 2013-12-18 15:03:03 -0500 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2013-12-18 16:56:52 -0500 |
| commit | c452644d91d57d8b05ef396a029e34d0c7a48920 (patch) | |
| tree | deca0362af71d12ea8d62529fce0f08975d2f7df /src | |
| parent | 4faca53e3a8ee213d43da8998f6889e7bfd36248 (diff) | |
| download | krb5-c452644d91d57d8b05ef396a029e34d0c7a48920.tar.gz krb5-c452644d91d57d8b05ef396a029e34d0c7a48920.tar.xz krb5-c452644d91d57d8b05ef396a029e34d0c7a48920.zip | |
Fix krb5_copy_context
krb5_copy_context has been broken since 1.8 (it broke in r22456)
because k5_copy_etypes crashes on null enctype lists. Subsequent
additions to the context structure were not reflected in
krb5_copy_context, creating double-free bugs. Make k5_copy_etypes
handle null input and account for all new fields in krb5_copy_context.
Reported by Arran Cudbard-Bell.
ticket: 7807 (new)
target_version: 1.12.1
tags: pullup
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/krb5/krb/copy_ctx.c | 15 | ||||
| -rw-r--r-- | src/lib/krb5/krb/etype_list.c | 2 |
2 files changed, 16 insertions, 1 deletions
diff --git a/src/lib/krb5/krb/copy_ctx.c b/src/lib/krb5/krb/copy_ctx.c index 0bc92f814b..42370232be 100644 --- a/src/lib/krb5/krb/copy_ctx.c +++ b/src/lib/krb5/krb/copy_ctx.c @@ -77,11 +77,19 @@ krb5_copy_context(krb5_context ctx, krb5_context *nctx_out) nctx->ser_ctx_count = 0; nctx->ser_ctx = NULL; nctx->prompt_types = NULL; + nctx->preauth_context = NULL; + nctx->ccselect_handles = NULL; + nctx->localauth_handles = NULL; + nctx->hostrealm_handles = NULL; + nctx->kdblog_context = NULL; + nctx->trace_callback = NULL; + nctx->trace_callback_data = NULL; + nctx->plugin_base_dir = NULL; nctx->os_context.default_ccname = NULL; memset(&nctx->libkrb5_plugins, 0, sizeof(nctx->libkrb5_plugins)); - memset(&nctx->err, 0, sizeof(nctx->err)); + memset(&nctx->plugins, 0, sizeof(nctx->plugins)); ret = k5_copy_etypes(ctx->in_tkt_etypes, &nctx->in_tkt_etypes); if (ret) @@ -101,6 +109,11 @@ krb5_copy_context(krb5_context ctx, krb5_context *nctx_out) ret = krb5_get_profile(ctx, &nctx->profile); if (ret) goto errout; + nctx->plugin_base_dir = strdup(ctx->plugin_base_dir); + if (nctx->plugin_base_dir == NULL) { + ret = ENOMEM; + goto errout; + } errout: if (ret) { diff --git a/src/lib/krb5/krb/etype_list.c b/src/lib/krb5/krb/etype_list.c index 9efe2e0bbe..71f664f0d5 100644 --- a/src/lib/krb5/krb/etype_list.c +++ b/src/lib/krb5/krb/etype_list.c @@ -49,6 +49,8 @@ k5_copy_etypes(const krb5_enctype *old_list, krb5_enctype **new_list) krb5_enctype *list; *new_list = NULL; + if (old_list == NULL) + return 0; count = k5_count_etypes(old_list); list = malloc(sizeof(krb5_enctype) * (count + 1)); if (list == NULL) |