svn rev #24958: branches/krb5-1-9/src/lib/krb5/krb/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24958
Commit By: tlyu
Log Message:
ticket: 6907
version_fixed: 1.9.2
status: resolved

Fix an incorrect shift-and-mask length decoding operation reported by
Russ Allbery.


Changed Files:
U   branches/krb5-1-9/src/lib/krb5/krb/chpw.c
Modified: branches/krb5-1-9/src/lib/krb5/krb/chpw.c
===================================================================
--- branches/krb5-1-9/src/lib/krb5/krb/chpw.c	2011-06-09 21:09:04 UTC (rev 24957)
+++ branches/krb5-1-9/src/lib/krb5/krb/chpw.c	2011-06-10 15:45:13 UTC (rev 24958)
@@ -379,7 +379,7 @@
         ** validate the message length -
         ** length is big endian
         */
-        message_length = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+        message_length = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
         ptr += 2;
         /*
         ** make sure the message length and packet length agree -
@@ -389,7 +389,7 @@
         /*
         ** get the version number -
         */
-        version_number = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+        version_number = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
         ptr += 2;
         /*
         ** make sure we support the version returned -
@@ -405,7 +405,7 @@
         /*
         ** get the reply length -
         */
-        ap_rep.length = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+        ap_rep.length = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
         ptr += 2;
         /*
         ** validate ap_rep length agrees with the packet length -
@@ -468,7 +468,7 @@
     */
     ptr = clearresult.data;
 
-    *result_code = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+    *result_code = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
     ptr += 2;
 
     /*