Attachment 35646 Details for Bug 80574

[patch] krb5-1.4-VUL-0-krb5-overflow.dif

krb5-1.4-VUL-0-krb5-overflow.dif (text/plain), 1.19 KB, created by Michael Calmer on 2005-04-27 09:06:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Calmer

Created: 2005-04-27 09:06:54 UTC

Size: 1.19 KB

patch

obsolete

>--- src/kdc/do_as_req.c
>+++ src/kdc/do_as_req.c	2005/04/27 08:54:30
>@@ -524,6 +524,10 @@
> 
>     retval = krb5_mk_error(kdc_context, &errpkt, scratch);
>     free(errpkt.text.data);
>-    *response = scratch;
>+    if (retval)
>+      free(scratch);
>+    else
>+      *response = scratch;
>+
>     return retval;
> }
>--- src/kdc/do_tgs_req.c
>+++ src/kdc/do_tgs_req.c	2005/04/27 08:55:37
>@@ -722,7 +722,11 @@
> 
>     retval = krb5_mk_error(kdc_context, &errpkt, scratch);
>     free(errpkt.text.data);
>-    *response = scratch;
>+    if (retval)
>+      free(scratch);
>+    else
>+      *response = scratch;
>+
>     return retval;
> }
> 
>--- src/kdc/network.c
>+++ src/kdc/network.c	2005/04/27 08:59:52
>@@ -722,6 +722,7 @@
>     char pktbuf[MAX_DGRAM_SIZE];
>     int port_fd = conn->fd;
> 
>+    response = NULL;
>     saddr_len = sizeof(saddr);
>     cc = recvfrom(port_fd, pktbuf, sizeof(pktbuf), 0,
> 		  (struct sockaddr *)&saddr, &saddr_len);
>--- src/lib/krb5/krb/unparse.c
>+++ src/lib/krb5/krb/unparse.c	2005/04/27 09:01:35
>@@ -91,6 +91,8 @@
> 				totalsize++;
> 		totalsize++;	/* This is for the separator */
> 	}
>+        if (nelem == 0)
>+                totalsize++;
> 
> 	/*
> 	 * Allocate space for the ascii string; if space has been

Actions: View | Diff

Attachments on bug 80574: 35646