krb5 commit: Check for cache copy error in kfwlogon

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/9c71a68596bc25b4b7373f475252a4baa17ed26c
commit 9c71a68596bc25b4b7373f475252a4baa17ed26c
Author: Greg Hudson <ghudson at mit.edu>
Date:   Fri Sep 11 20:32:06 2026 -0400

    Check for cache copy error in kfwlogon
    
    Add a return status to KFW_copy_cache_to_system_file().  If it returns
    an error to NPLogonNotify(), do not continue processing; otherwise
    kfwlogon could potentially set ACL rights on a file it didn't create.
    Discovered by Aisle Research.
    
    ticket: 9236 (new)
    tags: pullup
    target_version: 1.22-next

 src/windows/kfwlogon/kfwcommon.c | 12 +++++++++---
 src/windows/kfwlogon/kfwlogon.c  |  6 ++++--
 src/windows/kfwlogon/kfwlogon.h  |  2 +-
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/windows/kfwlogon/kfwcommon.c b/src/windows/kfwlogon/kfwcommon.c
index b7ffbbdde..6510e32ce 100644
--- a/src/windows/kfwlogon/kfwcommon.c
+++ b/src/windows/kfwlogon/kfwcommon.c
@@ -950,8 +950,9 @@ int KFW_obtain_user_temp_directory(HANDLE hUserToken, char *newfilename, int siz
     return 0;
 }
 
-void
-KFW_copy_cache_to_system_file(const char * user, const char * filename)
+int
+KFW_copy_cache_to_system_file(const char * user, const char * filename,
+			      char **reason_out)
 {
     char cachename[MAX_PATH + 8] = "FILE:";
     krb5_context		ctx = 0;
@@ -962,7 +963,7 @@ KFW_copy_cache_to_system_file(const char * user, const char * filename)
     PSECURITY_ATTRIBUTES        pSA = NULL;
 
     if (!pkrb5_init_context || !user || !filename)
-        return;
+        return EINVAL;
 
     strncat(cachename, filename, sizeof(cachename));
     cachename[sizeof(cachename)-1] = '\0';
@@ -1007,6 +1008,11 @@ KFW_copy_cache_to_system_file(const char * user, const char * filename)
 
     if (ctx)
         pkrb5_free_context(ctx);
+
+    if (code && reason_out != NULL)
+        *reason_out = (char *)perror_message(code);
+
+    return code;
 }
 
 int
diff --git a/src/windows/kfwlogon/kfwlogon.c b/src/windows/kfwlogon/kfwlogon.c
index 55dd026d1..f9213109a 100644
--- a/src/windows/kfwlogon/kfwlogon.c
+++ b/src/windows/kfwlogon/kfwlogon.c
@@ -195,7 +195,7 @@ DWORD APIENTRY NPLogonNotify(
 
     DWORD code = 0;
 
-    char *reason;
+    char *reason = "(unknown reason)";
     char *ctemp;
 
     BOOLEAN interactive = TRUE;
@@ -307,7 +307,9 @@ DWORD APIENTRY NPLogonNotify(
 	    goto cleanup;
 	}
 
-	KFW_copy_cache_to_system_file(uname, filename);
+	code = KFW_copy_cache_to_system_file(uname, filename, &reason);
+	if (code)
+	    goto cleanup;
 
 	/* Need to determine the SID */
 
diff --git a/src/windows/kfwlogon/kfwlogon.h b/src/windows/kfwlogon/kfwlogon.h
index 44749cdf7..cc7a42ffc 100644
--- a/src/windows/kfwlogon/kfwlogon.h
+++ b/src/windows/kfwlogon/kfwlogon.h
@@ -201,7 +201,7 @@ static BOOL WINAPI UnicodeStringToANSI(UNICODE_STRING uInputString, LPSTR lpszOu
 
 int KFW_is_available(void);
 int KFW_get_cred( char * username, char * password, int lifetime, char ** reasonP );
-void KFW_copy_cache_to_system_file(const char * user, const char * filename);
+int KFW_copy_cache_to_system_file(const char * user, const char * filename, char **reason_out);
 int KFW_destroy_tickets_for_principal(char * user);
 int KFW_set_ccache_dacl(char *filename, HANDLE hUserToken);
 int KFW_set_ccache_dacl_with_user_sid(char *filename, PSID pUserSID);