[krbdev.mit.edu #8727] Directly dereference the pointer svalue which may be NULL in kadm5_get_config_params()

Bean Zhang via RT rt-comment at KRBDEV-PROD-APP-1.mit.edu
Fri Aug 10 11:17:01 EDT 2018


Hi Team,

In kadm5_get_config_params() of krb5-1.16.1/src/lib/kadm5/alt_prof.c,
After calling strdup() to assign pointer svalue,
we directly dereference it without checking if it is valid.

We should add pointer validity checking for svalue after assigning.

Could someone help to take a look?

Thanks,
Bean



More information about the krb5-bugs mailing list