[krbdev.mit.edu #8856] segfault in krb5-1.17.1/src/lib/krb5/krb/authdata.c

[Jeffrey Arbuckle via RT]

Sat Dec 21 22:49:49 2019: Request 8856 was acted upon.
 Transaction: Ticket created by jeffa.lans at gmail.com
       Queue: krb5
     Subject: segfault in krb5-1.17.1/src/lib/krb5/krb/authdata.c
       Owner: Nobody
  Requestors: jeffa.lans at gmail.com
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8856 >


I have run into a segfault bug with krb5-1.17.1 and earlier versions at:

lib/krb5/krb/authdata.c, line 562 :

          for (n_elements = 0; elements[n_elements] != NULL; n_elements++);

The segfault occurs because elements is NULL.

This is due to the earlier call to k5_unwrap_cammac_svc() that returns
KRB5KRB_AP_ERR_BAD_INTEGRITY and leaves elements as NULL:

lib/krb5/krb/authdata.c, line 556 :

        ret = k5_unwrap_cammac_svc(kcontext, cammacs[i], key, &elements);
          if (ret && ret != KRB5KRB_AP_ERR_BAD_INTEGRITY)

The issue is fixable with the following patch, but the bypassing of the
KRB5KRB_AP_ERR_BAD_INTEGRITY result is suspect:

--- krb5-1.17.1/src/lib/krb5/krb/authdata.c     2019-12-11
10:13:10.000000000 -0700
+++ krb5-1.17.1/src/lib/krb5/krb/authdata.c.    2019-12-18
11:27:06.555957314 -0700
@@ -558,6 +558,8 @@
             goto cleanup;
         ret = 0;

+        if ( elements == NULL ) continue;
+
         /* Add the verified elements to list and free the container array.
*/
         for (n_elements = 0; elements[n_elements] != NULL; n_elements++);
         new_list = realloc(list, (count + n_elements + 1) * sizeof(*list));


--Jeffrey