diff options
| author | Neng Xue <xnsuda@yahoo.com> | 2014-06-30 14:04:56 -0700 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2014-06-30 18:23:04 -0400 |
| commit | 81e503c09ad9aef4a0afc6bf66a0269cde2151f3 (patch) | |
| tree | edaa4d150459023934f9d935d9b5ada20feb5ebd | |
| parent | b272744422dea77fdf9518a20386660df7a97bf7 (diff) | |
| download | krb5-81e503c09ad9aef4a0afc6bf66a0269cde2151f3.tar.gz krb5-81e503c09ad9aef4a0afc6bf66a0269cde2151f3.tar.xz krb5-81e503c09ad9aef4a0afc6bf66a0269cde2151f3.zip | |
Fix unlikely null dereference in TGS client code
If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an
error re-reading the profile), k5_make_tgs_req will dereference a null
pointer. Check the return value before dereferencing defenctypes.
[ghudson@mit.edu: clarified commit message]
ticket: 7952 (new)
target_version: 1.12.2
tags: pullup
| -rw-r--r-- | src/lib/krb5/krb/send_tgs.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/lib/krb5/krb/send_tgs.c b/src/lib/krb5/krb/send_tgs.c index cd56366cb..f6fdf68d4 100644 --- a/src/lib/krb5/krb/send_tgs.c +++ b/src/lib/krb5/krb/send_tgs.c @@ -198,7 +198,9 @@ k5_make_tgs_req(krb5_context context, req.nktypes = 1; } else { /* Get the default TGS enctypes. */ - krb5_get_tgs_ktypes(context, desired->server, &defenctypes); + ret = krb5_get_tgs_ktypes(context, desired->server, &defenctypes); + if (ret) + goto cleanup; for (count = 0; defenctypes[count]; count++); req.ktype = defenctypes; req.nktypes = count; |