[krbdev.mit.edu #6907] setpw response parsing fails for lengths above 255

[Greg Hudson via RT]

Index: lib/krb5/krb/chpw.c
===================================================================
--- lib/krb5/krb/chpw.c	(revision 24707)
+++ lib/krb5/krb/chpw.c	(working copy)
@@ -379,7 +379,7 @@
         ** validate the message length -
         ** length is big endian
         */
-        message_length = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+        message_length = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
         ptr += 2;
         /*
         ** make sure the message length and packet length agree -
@@ -389,7 +389,7 @@
         /*
         ** get the version number -
         */
-        version_number = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+        version_number = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
         ptr += 2;
         /*
         ** make sure we support the version returned -
@@ -405,7 +405,7 @@
         /*
         ** get the reply length -
         */
-        ap_rep.length = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+        ap_rep.length = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
         ptr += 2;
         /*
         ** validate ap_rep length agrees with the packet length -
@@ -468,7 +468,7 @@
     */
     ptr = clearresult.data;
 
-    *result_code = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+    *result_code = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
     ptr += 2;
 
     /*