krb5 commit [krb5-1.12]: Fix null deref in SPNEGO acceptor [CVE-2014-4344]

[Tom Yu]

https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc
commit a7886f0ed1277c69142b14a2c6629175a6331edc
Author: Greg Hudson <ghudson at mit.edu>
Date:   Tue Jul 15 12:56:01 2014 -0400

    Fix null deref in SPNEGO acceptor [CVE-2014-4344]
    
    When processing a continuation token, acc_ctx_cont was dereferencing
    the initial byte of the token without checking the length.  This could
    result in a null dereference.
    
    CVE-2014-4344:
    
    In MIT krb5 1.5 and newer, an unauthenticated or partially
    authenticated remote attacker can cause a NULL dereference and
    application crash during a SPNEGO negotiation by sending an empty
    token as the second or later context token from initiator to acceptor.
    The attacker must provide at least one valid context token in the
    security context negotiation before sending the empty token.  This can
    be done by an unauthenticated attacker by forcing SPNEGO to
    renegotiate the underlying mechanism, or by using IAKERB to wrap an
    unauthenticated AS-REQ as the first token.
    
        CVSSv2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C
    
    [kaduk at mit.edu: CVE summary, CVSSv2 vector]
    
    (cherry picked from commit 524688ce87a15fc75f87efc8c039ba4c7d5c197b)
    
    ticket: 7970
    version_fixed: 1.12.2
    status: resolved

 src/lib/gssapi/spnego/spnego_mech.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index a01f154..65e1306 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1442,7 +1442,7 @@ acc_ctx_cont(OM_uint32 *minstat,
 
 	ptr = bufstart = buf->value;
 #define REMAIN (buf->length - (ptr - bufstart))
-	if (REMAIN > INT_MAX)
+	if (REMAIN == 0 || REMAIN > INT_MAX)
 		return GSS_S_DEFECTIVE_TOKEN;
 
 	/*