Fix handling of invalid CAMMAC service verifier

In extract_cammacs(), avoid a null dereference if the CAMMAC service
verifier is invalid or the CAMMAC is empty.

ticket: 8856
tags: pullup
target_version: 1.17-next

diff --git a/src/lib/krb5/krb/authdata.c b/src/lib/krb5/krb/authdata.c
index 3685fcd916f72676c82ecf48cea0f2395ff3a101..7f28883be698debd2979eaceb7ede62464f745f4 100644 (file)
--- a/src/lib/krb5/krb/authdata.c
+++ b/src/lib/krb5/krb/authdata.c
@@ -557,6 +557,8 @@ extract_cammacs(krb5_context kcontext, krb5_authdata **cammacs,
         if (ret && ret != KRB5KRB_AP_ERR_BAD_INTEGRITY)
             goto cleanup;
         ret = 0;
+        if (elements == NULL)
+            continue;
 
         /* Add the verified elements to list and free the container array. */
         for (n_elements = 0; elements[n_elements] != NULL; n_elements++);