krb5 commit [krb5-1.12]: Fix possible null deref in previous

Tom Yu tlyu at MIT.EDU
Wed Jan 8 22:30:38 EST 2014


https://github.com/krb5/krb5/commit/1122d59f0f6eecee8478c5361269df79574b2dd7
commit 1122d59f0f6eecee8478c5361269df79574b2dd7
Author: Tom Yu <tlyu at mit.edu>
Date:   Tue Dec 31 19:41:12 2013 -0500

    Fix possible null deref in previous
    
    My rework of the do_tgs_req.c patch introduced a null deref if
    decode_krb5_tgs_req() failed.
    
    (cherry picked from commit 30589b2a1636de9f9b68591f0e546cb0fa21989f)
    
    ticket: 7802
    version_fixed: 1.12.1
    status: resolved

 src/kdc/do_tgs_req.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 5cfe0b6..6bc4f15 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -145,11 +145,12 @@ process_tgs_req(struct server_handle *handle, krb5_data *pkt,
     session_key.contents = NULL;
 
     retval = decode_krb5_tgs_req(pkt, &request);
-    /* Save pointer to client-requested service principal, in case of errors
-     * before a successful call to search_sprinc(). */
-    sprinc = request->server;
     if (retval)
         return retval;
+    /* Save pointer to client-requested service principal, in case of
+     * errors before a successful call to search_sprinc(). */
+    sprinc = request->server;
+
     if (request->msg_type != KRB5_TGS_REQ) {
         krb5_free_kdc_req(handle->kdc_err_context, request);
         return KRB5_BADMSGTYPE;


More information about the cvs-krb5 mailing list