svn rev #24878: trunk/src/kadmin/server/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24878
Commit By: tlyu
Log Message:
ticket: 6899
tags: pullup
target_version: 1.9.1

Fix the sole case in process_chpw_request() where a return could occur
without allocating the data pointer in the response.  This prevents a
later free() of an invalid pointer in kill_tcp_or_rpc_connection().

Also initialize rep->data to NULL in process_chpw_request() and clean
up *response in dispatch() as an additional precaution.


Changed Files:
U   trunk/src/kadmin/server/schpw.c
Modified: trunk/src/kadmin/server/schpw.c
===================================================================
--- trunk/src/kadmin/server/schpw.c	2011-04-13 15:15:56 UTC (rev 24877)
+++ trunk/src/kadmin/server/schpw.c	2011-04-13 18:43:37 UTC (rev 24878)
@@ -52,6 +52,7 @@
 
     ret = 0;
     rep->length = 0;
+    rep->data = NULL;
 
     auth_context = NULL;
     changepw = NULL;
@@ -76,8 +77,13 @@
     plen = (*ptr++ & 0xff);
     plen = (plen<<8) | (*ptr++ & 0xff);
 
-    if (plen != req->length)
-        return(KRB5KRB_AP_ERR_MODIFIED);
+    if (plen != req->length) {
+        ret = KRB5KRB_AP_ERR_MODIFIED;
+        numresult = KRB5_KPASSWD_MALFORMED;
+        strlcpy(strresult, "Request length was inconsistent",
+                sizeof(strresult));
+        goto chpwfail;
+    }
 
     /* verify version number */
 
@@ -534,6 +540,10 @@
     if (local_kaddrs != NULL)
         krb5_free_addresses(server_handle->context, local_kaddrs);
 
+    if ((*response)->data == NULL) {
+        free(*response);
+        *response = NULL;
+    }
     krb5_kt_close(server_handle->context, kt);
 
     return ret;