krb5 commit [krb5-1.10]: Do not retrieve zero-length creds

[Tom Yu]

https://github.com/krb5/krb5/commit/4e51366fc61b54ca84b3f48cd2abc0ba62852a7b
commit 4e51366fc61b54ca84b3f48cd2abc0ba62852a7b
Author: Ben Kaduk <kaduk at mit.edu>
Date:   Fri Aug 31 17:48:14 2012 -0400

    Do not retrieve zero-length creds
    
    In the MSLSA cache, if we get back a zero-length ticket, don't
    accept it as success; continue on to try and get an acceptable
    ticket.
    
    (cherry picked from commit cd58adf4b0f52d0293ec8bf9d7d3e87bd1e6ce3f)
    
    ticket: 7349
    version_fixed: 1.10.4
    status: resolved

 src/lib/krb5/ccache/cc_mslsa.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/lib/krb5/ccache/cc_mslsa.c b/src/lib/krb5/ccache/cc_mslsa.c
index 39d78e7..d692b42 100644
--- a/src/lib/krb5/ccache/cc_mslsa.c
+++ b/src/lib/krb5/ccache/cc_mslsa.c
@@ -2489,7 +2489,8 @@ krb5_lcc_retrieve(krb5_context context, krb5_ccache id, krb5_flags whichfields,
 
     /* first try to find out if we have an existing ticket which meets the requirements */
     kret = krb5_cc_retrieve_cred_default (context, id, whichfields, mcreds, creds);
-    if ( !kret )
+    /* This sometimes returns a zero-length ticket; work around it. */
+    if ( !kret && creds->ticket.length > 0 )
         return KRB5_OK;
 
     /* if not, we must try to get a ticket without specifying any flags or etypes */
@@ -2506,7 +2507,8 @@ krb5_lcc_retrieve(krb5_context context, krb5_ccache id, krb5_flags whichfields,
 
     /* try again to find out if we have an existing ticket which meets the requirements */
     kret = krb5_cc_retrieve_cred_default (context, id, whichfields, mcreds, creds);
-    if ( !kret )
+    /* This sometimes returns a zero-length ticket; work around it. */
+    if ( !kret && creds->ticket.length > 0 )
         goto cleanup;
 
     /* if not, obtain a ticket using the request flags and enctype even though it may not