svn rev #24056: trunk/src/lib/gssapi/krb5/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24056
Commit By: tlyu
Log Message:
ticket: 6725
subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
tags: pullup
target_version: 1.8.2

Make krb5_gss_accept_sec_context() check for a null authenticator
checksum pointer before attempting to dereference it.


Changed Files:
U   trunk/src/lib/gssapi/krb5/accept_sec_context.c
Modified: trunk/src/lib/gssapi/krb5/accept_sec_context.c
===================================================================
--- trunk/src/lib/gssapi/krb5/accept_sec_context.c	2010-05-18 17:19:15 UTC (rev 24055)
+++ trunk/src/lib/gssapi/krb5/accept_sec_context.c	2010-05-19 18:09:37 UTC (rev 24056)
@@ -640,6 +640,13 @@
     }
 #endif
 
+    if (authdat->checksum == NULL) {
+        /* missing checksum counts as "inappropriate type" */
+        code = KRB5KRB_AP_ERR_INAPP_CKSUM;
+        major_status = GSS_S_FAILURE;
+        goto fail;
+    }
+
     if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) {
         /* Samba does not send 0x8003 GSS-API checksums */
         krb5_boolean valid;