From 81e503c09ad9aef4a0afc6bf66a0269cde2151f3 Mon Sep 17 00:00:00 2001 From: Neng Xue Date: Mon, 30 Jun 2014 14:04:56 -0700 Subject: Fix unlikely null dereference in TGS client code If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an error re-reading the profile), k5_make_tgs_req will dereference a null pointer. Check the return value before dereferencing defenctypes. [ghudson@mit.edu: clarified commit message] ticket: 7952 (new) target_version: 1.12.2 tags: pullup --- src/lib/krb5/krb/send_tgs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/lib/krb5/krb/send_tgs.c b/src/lib/krb5/krb/send_tgs.c index cd56366cb..f6fdf68d4 100644 --- a/src/lib/krb5/krb/send_tgs.c +++ b/src/lib/krb5/krb/send_tgs.c @@ -198,7 +198,9 @@ k5_make_tgs_req(krb5_context context, req.nktypes = 1; } else { /* Get the default TGS enctypes. */ - krb5_get_tgs_ktypes(context, desired->server, &defenctypes); + ret = krb5_get_tgs_ktypes(context, desired->server, &defenctypes); + if (ret) + goto cleanup; for (count = 0; defenctypes[count]; count++); req.ktype = defenctypes; req.nktypes = count; -- cgit