From 94d3c5951e1171e44e36439cf59074ff3dd29ea4 Mon Sep 17 00:00:00 2001
From: Nalin Dahyabhai <nalin@fedoraproject.org>
Date: Thu, 4 Jun 2009 19:29:44 +0000
Subject: [PATCH] - try to be more resilient to comparisons of malformed
 principal structures

---
 krb5-1.7-api.patch | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 krb5-1.7-api.patch

diff --git a/krb5-1.7-api.patch b/krb5-1.7-api.patch
new file mode 100644
index 0000000..99d24cd
--- /dev/null
+++ b/krb5-1.7-api.patch
@@ -0,0 +1,30 @@
+Reference docs don't define what happens if you call krb5_realm_compare() with
+malformed krb5_principal structures.  Define a behavior which keeps it from
+crashing if applications don't check ahead of time.
+
+diff -up krb5-1.7/src/lib/krb5/krb/princ_comp.c krb5-1.7/src/lib/krb5/krb/princ_comp.c
+--- krb5-1.7/src/lib/krb5/krb/princ_comp.c	2009-01-03 18:19:42.000000000 -0500
++++ krb5-1.7/src/lib/krb5/krb/princ_comp.c	2009-06-04 14:31:26.000000000 -0400
+@@ -40,6 +40,12 @@ realm_compare_flags(krb5_context context
+     const krb5_data *realm1 = krb5_princ_realm(context, princ1);
+     const krb5_data *realm2 = krb5_princ_realm(context, princ2);
+ 
++    if ((princ1 == NULL) || (princ2 == NULL))
++	return FALSE;
++
++    if ((realm1 == NULL) || (realm2 == NULL))
++	return FALSE;
++
+     if (realm1->length != realm2->length)
+ 	return FALSE;
+ 
+@@ -91,6 +97,9 @@ krb5_principal_compare_flags(krb5_contex
+     krb5_principal upn2 = NULL;
+     krb5_boolean ret = FALSE;
+ 
++    if ((princ1 == NULL) || (princ2 == NULL))
++	return FALSE;
++
+     if (flags & KRB5_PRINCIPAL_COMPARE_ENTERPRISE) {
+ 	/* Treat UPNs as if they were real principals */
+ 	if (krb5_princ_type(context, princ1) == KRB5_NT_ENTERPRISE_PRINCIPAL) {