diff options
| author | Alexander Bokovoy <ab@samba.org> | 2012-06-07 18:24:38 +0300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2012-06-22 21:50:10 +0200 |
| commit | af02273b76a792ca71fcb369a2a647496c948531 (patch) | |
| tree | 84a0c73459479254974dacb2be86c443729e2491 | |
| parent | 437274c5f923940836fca4494a03f893f5e4217f (diff) | |
| download | samba-af02273b76a792ca71fcb369a2a647496c948531.tar.gz | |
s3-librpc-crypto: avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()
gss_get_name_attribute() can return unintialized pac_display_buffer
and later gss_release_buffer() will crash on attempting to release it.
The fix on MIT krb5 side is in 1.10.1, reported in both Debian and MIT upstream:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514
http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087
We need to initialize variables before using gss_get_name_attribute()
Fix bug #8988 (avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()).
(cherry picked from commit 185c2054fd22de0ab07a762a279a7ef0db5d802c)
| -rw-r--r-- | source3/librpc/crypto/gse.c | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c index 335dc1c53f1..02fb0f6141d 100644 --- a/source3/librpc/crypto/gse.c +++ b/source3/librpc/crypto/gse.c @@ -688,8 +688,24 @@ NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob) { OM_uint32 gss_min, gss_maj; - gss_buffer_desc pac_buffer; - gss_buffer_desc pac_display_buffer; +/* + * gss_get_name_attribute() in MIT krb5 1.10.0 can return unintialized pac_display_buffer + * and later gss_release_buffer() will crash on attempting to release it. + * + * So always initialize the buffer descriptors. + * + * See following links for more details: + * http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514 + * http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087 + */ + gss_buffer_desc pac_buffer = { + .value = NULL, + .length = 0 + }; + gss_buffer_desc pac_display_buffer = { + .value = NULL, + .length = 0 + }; gss_buffer_desc pac_name = { .value = discard_const_p(char, "urn:mspac:"), .length = sizeof("urn:mspac:") - 1 |