Skip to content

Commit

Permalink
Fix krb5_copy_context
Browse files Browse the repository at this point in the history
krb5_copy_context has been broken since 1.8 (it broke in r22456)
because k5_copy_etypes crashes on null enctype lists.  Subsequent
additions to the context structure were not reflected in
krb5_copy_context, creating double-free bugs.  Make k5_copy_etypes
handle null input and account for all new fields in krb5_copy_context.
Reported by Arran Cudbard-Bell.

(back ported from commit c452644)

ticket: 7807
  • Loading branch information
tlyu committed Jan 9, 2014
1 parent e591da9 commit 13cfe6a
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 0 deletions.
14 changes: 14 additions & 0 deletions src/lib/krb5/krb/copy_ctx.c
Original file line number Diff line number Diff line change
Expand Up @@ -77,13 +77,22 @@ krb5_copy_context(krb5_context ctx, krb5_context *nctx_out)
nctx->ser_ctx_count = 0;
nctx->ser_ctx = NULL;
nctx->prompt_types = NULL;
nctx->preauth_context = NULL;
nctx->ccselect_handles = NULL;
nctx->localauth_handles = NULL;
nctx->hostrealm_handles = NULL;
nctx->kdblog_context = NULL;
nctx->trace_callback = NULL;
nctx->trace_callback_data = NULL;
nctx->plugin_base_dir = NULL;
nctx->os_context.default_ccname = NULL;

memset(&nctx->libkrb5_plugins, 0, sizeof(nctx->libkrb5_plugins));
nctx->vtbl = NULL;
nctx->locate_fptrs = NULL;

memset(&nctx->err, 0, sizeof(nctx->err));
memset(&nctx->plugins, 0, sizeof(nctx->plugins));

ret = k5_copy_etypes(ctx->in_tkt_etypes, &nctx->in_tkt_etypes);
if (ret)
Expand All @@ -103,6 +112,11 @@ krb5_copy_context(krb5_context ctx, krb5_context *nctx_out)
ret = krb5_get_profile(ctx, &nctx->profile);
if (ret)
goto errout;
nctx->plugin_base_dir = strdup(ctx->plugin_base_dir);
if (nctx->plugin_base_dir == NULL) {
ret = ENOMEM;
goto errout;
}

errout:
if (ret) {
Expand Down
2 changes: 2 additions & 0 deletions src/lib/krb5/krb/etype_list.c
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@ k5_copy_etypes(const krb5_enctype *old_list, krb5_enctype **new_list)
krb5_enctype *list;

*new_list = NULL;
if (old_list == NULL)
return 0;
count = k5_count_etypes(old_list);
list = malloc(sizeof(krb5_enctype) * (count + 1));
if (list == NULL)
Expand Down

0 comments on commit 13cfe6a

Please sign in to comment.