svn rev #24063: branches/krb5-1-8/src/lib/gssapi/krb5/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24063
Commit By: tlyu
Log Message:
ticket: 6725
version_fixed: 1.8.2
status: resolved

pull up r24056 from trunk

 ------------------------------------------------------------------------
 r24056 | tlyu | 2010-05-19 14:09:37 -0400 (Wed, 19 May 2010) | 8 lines

 ticket: 6725
 subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
 tags: pullup
 target_version: 1.8.2

 Make krb5_gss_accept_sec_context() check for a null authenticator
 checksum pointer before attempting to dereference it.


Changed Files:
U   branches/krb5-1-8/src/lib/gssapi/krb5/accept_sec_context.c
Modified: branches/krb5-1-8/src/lib/gssapi/krb5/accept_sec_context.c
===================================================================
--- branches/krb5-1-8/src/lib/gssapi/krb5/accept_sec_context.c	2010-05-19 18:52:49 UTC (rev 24062)
+++ branches/krb5-1-8/src/lib/gssapi/krb5/accept_sec_context.c	2010-05-19 18:52:54 UTC (rev 24063)
@@ -607,6 +607,13 @@
     }
 #endif
 
+    if (authdat->checksum == NULL) {
+        /* missing checksum counts as "inappropriate type" */
+        code = KRB5KRB_AP_ERR_INAPP_CKSUM;
+        major_status = GSS_S_FAILURE;
+        goto fail;
+    }
+
     if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) {
         /* Samba does not send 0x8003 GSS-API checksums */
         krb5_boolean valid;