[krbdev.mit.edu #5947] FFM.EXAMPLE.ORG -> M.EXAMPLE.ORG broken
Ken Raeburn via RT
rt-comment at krbdev.mit.edu
Tue Jul 15 19:58:54 EDT 2008
The supplied patch tests conditions which I think will always be true -- that the ccp-com_cdot
and scp-com_sdot offsets are the same. So I think it's really only breaking out of the loop when
slen and/or clen are 1 and therefore about to be decremented to 0, which would break out of
the loop, but only after the decrements of clen, slen, ccp, and scp. The patch quits the loop
without those decrements, which changes the code paths following that check for slen==0 or
clen==0.
This causes a different result if the client and server realms supplied are the same (current
code: return KRB5_NO_TKT_IN_RLM; with patch: walk up and down the realm tree).
It also causes different results if one realm is above or below the other in the hierarchy, e.g.,
A.EXAMPLE.COM and EXAMPLE.COM.
I've added a test script on the trunk that should exercise this code a bit...
More information about the krb5-bugs
mailing list