From 617d153bb32d0bd7db33ccec21043d1113651f3a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 18 Apr 2018 14:13:28 -0400 Subject: [PATCH] Fix segfault in finish_dispatch() dispatch() doesn't necessarily initialize state->active_realm which led to an explicit NULL dereference in finish_dispatch(). Additionally, fix make_too_big_error() so that it won't subsequently dereference state->active_realm. tags: pullup target_version: 1.16-next target_version: 1.15-next --- src/kdc/dispatch.c | 79 ++++++++++++++++++++++++---------------------- 1 file changed, 42 insertions(+), 37 deletions(-) diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c index 3ed5176a8..fb3686c98 100644 --- a/src/kdc/dispatch.c +++ b/src/kdc/dispatch.c @@ -35,9 +35,6 @@ static krb5_int32 last_usec = 0, last_os_random = 0; -static krb5_error_code make_too_big_error(kdc_realm_t *kdc_active_realm, - krb5_data **out); - struct dispatch_state { loop_respond_fn respond; void *arg; @@ -47,6 +44,41 @@ struct dispatch_state { krb5_context kdc_err_context; }; + +static krb5_error_code +make_too_big_error(krb5_context context, krb5_principal tgsprinc, + krb5_data **out) +{ + krb5_error errpkt; + krb5_error_code retval; + krb5_data *scratch; + + *out = NULL; + memset(&errpkt, 0, sizeof(errpkt)); + + retval = krb5_us_timeofday(context, &errpkt.stime, &errpkt.susec); + if (retval) + return retval; + errpkt.error = KRB_ERR_RESPONSE_TOO_BIG; + errpkt.server = tgsprinc; + errpkt.client = NULL; + errpkt.text.length = 0; + errpkt.text.data = 0; + errpkt.e_data.length = 0; + errpkt.e_data.data = 0; + scratch = malloc(sizeof(*scratch)); + if (scratch == NULL) + return ENOMEM; + retval = krb5_mk_error(context, &errpkt, scratch); + if (retval) { + free(scratch); + return retval; + } + + *out = scratch; + return 0; +} + static void finish_dispatch(struct dispatch_state *state, krb5_error_code code, krb5_data *response) @@ -54,12 +86,17 @@ finish_dispatch(struct dispatch_state *state, krb5_error_code code, loop_respond_fn oldrespond = state->respond; void *oldarg = state->arg; kdc_realm_t *kdc_active_realm = state->active_realm; + krb5_principal tgsprinc = NULL; + + if (kdc_active_realm != NULL) + tgsprinc = kdc_active_realm->realm_tgsprinc; if (state->is_tcp == 0 && response && response->length > (unsigned int)max_dgram_reply_size) { - krb5_free_data(kdc_context, response); + krb5_free_data(state->kdc_err_context, response); response = NULL; - code = make_too_big_error(kdc_active_realm, &response); + code = make_too_big_error(state->kdc_err_context, tgsprinc, + &response); if (code) krb5_klog_syslog(LOG_ERR, "error constructing " "KRB_ERR_RESPONSE_TOO_BIG error: %s", @@ -208,38 +245,6 @@ done: finish_dispatch_cache(state, retval, response); } -static krb5_error_code -make_too_big_error(kdc_realm_t *kdc_active_realm, krb5_data **out) -{ - krb5_error errpkt; - krb5_error_code retval; - krb5_data *scratch; - - *out = NULL; - memset(&errpkt, 0, sizeof(errpkt)); - - retval = krb5_us_timeofday(kdc_context, &errpkt.stime, &errpkt.susec); - if (retval) - return retval; - errpkt.error = KRB_ERR_RESPONSE_TOO_BIG; - errpkt.server = tgs_server; - errpkt.client = NULL; - errpkt.text.length = 0; - errpkt.text.data = 0; - errpkt.e_data.length = 0; - errpkt.e_data.data = 0; - scratch = malloc(sizeof(*scratch)); - if (scratch == NULL) - return ENOMEM; - retval = krb5_mk_error(kdc_context, &errpkt, scratch); - if (retval) { - free(scratch); - return retval; - } - - *out = scratch; - return 0; -} krb5_context get_context(void *handle) {