Reject extra realm separators in principal names

Commit f609e5caff410cc8f71db7d95b4da219541437db accidentally omitted
the check for extra realm separators, leading to an assertion error
when parsing x@y@z or similar.  Restore the check.

diff --git a/src/lib/krb5/krb/parse.c b/src/lib/krb5/krb/parse.c
index cf3cce9d0d62e5ba15768f805e4da8a896404b12..613e41d1ff371ff667308bde4c3607642a0f7def 100644 (file)
--- a/src/lib/krb5/krb/parse.c
+++ b/src/lib/krb5/krb/parse.c
@@ -79,6 +79,8 @@ allocate_princ(krb5_context context, const char *name, krb5_boolean enterprise,
         } else if (*p == '@' && (!enterprise || !first_at)) {
             /* Realm separator.  In enterprise principals, the first one of
              * these we see is part of the component. */
+            if (cur_data == &princ->realm)
+                return KRB5_PARSE_MALFORMED;
             cur_data = &princ->realm;
         } else {
             /* Component or realm character, possibly quoted.  Make note if