krb5 commit: Multi-realm KDC null deref [CVE-2013-1418]

[Tom Yu]

https://github.com/krb5/krb5/commit/5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf
commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf
Author: Tom Yu <tlyu at mit.edu>
Date:   Mon Nov 4 13:44:29 2013 -0500

    Multi-realm KDC null deref [CVE-2013-1418]
    
    If a KDC serves multiple realms, certain requests can cause
    setup_server_realm() to dereference a null pointer, crashing the KDC.
    
    CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C
    
    A related but more minor vulnerability requires authentication to
    exploit, and is only present if a third-party KDC database module can
    dereference a null pointer under certain conditions.
    
    ticket: 7755 (new)
    target_version: 1.12
    tags: pullup

 src/kdc/main.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/src/kdc/main.c b/src/kdc/main.c
index 0f5961a..a7ffe63 100644
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -124,6 +124,9 @@ setup_server_realm(struct server_handle *handle, krb5_principal sprinc)
     kdc_realm_t **kdc_realmlist = handle->kdc_realmlist;
     int kdc_numrealms = handle->kdc_numrealms;
 
+    if (sprinc == NULL)
+        return NULL;
+
     if (kdc_numrealms > 1) {
         if (!(newrealm = find_realm_data(handle, sprinc->realm.data,
                                          (krb5_ui_4) sprinc->realm.length)))