svn rev #24067: branches/krb5-1-7/src/lib/gssapi/krb5/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24067
Commit By: tlyu
Log Message:
ticket: 6729
target_version: 1.7.2
version_fixed: 1.7.2
subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
status: resolved

pull up r24056 from trunk

 ------------------------------------------------------------------------
 r24056 | tlyu | 2010-05-19 14:09:37 -0400 (Wed, 19 May 2010) | 8 lines

 ticket: 6725
 subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
 tags: pullup
 target_version: 1.8.2

 Make krb5_gss_accept_sec_context() check for a null authenticator
 checksum pointer before attempting to dereference it.


Changed Files:
U   branches/krb5-1-7/src/lib/gssapi/krb5/accept_sec_context.c
Modified: branches/krb5-1-7/src/lib/gssapi/krb5/accept_sec_context.c
===================================================================
--- branches/krb5-1-7/src/lib/gssapi/krb5/accept_sec_context.c	2010-05-19 21:23:14 UTC (rev 24066)
+++ branches/krb5-1-7/src/lib/gssapi/krb5/accept_sec_context.c	2010-05-19 21:23:18 UTC (rev 24067)
@@ -561,6 +561,13 @@
     }
 #endif
 
+    if (authdat->checksum == NULL) {
+        /* missing checksum counts as "inappropriate type" */
+        code = KRB5KRB_AP_ERR_INAPP_CKSUM;
+        major_status = GSS_S_FAILURE;
+        goto fail;
+    }
+
    if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) {
       /* Samba does not send 0x8003 GSS-API checksums */
       krb5_boolean valid;