[krbdev.mit.edu #6402] Invalid initial GSSAPI/SPNEGO token can cause segmentation error or assert failure

[Tom Yu via RT]

"" Arlene Berry " via RT" <rt-comment at krbdev.mit.edu> writes:

> This fixed 1.6.3 for us.  I changed the call so that it doesn't
> dereference a NULL pointer and altered make_spnego_tokenTarg_msg to
> allow for no mechanism since there may not be one when rejecting the
> request.

[...]

Actually, based on discussion on the krbdev list, I had come up with
this shorter patch.  Do you find any particular reasons to prefer one
over the other?

--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1248,7 +1248,8 @@ spnego_gss_accept_sec_context(void *ct,
 				 &negState, &return_token);
 	}
 cleanup:
-	if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC) {
+	if (return_token == INIT_TOKEN_SEND ||
+	    return_token == CONT_TOKEN_SEND) {
 		tmpret = make_spnego_tokenTarg_msg(negState, sc->internal_mech,
 						   &mechtok_out, mic_out,
 						   return_token,