svn rev #19043: trunk/ src/kadmin/server/ src/lib/gssapi/mechglue/

[tlyu@MIT.EDU]

Commit By: tlyu
Log Message: 
ticket: new
target_version: 1.6
tags: pullup
subject: MITKRB5-SA-2006-003: mechglue argument handling too lax
component: krb5-libs

Fix mechglue argument checks so that output pointers are always
initialized regardless of whether the other arguments fail to validate
for some reason.  This avoids freeing of uninitialized pointers.

Initialize the gss_buffer_descs in ovsec_kadmd.c.




Changed Files:
_U  trunk/
U   trunk/src/kadmin/server/ovsec_kadmd.c
U   trunk/src/lib/gssapi/mechglue/g_accept_sec_context.c
U   trunk/src/lib/gssapi/mechglue/g_acquire_cred.c
U   trunk/src/lib/gssapi/mechglue/g_canon_name.c
U   trunk/src/lib/gssapi/mechglue/g_compare_name.c
U   trunk/src/lib/gssapi/mechglue/g_delete_sec_context.c
U   trunk/src/lib/gssapi/mechglue/g_dsp_name.c
U   trunk/src/lib/gssapi/mechglue/g_dsp_status.c
U   trunk/src/lib/gssapi/mechglue/g_dup_name.c
U   trunk/src/lib/gssapi/mechglue/g_exp_sec_context.c
U   trunk/src/lib/gssapi/mechglue/g_export_name.c
U   trunk/src/lib/gssapi/mechglue/g_imp_name.c
U   trunk/src/lib/gssapi/mechglue/g_imp_sec_context.c
U   trunk/src/lib/gssapi/mechglue/g_init_sec_context.c
U   trunk/src/lib/gssapi/mechglue/g_initialize.c
U   trunk/src/lib/gssapi/mechglue/g_inq_context.c
U   trunk/src/lib/gssapi/mechglue/g_inq_cred.c
U   trunk/src/lib/gssapi/mechglue/g_inq_names.c
U   trunk/src/lib/gssapi/mechglue/g_process_context.c
U   trunk/src/lib/gssapi/mechglue/g_seal.c
U   trunk/src/lib/gssapi/mechglue/g_sign.c
U   trunk/src/lib/gssapi/mechglue/g_store_cred.c
U   trunk/src/lib/gssapi/mechglue/g_unseal.c
U   trunk/src/lib/gssapi/mechglue/g_verify.c
U   trunk/src/lib/gssapi/mechglue/oid_ops.c