From: Greg Hudson <ghudson@mit.edu>
Date: Sun, 12 Oct 2025 18:03:06 +0000 (-0400)
Subject: Ensure defined behavior in k5_kt_have_match()
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F1464%2Fhead;p=thirdparty%2Fkrb5.git

Ensure defined behavior in k5_kt_have_match()

match_entries() in ktfns.c admits uninitialized use of match if the
loop runs for zero iterations (the keytab is valid but contains no
entries).  Initialize match to false to properly handle this case.
Fixes a -Werror compilation failure on macOS 10.6.8 reported by Sergey
Fedorov.
---

diff --git a/src/lib/krb5/keytab/ktfns.c b/src/lib/krb5/keytab/ktfns.c
index d6658b35f2..f3945f9daf 100644
--- a/src/lib/krb5/keytab/ktfns.c
+++ b/src/lib/krb5/keytab/ktfns.c
@@ -138,7 +138,7 @@ match_entries(krb5_context context, krb5_keytab keytab,
     krb5_error_code ret;
     krb5_keytab_entry ent;
     krb5_kt_cursor cursor;
-    krb5_boolean match;
+    krb5_boolean match = FALSE;
 
     /* Scan the keytab for host-based entries matching accprinc. */
     ret = krb5_kt_start_seq_get(context, keytab, &cursor);