svn rev #23850: branches/krb5-1-7/src/lib/gssapi/spnego/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=23850
Commit By: tlyu
Log Message:
ticket: 6694
subject: MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO
version_fixed: 1.7.2

pull up r23832 from trunk

 ------------------------------------------------------------------------
 r23832 | tlyu | 2010-03-23 14:53:52 -0400 (Tue, 23 Mar 2010) | 8 lines

 ticket: 6690
 target_version: 1.8.1
 tags: pullup
 subject: MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO

 The SPNEGO implementation in krb5-1.7 and later could crash due to
 assertion failure when receiving some sorts of invalid GSS-API tokens.


Changed Files:
U   branches/krb5-1-7/src/lib/gssapi/spnego/spnego_mech.c
Modified: branches/krb5-1-7/src/lib/gssapi/spnego/spnego_mech.c
===================================================================
--- branches/krb5-1-7/src/lib/gssapi/spnego/spnego_mech.c	2010-03-30 01:54:21 UTC (rev 23849)
+++ branches/krb5-1-7/src/lib/gssapi/spnego/spnego_mech.c	2010-03-30 03:05:11 UTC (rev 23850)
@@ -1561,7 +1561,7 @@
 	gss_buffer_desc mechtok_out = GSS_C_EMPTY_BUFFER;
 	spnego_gss_ctx_id_t sc = NULL;
 	OM_uint32 mechstat = GSS_S_FAILURE;
-	int sendTokenInit = 0;
+	int sendTokenInit = 0, tmpret;
 
 	mechtok_in = mic_in = mic_out = GSS_C_NO_BUFFER;
 
@@ -1593,7 +1593,6 @@
 		if (delegated_cred_handle != NULL)
 			*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
 		if (input_token->length == 0) {
-			sendTokenInit = 1;
 			ret = acc_ctx_hints(minor_status,
 					    context_handle,
 					    verifier_cred_handle,
@@ -1602,6 +1601,7 @@
 					    &return_token);
 			if (ret != GSS_S_COMPLETE)
 				goto cleanup;
+			sendTokenInit = 1;
 			ret = GSS_S_CONTINUE_NEEDED;
 		} else {
 			/* Can set negState to REQUEST_MIC */
@@ -1650,29 +1650,23 @@
 				 &negState, &return_token);
 	}
 cleanup:
-	if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC) {
-		/* For acceptor-sends-first send a tokenInit */
-		int tmpret;
-
+	if (return_token == INIT_TOKEN_SEND && sendTokenInit) {
 		assert(sc != NULL);
-
-		if (sendTokenInit) {
-			tmpret = make_spnego_tokenInit_msg(sc,
-							   1,
-							   mic_out,
-							   0,
-							   GSS_C_NO_BUFFER,
-							   return_token,
-							   output_token);
-		} else {
-			tmpret = make_spnego_tokenTarg_msg(negState,
-							   sc ? sc->internal_mech : GSS_C_NO_OID,
-							   &mechtok_out, mic_out,
-							   return_token,
-							   output_token);
-		}
+		tmpret = make_spnego_tokenInit_msg(sc, 1, mic_out, 0,
+						   GSS_C_NO_BUFFER,
+						   return_token, output_token);
 		if (tmpret < 0)
 			ret = GSS_S_FAILURE;
+	} else if (return_token != NO_TOKEN_SEND &&
+		   return_token != CHECK_MIC) {
+		tmpret = make_spnego_tokenTarg_msg(negState,
+						   sc ? sc->internal_mech :
+						   GSS_C_NO_OID,
+						   &mechtok_out, mic_out,
+						   return_token,
+						   output_token);
+		if (tmpret < 0)
+			ret = GSS_S_FAILURE;
 	}
 	if (ret == GSS_S_COMPLETE) {
 		*context_handle = (gss_ctx_id_t)sc->ctx_handle;