diff options
| author | Sam Hartman <hartmans@mit.edu> | 2011-10-05 21:30:42 +0000 |
|---|---|---|
| committer | Sam Hartman <hartmans@mit.edu> | 2011-10-05 21:30:42 +0000 |
| commit | 61ccf4d6a8fa65780e8564a065d7aa4e76f5d54d (patch) | |
| tree | 3e21c6385186fb024b722e49d3dba6de348ce46d /src/lib/gssapi | |
| parent | c4deb50427a24c104458ae1439b696aee41963d2 (diff) | |
| download | krb5-61ccf4d6a8fa65780e8564a065d7aa4e76f5d54d.tar.gz krb5-61ccf4d6a8fa65780e8564a065d7aa4e76f5d54d.tar.xz krb5-61ccf4d6a8fa65780e8564a065d7aa4e76f5d54d.zip | |
gss_unwrap_iov crashes with stream buffers for 3des, des, rc4
Use correct key to determine enctype for KG2 tokens in
kg_unseal_stream_iov
Tested with AES for a new enctype and 3DES for an old enctype.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 6970
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25309 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/lib/gssapi')
| -rw-r--r-- | src/lib/gssapi/krb5/k5unsealiov.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c index ec4eae979..986ee0616 100644 --- a/src/lib/gssapi/krb5/k5unsealiov.c +++ b/src/lib/gssapi/krb5/k5unsealiov.c @@ -502,10 +502,14 @@ kg_unseal_stream_iov(OM_uint32 *minor_status, case KG2_TOK_WRAP_MSG: case KG2_TOK_DEL_CTX: { size_t ec, rrc; - krb5_enctype enctype = ctx->enc->keyblock.enctype; + krb5_enctype enctype; unsigned int k5_headerlen = 0; unsigned int k5_trailerlen = 0; + if (ctx->have_acceptor_subkey) + enctype = ctx->acceptor_subkey->keyblock.enctype; + else + enctype = ctx->subkey->keyblock.enctype; conf_req_flag = ((ptr[0] & FLAG_WRAP_CONFIDENTIAL) != 0); ec = conf_req_flag ? load_16_be(ptr + 2) : 0; rrc = load_16_be(ptr + 4); |