[krbdev.mit.edu #5947] FFM.EXAMPLE.ORG -> M.EXAMPLE.ORG broken

Ken Raeburn via RT rt-comment at krbdev.mit.edu
Tue Jul 15 19:58:54 EDT 2008


The supplied patch tests conditions which I think will always be true -- that the ccp-com_cdot 
and scp-com_sdot offsets are the same.  So I think it's really only breaking out of the loop when 
slen and/or clen are 1 and therefore about to be decremented to 0, which would break out of 
the loop, but only after the decrements of clen, slen, ccp, and scp.  The patch quits the loop 
without those decrements, which changes the code paths following that check for slen==0 or 
clen==0.

This causes a different result if the client and server realms supplied are the same (current 
code: return KRB5_NO_TKT_IN_RLM; with patch: walk up and down the realm tree).

It also causes different results if one realm is above or below the other in the hierarchy, e.g., 
A.EXAMPLE.COM and EXAMPLE.COM.

I've added a test script on the trunk that should exercise this code a bit...



More information about the krb5-bugs mailing list