Zap copy of secret in RC4 string-to-key

Zap-copy-of-secret-in-RC4-string-to-key.patch

@@ -0,0 +1,30 @@
+From 55a8161c3f5238df522447499a38bf2e9497b074 Mon Sep 17 00:00:00 2001
+From: Dylan Gray <35609490+Dylan-MSFT@users.noreply.github.com>
+Date: Fri, 13 Jul 2018 15:09:01 -0700
+Subject: [PATCH] Zap copy of secret in RC4 string-to-key
+
+Commit b8814745049b5f401e3ae39a81dc1e14598ae48c (ticket 8576) added a
+zero-terminated copy of the input string in
+krb5int_arcfour_string_to_key().  This copy should be zeroed when
+freed as the input string typically contains a password.
+
+[ghudson@mit.edu: rewrote commit message]
+
+ticket: 8713 (new)
+---
+ src/lib/crypto/krb/s2k_rc4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/lib/crypto/krb/s2k_rc4.c b/src/lib/crypto/krb/s2k_rc4.c
+index 081a91217..f7e699d60 100644
+--- a/src/lib/crypto/krb/s2k_rc4.c
++++ b/src/lib/crypto/krb/s2k_rc4.c
+@@ -25,7 +25,7 @@ krb5int_arcfour_string_to_key(const struct krb5_keytypes *ktp,
+     if (utf8 == NULL)
+         return err;
+     err = k5_utf8_to_utf16le(utf8, &copystr, &copystrlen);
+-    free(utf8);
++    zapfree(utf8, string->length);
+     if (err)
+         return err;
+ 

krb5.spec

@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.16.1
 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 12%{?dist}
+Release: 13%{?dist}
 
 # lookaside-cached sources; two downloads and a build artifact
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.16/krb5-%{version}%{prerelease}.tar.gz
@@ -96,6 +96,7 @@ Patch76: Explicitly-look-for-python2-in-configure.in.patch
 Patch77: Use-SHA-256-instead-of-MD5-for-audit-ticket-IDs.patch
 Patch78: Add-k5test-mark-function.patch
 Patch79: Convert-Python-tests-to-Python-3.patch
+Patch80: Zap-copy-of-secret-in-RC4-string-to-key.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -742,6 +743,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Jul 16 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-13
+- Zap copy of secret in RC4 string-to-key
+
 * Thu Jul 12 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-12
 - Convert Python tests to Python 3