[krbdev.mit.edu #8055] git commit

[Greg Hudson via RT]

Fix gss_process_context_token() [CVE-2014-5352]

[MITKRB5-SA-2015-001] The krb5 gss_process_context_token() should not
actually delete the context; that leaves the caller with a dangling
pointer and no way to know that it is invalid.  Instead, mark the
context as terminated, and check for terminated contexts in the GSS
functions which expect established contexts.  Also add checks in
export_sec_context and pseudo_random, and adjust t_prf.c for the
pseudo_random check.

https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a
Author: Greg Hudson <ghudson at mit.edu>
Commit: 82dc33da50338ac84c7b4102dc6513d897d0506a
Branch: master
 src/lib/gssapi/krb5/context_time.c          |    2 +-
 src/lib/gssapi/krb5/export_sec_context.c    |    5 +++++
 src/lib/gssapi/krb5/gssapiP_krb5.h          |    1 +
 src/lib/gssapi/krb5/gssapi_krb5.c           |    2 +-
 src/lib/gssapi/krb5/inq_context.c           |    2 +-
 src/lib/gssapi/krb5/k5seal.c                |    2 +-
 src/lib/gssapi/krb5/k5sealiov.c             |    2 +-
 src/lib/gssapi/krb5/k5unseal.c              |    2 +-
 src/lib/gssapi/krb5/k5unsealiov.c           |    2 +-
 src/lib/gssapi/krb5/lucid_context.c         |    5 +++++
 src/lib/gssapi/krb5/prf.c                   |    4 ++++
 src/lib/gssapi/krb5/process_context_token.c |   17 ++++++++++++-----
 src/lib/gssapi/krb5/wrap_size_limit.c       |    2 +-
 src/tests/gssapi/t_prf.c                    |    1 +
 14 files changed, 36 insertions(+), 13 deletions(-)